diff --git a/quest/m1/README.md b/quest/m1/README.md index 3fe2ed0bf93..bed6f7d8fba 100644 --- a/quest/m1/README.md +++ b/quest/m1/README.md @@ -176,6 +176,9 @@ per-frame CPU growth since #5926. - [HLS export lists a same-codec reconfigure's first group under the new init](/quest/m1/hls-reinit-same-codec.md) - the hand-over pick, whichever of the catalog and the records arrives first, after the catalog `hls` removal is planned - [Ordered reads can skip owed holes, and snapshot latest() does](/quest/m1/ordered-owed-holes.md) - moq-net's `Ordered` gains a read that skips past an owed hole to the newest buffered group, while keeping the reader's bounds - [A Rust relay never replays from group 0 to a lite-03/04 subscriber](/quest/m1/relay-inflight-replay.md) - A Rust relay or publisher serving a lite-03 or lite-04 SUBSCRIBE from a track copy that is still resolving starts at the newest group once the copy resolves +- [Rename moq-rtc to moq-webrtc](/quest/m1/webrtc-rename.md) - one published `moq-webrtc` crate holds the gateway, the ICE driver, and the data-channel transport +- [Vendor and trim the WebRTC stack](/quest/m1/webrtc-vendor.md) - str0m, dimpl, `is`, and sctp-proto live in moq-webrtc with unused code removed, so moq-rtc can take rind +- [MoQ on rind](/quest/m1/rind/README.md) - every MoQ crate takes its crypto from rind, a pure-Rust graviola fork, so no build compiles C crypto ## Related diff --git a/quest/m2/rind/README.md b/quest/m1/rind/README.md similarity index 88% rename from quest/m2/rind/README.md rename to quest/m1/rind/README.md index cf6435cb00a..b9013cd7f91 100644 --- a/quest/m2/rind/README.md +++ b/quest/m1/rind/README.md @@ -47,8 +47,9 @@ instead, so every crate drops C, not just the relay. Decided 2026-10-31 (maintainer): each area waits only on the rind pieces it uses, so most areas switch on rind 0.1.2 (published 2026-11-01), which runs on CPUs without the crypto extensions (e2ee, which no binary links, switched - on 0.1.0), and only relay - ACME waits on `rind-instant-acme`. aws-lc-rs stays in the workspace until + on 0.1.0). Relay ACME, the one area that waited on `rind-instant-acme`, is + removed for now instead (maintainer, 2026-11-03), and returns on rind in m3. + aws-lc-rs stays in the workspace until the last area lands, which is when this epic removes it. - Split per area, each landing once rind covers it. Docs a change makes stale (CPU requirements, removed features) are edited inline in that area's PR; no @@ -64,7 +65,6 @@ The epic's own work, once every child has merged: ## Required -- [rind-instant-acme is on crates.io](/quest/m2/rind/instant-acme.md) - waiting on the adapter relay ACME needs -- [Transport on rind](/quest/m2/rind/transport.md) - moq-quic, moq-tokio, moq-uring, moq-rtmp, and qmux take rind, and the `aws-lc-rs`/`ring` features go -- [moq-rtc on rind](/quest/m2/rind/rtc.md) - str0m and dimpl run DTLS, SRTP, and STUN on rind -- [Relay ACME on instant-acme](/quest/m2/rind/acme.md) - moq-relay replaces rustls-acme with instant-acme on rind and owns renewal +- [Transport on rind](/quest/m1/rind/transport.md) - moq-quic, moq-tokio, moq-uring, moq-rtmp, and qmux take rind, and the `aws-lc-rs`/`ring` features go +- [moq-rtc on rind](/quest/m1/rind/rtc.md) - str0m and dimpl run DTLS, SRTP, and STUN on rind +- [moq-relay drops ACME for now](/quest/m1/rind/acme-remove.md) - the `acme` feature and rustls-acme go until ACME returns on rind diff --git a/quest/m1/rind/acme-remove.md b/quest/m1/rind/acme-remove.md new file mode 100644 index 00000000000..d1bf10de677 --- /dev/null +++ b/quest/m1/rind/acme-remove.md @@ -0,0 +1,14 @@ +# [S] moq-relay drops ACME for now + +## Goal + +moq-relay has no `acme` feature and no rustls-acme dependency, so the migration to rind no longer waits on instant-acme 0.9. Its config and docs no longer offer ACME; a relay serves certificates from files or generates self-signed ones, as without the feature today. + +## Plan + +Decided by the maintainer on 2026-11-03: ACME is a recent feature nobody uses yet, so it is removed until [relay ACME on instant-acme](/quest/m3/relay-acme.md) brings it back on rind. + +- Remove the `acme` feature, its rustls-acme dependency, the ACME config section, and the code behind it. +- Fix every doc and example that mentions it inline. + +Public API: moq-relay's `acme` feature and ACME config fields are removed (breaking for anyone setting them; the title gets `!`). Wire: none. diff --git a/quest/m2/rind/rtc.md b/quest/m1/rind/rtc.md similarity index 90% rename from quest/m2/rind/rtc.md rename to quest/m1/rind/rtc.md index 0f8be51688e..fc4c19d0670 100644 --- a/quest/m2/rind/rtc.md +++ b/quest/m1/rind/rtc.md @@ -10,7 +10,7 @@ hold no aws-lc-rs or str0m-aws-lc-rs, and a browser still connects. ## Plan Decided with the maintainer on 2026-10-26; see the -[epic](/quest/m2/rind/README.md). str0m's workspace dependency drops its +[epic](/quest/m1/rind/README.md). str0m's workspace dependency drops its `aws-lc-rs` feature, the test-only HMAC-SHA1 in `server/mux.rs` moves to rind, and reqwest switches to its no-provider feature. The existing browser interop tests prove the switch. @@ -30,4 +30,4 @@ offered. ## Required -- [Vendor and trim the stack](/quest/m2/webrtc/vendor.md) - where str0m and dimpl live once vendored +- [Vendor and trim the stack](/quest/m1/webrtc-vendor.md) - where str0m and dimpl live once vendored diff --git a/quest/m2/rind/transport.md b/quest/m1/rind/transport.md similarity index 94% rename from quest/m2/rind/transport.md rename to quest/m1/rind/transport.md index 02536ea7781..250928368b0 100644 --- a/quest/m2/rind/transport.md +++ b/quest/m1/rind/transport.md @@ -11,7 +11,7 @@ moq-tokio checks rind's CPU support at startup. ## Plan Decided with the maintainer on 2026-10-26; see the -[epic](/quest/m2/rind/README.md). +[epic](/quest/m1/rind/README.md). - moq-quic's direct calls move to rind's API: stateless reset HMAC-SHA256 and its HKDF-SHA256 key derivation, address-validation tokens (HKDF to @@ -28,7 +28,8 @@ Decided with the maintainer on 2026-10-26; see the - reqwest and axum-server switch to their no-provider features wherever these crates enable them. Decided 2026-10-31 (maintainer): this includes moq-relay's own reqwest, axum-server, and rustls `aws-lc-rs` features, which - no other area owns; relay ACME still owns rustls-acme. + no other area owns; rustls-acme leaves with + [ACME](/quest/m1/rind/acme-remove.md). - The roughly 100 test call sites that install aws-lc's provider install rind's. - The startup check runs where moq-tokio's crypto is first configured, and its diff --git a/quest/m2/webrtc/rename.md b/quest/m1/webrtc-rename.md similarity index 79% rename from quest/m2/webrtc/rename.md rename to quest/m1/webrtc-rename.md index fb2390acd78..0c31beae4e3 100644 --- a/quest/m2/webrtc/rename.md +++ b/quest/m1/webrtc-rename.md @@ -8,6 +8,8 @@ The published `moq-webrtc` crate holds what `moq-rtc`, `moq-ice`, and moq-tokio' Decided 2026-10-30 with the maintainer (planning interview); see the [epic](/quest/m2/webrtc/README.md). +Milestone: ✅ m1 (moved from m2, maintainer, 2026-11-03). Not chosen: keep it in m2, or send [moq-rtc on rind](/quest/m1/rind/rtc.md) back to m2. [Vendor and trim the WebRTC stack](/quest/m1/webrtc-vendor.md) requires this, and m1's rind epic requires the vendoring, so this sits at the m1 top level. It stays a child of the m2 [WebRTC epic](/quest/m2/webrtc/README.md). + - Move `rs/moq-rtc` to `rs/moq-webrtc` and merge `rs/moq-ice` in as a module. Keep the gateway's `server` feature; add a feature for the data-channel transport so WHIP/WHEP-only builds skip SCTP. - Move moq-tokio's `webrtc` module (`rs/moq-tokio/src/webrtc.rs`, host gathering, `.local` resolution) into moq-webrtc, built on moq-tokio's public session types. If the move needs something moq-tokio keeps private, bring the shape to the maintainer. - Update moq-cli's `rtc` subcommand, the bindings or examples that use the transport, `test/p2p`, and every doc and quest naming the old crates. diff --git a/quest/m2/webrtc/vendor.md b/quest/m1/webrtc-vendor.md similarity index 74% rename from quest/m2/webrtc/vendor.md rename to quest/m1/webrtc-vendor.md index d94aaba5fa3..2908aea189a 100644 --- a/quest/m2/webrtc/vendor.md +++ b/quest/m1/webrtc-vendor.md @@ -8,14 +8,16 @@ moq-webrtc builds str0m, dimpl, `is`, and sctp-proto from private in-tree module Decided 2026-10-30 with the maintainer (planning interview); see the [epic](/quest/m2/webrtc/README.md) for what goes and why. -- Vendor str0m and str0m-proto at the main-branch revision moq-dev/rind's `rind-str0m` targeted (`dc317173`, on dimpl 0.9 with str0m's pluggable crypto provider), with the dimpl, `is`, and sctp-proto versions it depends on (maintainer, 2026-10-31), so [moq-rtc on rind](/quest/m2/rind/rtc.md) can port rind's provider code unchanged. Commit them unchanged first so later diffs show only our changes, then trim. -- Remove: str0m's `bwe/`, leaky pacer, H.266, RED, DTMF, G.7xx and comfort noise, VLA and simulcast layers, RTCP XR and app feedback, stats, `_internal_test_exports`, the crypto backends other than the one rind will replace (keep the provider trait until [moq-rtc on rind](/quest/m2/rind/rtc.md)); dimpl's `dtls13/` and `auto.rs`. Keep upstream's tests for what remains. +Milestone: ✅ m1 (moved from m2, maintainer, 2026-11-03). Not chosen: keep it in m2, or send [moq-rtc on rind](/quest/m1/rind/rtc.md) back to m2. m1's [moq-rtc on rind](/quest/m1/rind/rtc.md) requires this, so it sits at the m1 top level. It stays a child of the m2 [WebRTC epic](/quest/m2/webrtc/README.md). + +- Vendor str0m and str0m-proto at the main-branch revision moq-dev/rind's `rind-str0m` targeted (`dc317173`, on dimpl 0.9 with str0m's pluggable crypto provider), with the dimpl, `is`, and sctp-proto versions it depends on (maintainer, 2026-10-31), so [moq-rtc on rind](/quest/m1/rind/rtc.md) can port rind's provider code unchanged. Commit them unchanged first so later diffs show only our changes, then trim. +- Remove: str0m's `bwe/`, leaky pacer, H.266, RED, DTMF, G.7xx and comfort noise, VLA and simulcast layers, RTCP XR and app feedback, stats, `_internal_test_exports`, the crypto backends other than the one rind will replace (keep the provider trait until [moq-rtc on rind](/quest/m1/rind/rtc.md)); dimpl's `dtls13/` and `auto.rs`. Keep upstream's tests for what remains. - Keep dimpl's typed `TimeoutError::Handshake` through the vendored `dtls.rs`, which str0m flattens into `CryptoError::Other(String)`, and replace moq-ice's text match for it with a typed match if [the typed DTLS timeout](/quest/m2/webrtc/dtls-timeout.md) has landed. - Keep the license files and record each upstream version in the module docs. - Drop the crates.io dependencies on str0m and friends from the workspace once nothing uses them. -Public API: none beyond what [rename](/quest/m2/webrtc/rename.md) changed. Wire: unchanged; the same DTLS 1.2 suites and SRTP profiles are offered. +Public API: none beyond what [rename](/quest/m1/webrtc-rename.md) changed. Wire: unchanged; the same DTLS 1.2 suites and SRTP profiles are offered. ## Required -- [Rename moq-rtc to moq-webrtc](/quest/m2/webrtc/rename.md) - the crate the stack is vendored into +- [Rename moq-rtc to moq-webrtc](/quest/m1/webrtc-rename.md) - the crate the stack is vendored into diff --git a/quest/m2/README.md b/quest/m2/README.md index e3c6bca8ba2..a0364c7a4d3 100644 --- a/quest/m2/README.md +++ b/quest/m2/README.md @@ -46,7 +46,6 @@ lite-07; bitrate enforcement is not part of this release. - [Generated C bindings](/quest/m2/c/README.md) - C generated from moq-ffi ships as `moq-c` 0.8.0 and replaces the hand-written crate - [A C origin can discover eagerly, like a relay](/quest/m2/c-origin-relay.md) - the C API puts an origin in relay mode, so forwarding a client session's routes needs no local announce watcher - [A runtime-free QUIC driver](/quest/m2/quic-sansio-driver.md) - a caller's own loop moves UDP datagrams and polls moq sessions over moq-quic, for rust2's bindings -- [MoQ on rind](/quest/m2/rind/README.md) - every MoQ crate takes its crypto from rind, a pure-Rust graviola fork, so no build compiles C crypto - [Benchmark sources](/quest/m2/bench-sources.md) - every measuring nightly benchmark feeds the regression table, and none is a smoke run - [QoS](/quest/m2/qos/README.md) - the relay's egress `lag` histogram and `dropped` counters on the stats totals and prefix tracks - [HLS and DASH browser playback](/quest/m2/hls-player-test.md) - hls.js and dash.js play, reload, switch, and survive reconfiguration nightly diff --git a/quest/m2/p2p/native-quic.md b/quest/m2/p2p/native-quic.md index fa85ec93ede..3ad34b16e62 100644 --- a/quest/m2/p2p/native-quic.md +++ b/quest/m2/p2p/native-quic.md @@ -23,7 +23,7 @@ Decided with the maintainer on 2026-10-13: are private to the data channel transport today, so move them into `moq-ice` rather than export them from `moq-tokio`. Decided 2026-10-30 (maintainer): `moq-ice`, the data-channel transport, and a vendored `is` all move into - `moq-webrtc` ([rename](/quest/m2/webrtc/rename.md)); take them from there. + `moq-webrtc` ([rename](/quest/m1/webrtc-rename.md)); take them from there. - QUIC is `moq-quic`, fed datagrams from the nominated pair. - Authentication: each side generates a self-signed certificate and sends its SHA-256 fingerprint in its offer or answer, as DTLS fingerprints ride diff --git a/quest/m2/rtc-pacing.md b/quest/m2/rtc-pacing.md index 9ff8235d0cc..201aac9ae93 100644 --- a/quest/m2/rtc-pacing.md +++ b/quest/m2/rtc-pacing.md @@ -63,7 +63,7 @@ its argument list rather than adding a fifth argument. Wire: none. ## Required -- [Vendor and trim the stack](/quest/m2/webrtc/vendor.md) - the vendored str0m this adds the NACK hook to +- [Vendor and trim the stack](/quest/m1/webrtc-vendor.md) - the vendored str0m this adds the NACK hook to ## Related diff --git a/quest/m2/webrtc/README.md b/quest/m2/webrtc/README.md index 2000042d4aa..4c24979304e 100644 --- a/quest/m2/webrtc/README.md +++ b/quest/m2/webrtc/README.md @@ -13,16 +13,16 @@ Decided 2026-10-30 with the maintainer (planning interview), after the str0m wor - **Vendor, then replace.** Copy the upstream crates in, trim them, and fix them in-tree. Replacing a layer with our own (SDP, RTP/RTCP, SRTP, SCTP) is a later child once a concrete need appears; none is planned yet. - **One crate.** `moq-ice` merges into it, since its only users are `moq-rtc` and moq-tokio's data-channel transport. moq-tokio's `webrtc` feature moves into `moq-webrtc` as well, which breaks the cycle (`moq-webrtc` depends on moq-tokio; moq-tokio would otherwise need ICE and SCTP). The vendored crates become private modules, not separate published crates, keeping their MIT/Apache-2.0 notices (str0m's `packet/` carries webrtc-rs's Apache notice). - **What goes** (from the 2026-10-30 inventory: we use frame mode, full ICE, and DTLS 1.2, and never enable str0m's BWE, pacer, or stats): GCC bandwidth estimation (8k lines; GCC is ported into `moq-congestion` as `moq_congestion::gcc`), the leaky pacer (replaced by moq-congestion's pacer, made public by [rtc-pacing](/quest/m2/rtc-pacing.md)), H.266, RED, DTMF, G.7xx and comfort noise, VLA and simulcast layers, RTCP XR and app feedback, stats, internal test exports, and dimpl's DTLS 1.3 and version auto-selection. Roughly 17k of str0m's 72k lines and 11k of dimpl's 33k. -- **DTLS 1.2 only.** Every browser negotiates 1.2 today. [moq-rtc on rind](/quest/m2/rind/rtc.md) narrows to 1.2 to match. +- **DTLS 1.2 only.** Every browser negotiates 1.2 today. [moq-rtc on rind](/quest/m1/rind/rtc.md) narrows to 1.2 to match. - **SCTP stays**, for browser data channels in [P2P](/quest/m2/p2p/README.md), but compiles only with the data-channel feature, so WHIP/WHEP builds carry none of it. Vendored, it can later be simplified or put on moq-congestion. - **Upstream fixes:** after vendoring, nobody merges upstream automatically. Record the vendored upstream versions in the crate docs; the release-cut audit checks the upstream changelogs for security fixes (malformed SRTP/RTCP input, for example) and ports them. - Docs a change makes stale (crate names, `doc/lib/rs`, `doc/setup/upgrade.md`, other quests naming `moq-rtc` or `moq-ice`) change in the PR that makes them stale. ## Required +- [Rename moq-rtc to moq-webrtc](/quest/m1/webrtc-rename.md) - one crate holds the gateway, the ICE driver, and the data-channel transport +- [Vendor and trim the stack](/quest/m1/webrtc-vendor.md) - str0m, dimpl, `is`, and sctp-proto live in moq-webrtc with unused code removed - [A typed DTLS handshake timeout error](/quest/m2/webrtc/dtls-timeout.md) - callers match a DTLS handshake timeout by variant, and session end treats it like an ICE timeout -- [Rename moq-rtc to moq-webrtc](/quest/m2/webrtc/rename.md) - one crate holds the gateway, the ICE driver, and the data-channel transport -- [Vendor and trim the stack](/quest/m2/webrtc/vendor.md) - str0m, dimpl, `is`, and sctp-proto live in moq-webrtc with unused code removed - [Several bandwidth lines per media section](/quest/m2/webrtc/sdp-bandwidth.md) - answers carry both `b=TIAS` and `b=AS` without splicing - [DTLS waits for ICE](/quest/m2/webrtc/dtls-after-ice.md) - DTLS flights start once ICE nominates a pair, so a late ICE path can't exhaust them - [The stack takes kio clock time](/quest/m2/webrtc/clock.md) - the vendored code takes `kio::clock::Instant`, so sim tests drive it directly @@ -30,4 +30,4 @@ Decided 2026-10-30 with the maintainer (planning interview), after the str0m wor ## Related - [moq-rtc paces WHEP viewers](/quest/m2/rtc-pacing.md) - adds the NACK hook and the shared pacer on the vendored stack -- [moq-rtc on rind](/quest/m2/rind/rtc.md) - the vendored DTLS and SRTP take rind's crypto +- [moq-rtc on rind](/quest/m1/rind/rtc.md) - the vendored DTLS and SRTP take rind's crypto diff --git a/quest/m2/webrtc/clock.md b/quest/m2/webrtc/clock.md index 832da2839e2..decf8794ed7 100644 --- a/quest/m2/webrtc/clock.md +++ b/quest/m2/webrtc/clock.md @@ -12,4 +12,4 @@ Public API: none. Wire: none. ## Required -- [Vendor and trim the stack](/quest/m2/webrtc/vendor.md) - the modules whose time type changes +- [Vendor and trim the stack](/quest/m1/webrtc-vendor.md) - the modules whose time type changes diff --git a/quest/m2/webrtc/dtls-after-ice.md b/quest/m2/webrtc/dtls-after-ice.md index 30f9c2597c1..af3d8fc1816 100644 --- a/quest/m2/webrtc/dtls-after-ice.md +++ b/quest/m2/webrtc/dtls-after-ice.md @@ -12,4 +12,4 @@ Public API: none. Wire: none. ## Required -- [Vendor and trim the stack](/quest/m2/webrtc/vendor.md) - the DTLS activation this moves +- [Vendor and trim the stack](/quest/m1/webrtc-vendor.md) - the DTLS activation this moves diff --git a/quest/m2/webrtc/dtls-timeout.md b/quest/m2/webrtc/dtls-timeout.md index 806137f9856..c1f6ea213fe 100644 --- a/quest/m2/webrtc/dtls-timeout.md +++ b/quest/m2/webrtc/dtls-timeout.md @@ -4,7 +4,7 @@ A DTLS handshake that times out after ICE connects surfaces as its own error variant in `moq-ice` and `moq-rtc` (or `moq-webrtc`, after the -[rename](/quest/m2/webrtc/rename.md)), so callers match it instead of the text +[rename](/quest/m1/webrtc-rename.md)), so callers match it instead of the text `rtc error: DTLS error: timeout: handshake` inside `Error::Rtc(String)`. Session-end handling and logging treat it like an ICE timeout: `session::end` logs it at debug as abandoned-session churn, not as a warning. @@ -18,7 +18,7 @@ dimpl's typed `Error::Timeout(TimeoutError::Handshake)` into before moq-ice sees it. - Classify it once at the str0m boundary in moq-ice, the only place that sees - str0m's error. Until the [vendored stack](/quest/m2/webrtc/vendor.md) lands, + str0m's error. Until the [vendored stack](/quest/m1/webrtc-vendor.md) lands, that is a text match there, pinned by a test against the crate's real message. If the vendoring lands first, carry dimpl's variant through the vendored `dtls.rs` typed instead, and add no text match. Otherwise the @@ -35,5 +35,5 @@ Public API: additive variants on non-exhaustive error enums. Wire: none. ## Related -- [Vendor and trim the WebRTC stack](/quest/m2/webrtc/vendor.md) - replaces this quest's text match with dimpl's typed timeout +- [Vendor and trim the WebRTC stack](/quest/m1/webrtc-vendor.md) - replaces this quest's text match with dimpl's typed timeout - [DTLS waits for ICE](/quest/m2/webrtc/dtls-after-ice.md) - after it, every DTLS handshake timeout comes after nomination, which is the case this types diff --git a/quest/m2/webrtc/sdp-bandwidth.md b/quest/m2/webrtc/sdp-bandwidth.md index d07b203d4df..18c8f26693f 100644 --- a/quest/m2/webrtc/sdp-bandwidth.md +++ b/quest/m2/webrtc/sdp-bandwidth.md @@ -12,4 +12,4 @@ Public API: none. Wire: capped answers gain `b=AS`. ## Required -- [Vendor and trim the stack](/quest/m2/webrtc/vendor.md) - the parser this changes +- [Vendor and trim the stack](/quest/m1/webrtc-vendor.md) - the parser this changes diff --git a/quest/m3/README.md b/quest/m3/README.md index 14cab45ef37..3a5233a004e 100644 --- a/quest/m3/README.md +++ b/quest/m3/README.md @@ -84,3 +84,5 @@ m4's upstream waits in here and moved m2 work with no consumer. - [Rust and JS end a lite-05 track the same way after an inclusive SUBSCRIBE_END](/quest/m3/lite05-subscribe-end.md) - after a legacy inclusive SUBSCRIBE_END, Rust and JS both end the track instead of Rust sending a FIN and JS only releasing - [Byte-at-a-time MKV input imports as fast as chunked input](/quest/m3/mkv-input-coalesce.md) - the MKV importer fed one byte at a time is no slower than before moq-dev/moq#7234 - [A transcode ladder probes an unseen source shape without stalling its other rungs](/quest/m3/transcode-parallel-open.md) - a source changing to an unseen size opens the new encoders without stalling the ladder's other rungs +- [rind-instant-acme is on crates.io](/quest/m3/rind-instant-acme.md) - waiting on instant-acme 0.9 and rind publishing its adapter +- [Relay ACME on instant-acme](/quest/m3/relay-acme.md) - moq-relay's ACME returns on instant-acme and rind, once a user needs it diff --git a/quest/m2/rind/acme.md b/quest/m3/relay-acme.md similarity index 60% rename from quest/m2/rind/acme.md rename to quest/m3/relay-acme.md index 69627b6dd60..734d24bad8f 100644 --- a/quest/m2/rind/acme.md +++ b/quest/m3/relay-acme.md @@ -2,9 +2,9 @@ ## Goal -moq-relay's default `acme` feature issues and renews certificates through +moq-relay's `acme` feature returns: it issues and renews certificates through instant-acme on `rind-instant-acme`, with no rustls-acme, and its graph holds -no aws-lc-rs. Existing config and the on-disk cache keep working. +no aws-lc-rs. ## Plan @@ -18,12 +18,14 @@ so moq-relay moves to instant-acme 0.9, which takes its crypto through its own - the TLS-ALPN-01 challenge resolver in its rustls config, - key and CSR generation through `rind-rcgen`. -The cache's file naming (SHA-256 today) moves to rind and stays compatible, so -an upgraded relay reuses its cached account and certificate. Test against a -local ACME server such as Pebble. +Its cache's file naming moves to rind. m1 removed the feature, its config, and +its cache because nobody used ACME yet (maintainer, 2026-11-03), so the cache +needs no compatibility with the rustls-acme layout. Test against a local ACME +server such as Pebble. -Public API: none; config unchanged. Wire: none. +Public API: moq-relay regains the `acme` feature and an ACME config section. +Wire: none. ## Required -- [rind-instant-acme is on crates.io](/quest/m2/rind/instant-acme.md) - the adapter this uses, waiting on instant-acme 0.9 +- [rind-instant-acme is on crates.io](/quest/m3/rind-instant-acme.md) - the adapter this uses, waiting on instant-acme 0.9 diff --git a/quest/m2/rind/instant-acme.md b/quest/m3/rind-instant-acme.md similarity index 78% rename from quest/m2/rind/instant-acme.md rename to quest/m3/rind-instant-acme.md index 20deda9ffec..d4ac278331f 100644 --- a/quest/m2/rind/instant-acme.md +++ b/quest/m3/rind-instant-acme.md @@ -4,12 +4,12 @@ `rind-instant-acme` is on crates.io, built on a published instant-acme 0.9. It holds once moq-dev/rind's -[Publish rind-instant-acme](https://github.com/moq-dev/rind/blob/main/quest/m1/moq/instant-acme-publish.md) +[Publish rind-instant-acme](https://github.com/moq-dev/rind/blob/main/quest/m3/instant-acme-publish.md) quest is deleted and `cargo search rind-instant-acme` shows it. This quest only waits; delete it once that holds. ## Plan rind's adapter waits on instant-acme's 0.9 release, which carries the -pluggable `CryptoProvider`. Only [relay ACME](/quest/m2/rind/acme.md) needs +pluggable `CryptoProvider`. Only [relay ACME](/quest/m3/relay-acme.md) needs it (maintainer, 2026-10-31).