tpt-gatemesh

A memory-safe, Wasm-extensible API gateway and service mesh in Rust with formally-verified, loop-free routing topologies.

Features

• HTTP/1.1, HTTP/2, HTTP/3 (QUIC) — full protocol support
• TLS/mTLS — rustls-based termination with client certificate verification
• Routing verification — routing topologies are modeled as a directed graph and verified loop-free and fully reachable before deployment
• Wasm plugins — capability-based sandboxed plugin runtime (wasmtime) with fuel/timeout limits
• Rate limiting — token-bucket per-route and global
• Auth — API key, JWT validation, RBAC
• Service mesh — sidecar mode with mTLS, circuit breaker, retries, load balancing
• Ambient/eBPF mode — (prototype) node-level traffic interception without sidecar injection
• Prometheus metrics — real-time request/error/latency counters
• Chaos testing — built-in fault injection for resilience validation

Quick Start

Build

cargo build --release

Run

# Validate a config
./target/release/tpt-gatemesh admin validate config.json

# Start the gateway
./target/release/tpt-gatemesh serve --config config.json

# Show effective config
./target/release/tpt-gatemesh admin show-config --config config.json

# Verify routing graph
./target/release/tpt-gatemesh admin verify-routing --config config.json

Example Config

{
  "listen": "0.0.0.0:8443",
  "tls": {
    "cert_path": "server.pem",
    "key_path": "server-key.pem"
  },
  "routes": [
    {
      "name": "api",
      "match": { "host": "api.example.com", "path_prefix": "/v1" },
      "upstream": { "url": "http://backend:8080" }
    }
  ]
}

Architecture

tpt-gatemesh/
├── crates/
│   ├── core/       # Shared config, routing, policy types
│   ├── edge/       # Ingress/egress proxy (TLS, routing, rate limit, auth)
│   ├── fabric/     # Service mesh data plane (sidecar, ambient/eBPF)
│   ├── wasm/       # Sandboxed Wasm plugin runtime (wasmtime)
│   └── control/    # Control plane (config distribution, routing verification)
├── fuzz/           # Fuzz testing targets
└── docs/           # Deployment guides

Testing

cargo test --all
cargo clippy --all-targets
cargo fmt --all -- --check

Documentation

• Bare Metal Deployment
• Kubernetes Sidecar
• Kubernetes Ambient

License

Dual-licensed under MIT or Apache-2.0, at your option.