{"id":49913559,"url":"https://github.com/true-async/server","last_synced_at":"2026-05-19T21:08:54.712Z","repository":{"id":353936238,"uuid":"1216892930","full_name":"true-async/server","owner":"true-async","description":"TrueAsync Server","archived":false,"fork":false,"pushed_at":"2026-05-11T13:35:53.000Z","size":1866,"stargazers_count":12,"open_issues_count":5,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-05-11T13:39:25.308Z","etag":null,"topics":["async","grpc","http2","http2-server","http3","php","server","websocket"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/true-async.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-21T10:37:37.000Z","updated_at":"2026-05-11T12:00:45.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/true-async/server","commit_stats":null,"previous_names":["true-async/server"],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/true-async/server","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/true-async%2Fserver","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/true-async%2Fserver/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/true-async%2Fserver/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/true-async%2Fserver/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/true-async","download_url":"https://codeload.github.com/true-async/server/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/true-async%2Fserver/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33105712,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-16T04:41:52.686Z","status":"ssl_error","status_checked_at":"2026-05-16T04:41:52.009Z","response_time":115,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["async","grpc","http2","http2-server","http3","php","server","websocket"],"created_at":"2026-05-16T14:02:11.960Z","updated_at":"2026-05-16T14:02:16.063Z","avatar_url":"https://github.com/true-async.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n  \u003cimg src=\"logo.jpg\" alt=\"TrueAsync Server\" width=\"250\"/\u003e\n\u003c/p\u003e\n\n\u003ch1 align=\"center\"\u003eTrueAsync Server\u003c/h1\u003e\n\n\u003cp align=\"center\"\u003e\n  High-performance HTTP/1.1, HTTP/2, and HTTP/3 server as a native PHP extension,\u003cbr/\u003e\n  built on the \u003ca href=\"https://github.com/true-async\"\u003eTrueAsync\u003c/a\u003e event loop.\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"LICENSE\"\u003e\u003cimg src=\"https://img.shields.io/badge/license-Apache%202.0-blue.svg\" alt=\"License\"/\u003e\u003c/a\u003e\n  \u003cimg src=\"https://img.shields.io/badge/PHP-8.6%2B-blue.svg\" alt=\"PHP 8.6+\"/\u003e\n  \u003cimg src=\"https://img.shields.io/badge/HTTP-1.1%20%7C%202%20%7C%203-green.svg\" alt=\"HTTP 1.1 | 2 | 3\"/\u003e\n  \u003cimg src=\"https://img.shields.io/badge/TLS-1.2%20%7C%201.3-green.svg\" alt=\"TLS 1.2 | 1.3\"/\u003e\n  \u003cimg src=\"https://img.shields.io/badge/compression-gzip%20%7C%20br%20%7C%20zstd-green.svg\" alt=\"compression: gzip, brotli, zstd\"/\u003e\n  \u003cimg src=\"https://img.shields.io/badge/WebSocket-RFC%206455-orange.svg\" alt=\"WebSocket\"/\u003e\n  \u003cimg src=\"https://img.shields.io/badge/gRPC-supported-orange.svg\" alt=\"gRPC\"/\u003e\n  \u003cimg src=\"https://img.shields.io/badge/security-audited-brightgreen.svg\" alt=\"Security Audited\"/\u003e\n  \u003cimg src=\"https://img.shields.io/badge/platform-Linux%20%7C%20macOS%20%7C%20Windows-lightgrey.svg\" alt=\"Platform: Linux | macOS | Windows\"/\u003e\n\u003c/p\u003e\n\n---\n\nTrueAsync Server is a native PHP extension that runs a high-performance web server **directly inside PHP** — no separate process, no reverse proxy, no external daemon.\n\nThe defining characteristic is **multi-protocol in a single server**: HTTP/1.1, HTTP/2, WebSocket, SSE, and gRPC share the same TCP port and the same event loop — protocol selection happens via **ALPN negotiation** (for TLS) or **HTTP Upgrade**. HTTP/3 runs on the same UDP port (QUIC), advertised to clients through an `Alt-Svc` response header, so they transparently upgrade on subsequent requests.\n\nThis means you can serve a REST API over HTTP/2, push real-time events over Server-Sent Events, handle long-lived connections over WebSocket, and expose a gRPC endpoint — all from a single `$server-\u003estart()` call.\n\n---\n\n## Features\n\n| Status | Feature | Details |\n|--------|---------|---------|\n| ✅ Ready | **HTTP/1.1** | Full RFC 9112 compliance, keep-alive, pipelining |\n| ✅ Ready | **TLS 1.2 / 1.3** | OpenSSL 3.x, ALPN negotiation |\n| ✅ Ready | **Multipart / file uploads** | Streaming zero-copy parser |\n| ✅ Ready | **Backpressure** | CoDel (RFC 8289) adaptive pausing |\n| ✅ Ready | **Native coroutines** | Deep integration with TrueAsync async API |\n| ✅ Ready | **Zero-copy architecture** | Minimal allocations on hot paths |\n| ✅ Ready | **HTTP/2** | Multiplexing, server push (via nghttp2) |\n| ✅ Ready | **HTTP/3 / QUIC** | UDP transport via ngtcp2 + nghttp3; OpenSSL 3.5 QUIC API |\n| ✅ Ready | **Compression** | gzip (zlib-ng / zlib), Brotli, zstd — response encoding + inbound decode across H1/H2/H3. Server-side preference `zstd \u003e br \u003e gzip`; per-codec level setters. See [docs/COMPRESSION.md](docs/COMPRESSION.md). |\n| 📋 Planned | **WebSocket** | RFC 6455, upgrade from HTTP/1.1 and HTTP/2, full duplex |\n| 📋 Planned | **SSE (Server-Sent Events)** | RFC 8895, server-to-client event streaming |\n| 📋 Planned | **gRPC** | Built on HTTP/2, unary and streaming RPC |\n\n### Development Progress\n\n```\nHTTP/1.1   ████████████████████  100%\nTLS        ████████████████████  100%\nHTTP/2     ████████████████████  100%\nHTTP/3     ████████████████████  100%\nWebSocket  ░░░░░░░░░░░░░░░░░░░░    0%\nSSE        ░░░░░░░░░░░░░░░░░░░░    0%\ngRPC       ░░░░░░░░░░░░░░░░░░░░    0%\n```\n\nAll ten ship-gates of the HTTP/3 plan (transport, TLS 1.3, request/response, streaming, lifecycle + drain, Alt-Svc, compliance smoke, fuzzing) are merged. Open items are post-ship performance follow-ups — `recvmmsg` inbound batching and Linux GSO outbound coalescing — that require upstream TrueAsync API extensions, plus optional ECN/pacing.\n\n---\n\n## Architecture\n\nTrueAsync Server follows the **single-threaded event loop** model — the same approach used by\n[NGINX](https://nginx.org), [Envoy](https://www.envoyproxy.io), [Node.js](https://nodejs.org),\nand Rust's [Tokio](https://tokio.rs)/[hyper](https://hyper.rs).\n\nThe core idea: **one thread owns both the connection and the request from start to finish**.\nThere is no handoff between an \"accept thread\" and a \"worker thread\", no lock contention,\nno context switch between the two. A single event loop receives the connection, reads bytes off\nthe socket, parses the HTTP stream, dispatches the request to user code, and writes the response\n— all without leaving the thread.\n\n```\n         ┌─────────────────────────────────────────┐\n         │              Event Loop Thread          │\n         │                                         │\n  accept ─►  parse  ─►  dispatch  ─►  respond      │\n         │     ▲                        │          │\n         │     └──── coroutine yield ◄──┘          │\n         └─────────────────────────────────────────┘\n```\n\nNon-blocking I/O is handled by the **libuv reactor** (via TrueAsync). When a coroutine needs to\nwait for I/O — reading a file, querying a database, waiting for the next WebSocket frame — it\nyields back to the event loop, which immediately picks up the next ready event. No thread sits\nidle waiting.\n\nTo scale across CPU cores, multiple worker processes are launched (one per core) with\n`SO_REUSEPORT`, so the kernel distributes incoming connections across them. Each process runs its\nown fully independent event loop — no shared state, no global locks.\n\nThis model delivers predictable latency, low memory footprint under high concurrency, and\nnear-linear horizontal scaling.\n\n---\n\n## Security\n\nSecurity is a first-class concern in TrueAsync Server.\n\n- **Security audit** — the codebase has undergone a dedicated security analysis covering HTTP parsing edge cases, TLS configuration, memory safety, and protocol-level attack vectors (HTTP request smuggling, HPACK bombing, QUIC amplification)\n- **Memory safety** — all hot paths are tested with AddressSanitizer and Valgrind; zero memory leaks policy enforced in CI\n- **TLS hardened** — TLS 1.2/1.3 only, weak cipher suites disabled, stateless session tickets, safe renegotiation disabled\n- **HTTP/3 security** — QUIC amplification limits and connection ID rotation implemented per RFC 9000 recommendations\n\nIf you discover a security vulnerability, please report it privately via GitHub Security Advisories.\n\n---\n\n## Requirements\n\n| Component | Min version | Required for | Notes |\n|---|---|---|---|\n| PHP | 8.6 | core | built with the [TrueAsync](https://github.com/true-async) `php-src` fork |\n| `ext-async` | latest `main` | core | provides the event loop and `udp_bind` API used by HTTP/3 |\n| OpenSSL | 3.0 (3.5 for HTTP/3) | TLS, HTTP/3 | HTTP/3 needs the QUIC TLS API that landed in OpenSSL 3.5 |\n| `libnghttp2` | 1.57 | HTTP/2 | floor enforced for rapid-reset mitigation (CVE-2023-44487) |\n| `libngtcp2` + `libngtcp2_crypto_ossl` | 1.22 | HTTP/3 | must be the OpenSSL crypto backend |\n| `libnghttp3` | 1.15 | HTTP/3 | |\n| `libuv` | bundled via TrueAsync | core | not linked directly by this extension |\n| [`llhttp`](https://github.com/nodejs/llhttp) | 9.3.0 | HTTP/1.1 | vendored under [`deps/llhttp/`](deps/llhttp/UPSTREAM.md) (MIT); same parser used by Node.js |\n\n\u003e Distro packages of OpenSSL/ngtcp2/nghttp3 are usually too old. The recommended path is to build OpenSSL 3.5 + ngtcp2 + nghttp3 from source into `/usr/local` (or `/opt/h3`) and point `PKG_CONFIG_PATH` at that prefix when running `./configure`.\n\n---\n\n## Installation — Linux\n\n### 1. Build prerequisites\n\n```bash\nsudo apt-get install -y \\\n    build-essential autoconf bison re2c pkg-config \\\n    libcmocka-dev   # for `--enable-tests`\n```\n\nOpenSSL 3.5, ngtcp2 1.22+, nghttp3 1.15+ are not in distro repos at the time of writing — install them from source under a single prefix (we use `/usr/local`):\n\n```bash\n# OpenSSL 3.5 with QUIC support\ngit clone --branch openssl-3.5 https://github.com/openssl/openssl\ncd openssl \u0026\u0026 ./Configure --prefix=/usr/local \u0026\u0026 make -j$(nproc) \u0026\u0026 sudo make install\nsudo ldconfig\n\n# ngtcp2 (OpenSSL crypto backend)\ngit clone --recursive https://github.com/ngtcp2/ngtcp2\ncd ngtcp2 \u0026\u0026 autoreconf -i \\\n  \u0026\u0026 ./configure --prefix=/usr/local --with-openssl --with-libnghttp3 \\\n                 PKG_CONFIG_PATH=/usr/local/lib/pkgconfig \\\n  \u0026\u0026 make -j$(nproc) \u0026\u0026 sudo make install\n\n# nghttp3\ngit clone --recursive https://github.com/ngtcp2/nghttp3\ncd nghttp3 \u0026\u0026 autoreconf -i \\\n  \u0026\u0026 ./configure --prefix=/usr/local \u0026\u0026 make -j$(nproc) \u0026\u0026 sudo make install\n```\n\n### 2. Build the extension\n\n```bash\nphpize\n./configure \\\n    --enable-http-server \\\n    --with-php-config=\"$(which php-config)\" \\\n    PKG_CONFIG_PATH=/usr/local/lib/pkgconfig\nmake -j$(nproc)\nsudo make install\n```\n\nHTTP/2 and HTTP/3 are enabled by default when their respective dependencies are detected (`libnghttp2 ≥ 1.57` for HTTP/2; `libngtcp2 ≥ 1.22`, `libnghttp3 ≥ 1.15`, and OpenSSL ≥ 3.5 for HTTP/3). To opt out: `--disable-http2`, `--disable-http3`.\n\nOptional flags: `--enable-tests` (links `libcmocka` for unit tests), `--enable-coverage` (gcov instrumentation), `--without-openssl` (build without TLS — disables HTTP/3 too).\n\n### 3. Enable in `php.ini`\n\n```ini\nextension=true_async_server\n```\n\nVerify:\n\n```bash\nphp --ri true_async_server\n```\n\nYou should see the protocol list (HTTP/1.1, HTTP/2, HTTP/3, TLS 1.2/1.3) and the runtime versions of OpenSSL, nghttp2, ngtcp2, nghttp3, and libuv.\n\n---\n\n## Installation — Windows\n\nThe Windows build follows the standard PHP-SDK flow. Static `.lib`s of OpenSSL 3.5, nghttp2, ngtcp2, and nghttp3 must be available under the PHP-SDK `deps\\` tree.\n\n```cmd\nREM From a \"Visual Studio x64 Native Tools\" prompt\nphpsdk_buildtree phpdev\ngit clone https://github.com/true-async/php-src.git\ncd php-src\ngit clone https://github.com/true-async/server ext\\true_async_server\n\nbuildconf.bat\nconfigure.bat ^\n    --disable-all ^\n    --enable-cli ^\n    --enable-async=shared ^\n    --enable-http-server=shared ^\n    --with-openssl=shared\n\nnmake\n```\n\nThe resulting `php_true_async_server.dll` lands in `x64\\Release_TS\\` (or `Release\\` for NTS). Copy it into your PHP `ext\\` directory and add `extension=true_async_server` to `php.ini`.\n\n\u003e HTTP/3 outbound batching uses `UDP_SEGMENT` (Linux GSO), which has no Windows equivalent. Throughput on Windows is therefore lower than on Linux for HTTP/3; HTTP/1.1 / HTTP/2 / TLS performance is unaffected.\n\n---\n\n## Build verification\n\nAfter `make install` (or copying the DLL on Windows), the test suite should pass cleanly:\n\n```bash\nphp run-tests.php -d extension_dir=\"$(pwd)/modules\" tests/phpt/\n```\n\nExpect ~123/124 PASS, with at most one environment-dependent skip.\n\n## Quick Start\n\n```php\nuse TrueAsync\\HttpServer;\nuse TrueAsync\\HttpServerConfig;\n\n$server = new HttpServer(\n    (new HttpServerConfig())\n        -\u003eaddListener('0.0.0.0', 8080)\n        -\u003esetWorkers(4)              // optional: spawn N worker threads\n);\n\n$server-\u003eaddHttpHandler(function ($request, $response) {\n    $response-\u003esetStatusCode(200)-\u003esetBody('Hello, World!');\n});\n\n$server-\u003estart();                    // blocks until every worker exits\n```\n\n`setWorkers(N)` opts into the built-in worker pool: the server spawns N\nthreads via `Async\\ThreadPool` and load-balances accept() across them\nwith `SO_REUSEPORT` (Linux/BSD). Default `1` keeps single-threaded\nbehaviour. See **[docs/USAGE.md](docs/USAGE.md)** for protocol-restricted\nlisteners (`addHttp1Listener`/`addHttp2Listener`/`addHttp3Listener`),\nTLS, compression, timeouts, backpressure and caveats.\n\nWorking examples live under [`examples/`](examples/):\n[`minimal-server.php`](examples/minimal-server.php),\n[`demo-server.php`](examples/demo-server.php),\n[`multi-worker.php`](examples/multi-worker.php),\n[`multi-worker-manual.php`](examples/multi-worker-manual.php).\n\n---\n\n## License\n\nLicensed under the [Apache License, Version 2.0](LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrue-async%2Fserver","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftrue-async%2Fserver","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrue-async%2Fserver/lists"}