Context

Sites need TLS by SNI with certificates issued on demand, FastCGI to PHP, proxying to dev servers with WebSockets, request recording, and a share listener with access rules.

Decision

Write the proxy in Rust with hyper, rustls and fastcgi-client, inside leashd. PHP requests go through a Valet-derived server.php for framework compatibility.

Consequences

One process to supervise and no config files to generate or reload. Request recording and access rules are ordinary code with tests. We own HTTP edge cases ourselves.

The Valet-derived server.php was never built: the proxy picks a PHP site's script itself, the way nginx's try_files does (proxy::php), so Short Leash includes no code from Laravel Valet.

Serving files is ours too, so the rules nginx configs usually add are in proxy::files: no dotfile or dot folder is served as a file except .well-known, on a site's address and its share alike, and a static site serves nothing through a link that leaves its folder. PHP sites keep following links, since their code can read those files anyway.