TLS configuration
Why explicit context#
A caller-built TlsContext keeps cipher suites, protocol versions, post-quantum groups and SNI certificates reachable and configurable — nothing about the TLS surface is decided for you by the server.
import serve, serve/reactor
let ctx = newTlsContext(certFile = "cert.pem", keyFile = "key.pem")
serveHttpsReactor(8443, ctx, handler)See reactor_tlsconf.nim in the repo — "reactor TLS servers take a caller-built context."
ALPN and one-port dispatch#
When a TlsContext is passed to serveHttpsAlpnReactor or serveAllReactor, ALPN negotiation during the TLS handshake decides HTTP/1.1 vs HTTP/2 automatically — see HTTP/2 for the full one-port pattern, and The reactor for how QUIC joins the same port over UDP.
QUIC transport parameters#
QUIC transport parameters (used by the HTTP/3 and WebTransport paths) are runtime configuration rather than compile-time constants — see the repo's recent commit "quic: transport parameters become runtime configuration." This keeps idle timeouts, flow-control windows and similar QUIC-level tuning adjustable without a rebuild.