Initial Fluxheim scaffold

Author: eldryoth

.gitignore

@@ -0,0 +1,2 @@
+/target/
+*.log

Cargo.lock

@@ -0,0 +1,22 @@
+[package]
+name = "fluxheim"
+version = "0.1.0"
+edition = "2024"
+rust-version = "1.95"
+license = "EUPL-1.2"
+publish = false
+description = "A modular Pingora-based reverse proxy, static web server, and cache."
+
+[features]
+default = ["proxy", "cache", "web", "tls", "acme", "metrics", "security"]
+proxy = []
+cache = []
+web = []
+tls = []
+acme = ["tls"]
+metrics = []
+security = []
+
+[dependencies]
+
+[dev-dependencies]

Cargo.toml

@@ -0,0 +1,64 @@
+# Fluxheim
+
+Fluxheim is planned as a modular Rust reverse proxy built on Pingora. The
+default binary will include proxying, caching, static file serving, TLS, ACME,
+metrics, and security controls. Each major capability is feature-gated so a
+smaller binary can be compiled when only one role is needed.
+
+## Current Baseline
+
+- Rust stable: `1.95.0`
+- Rust edition: `2024`
+- License: `EUPL-1.2`
+- Dependency policy: `deny.toml`
+
+## Feature Flags
+
+Default build:
+
+```bash
+cargo build
+```
+
+Proxy-only build:
+
+```bash
+cargo build --no-default-features --features proxy
+```
+
+Static web server-only build:
+
+```bash
+cargo build --no-default-features --features web
+```
+
+## Required Checks
+
+Run these before committing dependency or security-sensitive changes:
+
+```bash
+cargo fmt --all --check
+cargo clippy --all-targets --all-features -- -D warnings
+cargo test --all-features
+cargo deny check
+cargo audit
+```
+
+Install the security tools with locked versions from crates.io:
+
+```bash
+cargo install --locked cargo-deny
+cargo install --locked cargo-audit
+```
+
+The latest versions verified on May 4, 2026 were `cargo-deny 0.19.4` and
+`cargo-audit 0.22.1`.
+
+## Dependency Rules
+
+- Check crates.io/docs.rs before adding or upgrading dependencies.
+- Prefer maintained crates with clear SPDX license metadata.
+- Keep dependencies compatible with `EUPL-1.2`.
+- Do not add git dependencies unless pinned by revision and reviewed.
+- Run `cargo deny check licenses` after dependency changes.
+- Run `cargo audit` regularly and before releases.

README.md

@@ -0,0 +1,26 @@
+# Security Policy
+
+Fluxheim is security-sensitive infrastructure. Treat dependency, TLS, cache, and
+request-routing changes as high-risk until tested.
+
+## Routine Checks
+
+Run these regularly and before releases:
+
+```bash
+cargo deny check
+cargo deny check licenses
+cargo audit
+```
+
+## Dependency Policy
+
+The dependency policy lives in `deny.toml`. Unknown registries and git sources
+are denied by default. License exceptions must be narrow, named, versioned, and
+documented with the reason for acceptance.
+
+## Reporting
+
+Do not publish exploitable security details before a fix is available. Open a
+private security advisory or contact the maintainers directly once the project
+has public repository security channels configured.

SECURITY.md

@@ -0,0 +1,57 @@
+# Fluxheim dependency policy.
+#
+# Fluxheim is an EUPL-1.2 project. Third-party dependencies are checked with a
+# narrow allow-list so incompatible or unclear licenses fail early.
+
+[graph]
+all-features = true
+
+[licenses]
+confidence-threshold = 0.95
+include-dev = true
+include-build = true
+unused-allowed-license = "allow"
+unused-license-exception = "deny"
+
+allow = [
+    "0BSD",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-1-Clause",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "BSL-1.0",
+    "EUPL-1.2",
+    "ISC",
+    "MIT",
+    "MIT-0",
+    "Unicode-3.0",
+    "Zlib",
+]
+
+exceptions = [
+    # TLS root stores can carry reviewed data licenses. Keep exceptions narrow;
+    # do not globally allow CDLA-Permissive-2.0 for code.
+]
+
+[licenses.private]
+ignore = true
+
+[bans]
+multiple-versions = "allow"
+wildcards = "allow"
+highlight = "all"
+
+[advisories]
+yanked = "deny"
+unmaintained = "workspace"
+unsound = "workspace"
+unused-ignored-advisory = "deny"
+ignore = []
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+required-git-spec = "rev"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []

deny.toml

@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.95.0"
+components = ["clippy", "rustfmt"]

rust-toolchain.toml

@@ -0,0 +1,8 @@
+#!/usr/bin/env sh
+set -eu
+
+cargo fmt --all --check
+cargo clippy --all-targets --all-features -- -D warnings
+cargo test --all-features
+cargo deny check
+cargo audit

scripts/checks.sh

@@ -0,0 +1,3 @@
+pub fn enabled() -> bool {
+    true
+}

src/acme.rs

@@ -0,0 +1,3 @@
+pub fn enabled() -> bool {
+    true
+}