[aofusa]

Description

Adds veil as an infrastructure entry: veil is a reverse proxy / web
server written in Rust on its own async runtime (no tokio). The entry uses veil's published container image
(ghcr.io/aofusa/veil:musl-v0.10.1, the full-container build: epoll readiness reactor) and adds a configuration
file and a Proxy-Wasm module. I maintain veil.

How the endpoints are answered (nothing is proxied to an upstream application):

• /baseline11 (GET, and POST with Content-Length or chunked), /baseline2, /pipeline, /json/{count}?m= are
  answered by a Proxy-Wasm module (filter/, Rust, compiled to wasm32-wasip1 in the Dockerfile) loaded into veil,
  on a type = "Respond" route. The POST body is read in the request-body phase. The dataset is read by veil at startup
  (data_files) and parsed once per module instance; the JSON response is serialized on every request.
• /static/* is veil's File backend with its open-file and content caches (watch = true: inotify, so replaced
  files are served immediately) and [route.compression] (br/gzip on HTTP/1.1, HTTP/2 and HTTP/3; uncompressed HTTP/1.1
  responses are sent with sendfile).
• One veil process with four [[listener]]s: 8080 HTTP/1.1, 8081 TLS HTTP/1.1 only (no h2 in ALPN), 8082 h2c,
  8443 TLS h2 + HTTP/3 (quiche). TLS is rustls; worker threads follow the container's CPUs; access log off.
• veil's hardening stays on: privileges dropped to nonroot, seccomp, Landlock limited to /certs, /data,
  /etc/veil.

Subscribed profiles: baseline, pipelined, limited-conn, json-tls, static-tls, baseline-h2, static-h2, baseline-h2c,
json-h2c, baseline-h3, static-h3.

Local validation (./scripts/validate.sh veil, the published ghcr.io/aofusa/veil:musl-v0.10.1): 72 passed, 0 failed (frag 9/9, h2/h2c, h3, static-tls compression).

🤖 Generated with Claude Code