QUIC tunnel transport

QUIC is now available as the transport between an rstream client and the edge.

The published side of the tunnel does not change. A project can still expose HTTP, TLS, DTLS, or QUIC endpoints while the publishing client carries its control channel and upstream traffic over a single QUIC connection instead of TLS over TCP.

This is a better fit for unstable paths, environments where TCP recovery is expensive, and datagram-heavy workloads. DNS override, DNS over TLS, DNSSEC validation, and address-family controls remain available on the transport side.

Transport selection is opt-in and depends on cluster support. Existing workflows can keep the default TLS transport, while CLI contexts and SDK clients can switch to QUIC where it provides better behavior.

CLI context support for QUIC tunnel transport is available in rstream Go CLI 1.12.0 and later.

For transport semantics and configuration examples, refer to Tunnel Transports.