FastHTTP migration and performance improvements

.github/workflows/ci.yml

@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version-file: go.mod
           cache: true
@@ -28,3 +28,9 @@ jobs:
 
       - name: Test
         run: go test -race ./...
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run govulncheck
+        run: govulncheck ./...

.github/workflows/release.yml

@@ -14,12 +14,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version-file: go.mod
           cache: true
@@ -28,7 +28,7 @@ jobs:
         run: go test -race ./...
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
         with:
           distribution: goreleaser
           version: "~> v2"

.gitignore

@@ -1,6 +1,7 @@
 # Build output
 /bin/
 /dist/
+/static-web
 
 # Test and coverage artifacts
 coverage.out

CHANGELOG.md

@@ -1,3 +1,21 @@
+## v1.3.0 (2026-03-08)
+
+### Perf
+
+- **server**: migrate HTTP layer from net/http to fasthttp — ~141k req/sec (55% faster than Bun)
+- **server**: use `tcp4` listener to eliminate dual-stack overhead (2x throughput gain on macOS)
+
+### Refactor
+
+- **handler**: replace `http.ServeContent` with custom `parseRange()`/`serveRange()` for byte-range requests
+- **compress**: convert gzip middleware from wrapping `ResponseWriter` to post-processing response body
+- **security**: use `ctx.SetStatusCode()`+`ctx.SetBodyString()` instead of `ctx.Error()` to preserve headers
+- **cache**: change `CachedFile` header fields from `[]string` to `string`
+
+### Build
+
+- **benchmark**: add fasthttp/net-http hello world baselines and update baremetal script
+
 ## v1.2.0 (2026-03-07)
 
 ### Feat

CLI.md

@@ -186,6 +186,7 @@ Grouped by concern for readability. All flags are optional; unset flags do not o
 |------|------|---------|--------------|
 | `--host` | string | `` (all interfaces) | `server.addr` (host part) |
 | `--port`, `-p` | int | `8080` | `server.addr` (port part) |
+| `--redirect-host` | string | — | `server.redirect_host` |
 | `--tls-cert` | string | — | `server.tls_cert` |
 | `--tls-key` | string | — | `server.tls_key` |
 | `--tls-port` | int | `8443` | `server.tls_addr` (port part) |
@@ -205,6 +206,8 @@ Grouped by concern for readability. All flags are optional; unset flags do not o
 |------|------|---------|--------------|
 | `--no-cache` | bool | `false` | `cache.enabled = false` |
 | `--cache-size` | string | `256MB` | `cache.max_bytes` (parses `256MB`, `64MB`, `1GB`) |
+| `--preload` | bool | `false` | `cache.preload` — load all files into cache at startup |
+| `--gc-percent` | int | `0` | `cache.gc_percent` — Go GC target % (0 = default; try 400 for throughput) |
 
 #### Compression
 
@@ -244,6 +247,7 @@ static-web --dir-listing --no-dotfile-block ~/Downloads
 
 # Serve with TLS (HTTPS on :443, HTTP redirect on :80)
 static-web --port 80 --tls-port 443 \
+           --redirect-host static.example.com \
            --tls-cert /etc/ssl/cert.pem \
            --tls-key  /etc/ssl/key.pem \
            ./public
@@ -265,6 +269,9 @@ static-web
 # Disable caching (useful during local development to see file changes immediately)
 static-web --no-cache ./dist
 
+# Maximum throughput: preload all files + tune GC
+static-web --preload --gc-percent 400 ./dist
+
 # Print version info
 static-web version
 ```
@@ -385,7 +392,7 @@ The CLI was implemented using Go stdlib `flag.FlagSet` — no external framework
 - **`--host` + `--port` merging**: `net.SplitHostPort` / `net.JoinHostPort` used to decompose and reconstruct `server.addr`.
 - **`parseBytes()`**: a small helper that parses `256MB`, `1GB`, etc. with `B`/`KB`/`MB`/`GB` suffixes (case-insensitive).
 - **`//go:embed config.toml.example`**: the example config is embedded in `cmd/static-web/` at compile time. The binary is fully self-contained.
-- **`--quiet`**: passes `io.Discard` to a `loggingMiddlewareWithWriter` variant, suppressing access log output with zero overhead.
+- **`--quiet`**: skips access-log middleware entirely, removing per-request logging overhead.
 - **`--verbose`**: calls `logConfig(cfg)` after all overrides are applied, so you see the final resolved values.
 - **Version injection**: `internal/version.Version`, `Commit`, `Date` are set via `-ldflags` at build time. Default to `"dev"`, `"none"`, `"unknown"` for `go run`.
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build run test bench lint precompress clean release install commit bump changelog benchmark benchmark-keep benchmark-down
+.PHONY: build run test bench lint precompress clean release install commit bump changelog benchmark benchmark-keep benchmark-down benchmark-baremetal
 
 # Binary output path and name
 BIN     := bin/static-web
@@ -83,3 +83,7 @@ benchmark-keep:
 ## benchmark-down: tear down any running benchmark containers
 benchmark-down:
 	docker compose -f benchmark/docker-compose.benchmark.yml down --remove-orphans
+
+## benchmark-baremetal: run bare-metal benchmark (static-web production vs Bun, no Docker)
+benchmark-baremetal:
+	@bash benchmark/baremetal.sh