fix: use http protocols and remove deprecated (#197)

Author: nrwiersma

http/server.go

@@ -8,15 +8,14 @@ import (
 	"log"
 	"net"
 	"net/http"
+	"slices"
 	"sync"
 	"time"
 
 	"github.com/hamba/logger/v2"
 	lctx "github.com/hamba/logger/v2/ctx"
 	"github.com/hamba/pkg/v2/http/healthz"
 	"github.com/hamba/statter/v2"
-	"golang.org/x/net/http2"
-	"golang.org/x/net/http2/h2c"
 )
 
 var testHookServerServe func(net.Listener)
@@ -128,20 +127,25 @@ func (s *GenericServer[T]) runServer(
 	if err != nil {
 		return nil, nil, err
 	}
+	var tlsCfg *tls.Config
 	if s.TLSConfig != nil {
-		ln = tls.NewListener(ln, s.TLSConfig)
+		tlsCfg = s.TLSConfig.Clone()
+		if !slices.Contains(tlsCfg.NextProtos, "h2") {
+			tlsCfg.NextProtos = append([]string{"h2"}, tlsCfg.NextProtos...)
+		}
+		ln = tls.NewListener(ln, tlsCfg)
 	}
 
 	if testHookServerServe != nil {
 		testHookServerServe(ln)
 	}
 
-	// If there is no TLS, setup h2c.
+	protos := &http.Protocols{}
+	protos.SetHTTP1(true)
+	protos.SetHTTP2(true)
 	if s.TLSConfig == nil {
-		h2s := &http2.Server{
-			IdleTimeout: s.IdleTimeout,
-		}
-		h = h2c.NewHandler(h, h2s)
+		// If there is no TLS, setup unencrypted HTTP/2 (h2c).
+		protos.SetUnencryptedHTTP2(true)
 	}
 
 	srv := &http.Server{
@@ -150,12 +154,13 @@ func (s *GenericServer[T]) runServer(
 			return ctx
 		},
 		Handler:           h,
-		TLSConfig:         s.TLSConfig,
+		TLSConfig:         tlsCfg,
 		ReadHeaderTimeout: withDefault(s.ReadHeaderTimeout, time.Second),
 		ReadTimeout:       withDefault(s.ReadTimeout, 10*time.Second),
 		WriteTimeout:      withDefault(s.WriteTimeout, 10*time.Second),
 		IdleTimeout:       withDefault(s.IdleTimeout, 120*time.Second),
 		ErrorLog:          log.New(s.Log.Writer(logger.Error), "", 0),
+		Protocols:         protos,
 	}
 
 	serverShutdownCh := make(chan struct{})
@@ -197,7 +202,7 @@ func (s *GenericServer[T]) shutdownTimeout() time.Duration {
 func withDefault[T comparable](val, def T) T {
 	var defT T
 	if val == defT {
-		return val
+		return def
 	}
-	return def
+	return val
 }

http/server/server.go

@@ -3,6 +3,7 @@ package server
 import (
 	"context"
 	"crypto/tls"
+	"crypto/x509"
 	"io"
 	"net"
 	"net/http"
@@ -108,7 +109,7 @@ func TestGenericServer_RunWithTLS(t *testing.T) {
 	go func() {
 		defer close(shutdownCh)
 
-		err := srv.Run(ctx)
+		err = srv.Run(ctx)
 
 		assert.NoError(t, err)
 	}()
@@ -386,11 +387,20 @@ func TestGenericServer_RunHandlesUnexpectedListenerClose(t *testing.T) {
 func requireDoRequest(t *testing.T, path string) (int, string) {
 	t.Helper()
 
+	certPool := x509.NewCertPool()
+	ok := certPool.AppendCertsFromPEM(localhostCert)
+	require.True(t, ok, "failed to append cert to pool")
+
+	protos := &http.Protocols{}
+	protos.SetHTTP2(true)
+	protos.SetUnencryptedHTTP2(true)
+
 	client := &http.Client{
 		Transport: &http.Transport{
 			TLSClientConfig: &tls.Config{
-				InsecureSkipVerify: true,
+				RootCAs: certPool,
 			},
+			Protocols: protos,
 		},
 	}