tiny-skia VS vouch-proxy

You can even check https://github.com/linebender/piet and https://github.com/RazrFalcon/tiny-skia. They are pure rust libraries. Skia as a whole is a big binary to add.

Looking through the source code. It looks like it's using tiny-skia for rendering.

Tiny Skia (https://github.com/RazrFalcon/tiny-skia) which is a slower Rust port of Skia and does all software rendering.

https://github.com/RazrFalcon/tiny-skia is pretty great.

I understand that this may sound harsh, but I also ported two (far bigger) codebases from C++ to Rust: rustybuzz and tiny-skia. Both of which are production -ready and not just prototypes. And mine not only do not use pointers, but also barely use unsafe in general.

Here is a real world implementation in tiny-skia: https://github.com/RazrFalcon/tiny-skia/blob/master/src/pipeline/highp.rs

How about tiny-skia?

How about tiny-skia? Almost the same performance as C, no unsafe, a lot of explicit SIMD.

Now I would love to see a universal Bezier path crate, storage + common utilities like length, point at offset, some low-level stuff, etc. So it could be used as a foundation for other crates. Currently, there is a lot of friction because each crate has its own implementation.

Nice to see tiny-skia in use.

Look into vouch proxy

Vouch proxy is designed for this usage: https://github.com/vouch/vouch-proxy I don't think there are any nice UIs to configure it though so you'll need to be familiar with running it yourself.

Not sure this is a "best practice", but it lets me keep control of the Ingress resources inside their YAML configs. I've also layered Vouch Proxy into the ingress configurations to require SSO/MFA auth to access the resources behind the Ingress. Cloudflare has the ability to do this, but I found it cumbersome to keep track of the configs outside the K8s cluster.

I've used vouch proxy for my own stuff previously, before more recently moving to Cloudflare Access. vouch can be slightly janky at times to get working right, but once set up, it's been solid.

For example: nginx -> Vouch proxy -> KeyCloak -> Jellyfin

While this works, we were hoping to make access a bit easier with say an OpenID Connect SSO and reverse-proxy solution. I've seen Vouch Proxy, https://github.com/vouch/vouch-proxy which is really just SSO on top of nginx, but I'm wondering if there's a simpler way to do this.

You seem to be quite knowledgeable and a minimal provider with just the bare minimum would suffice for you. Have a look at Vouch Proxy, it does one thing and it does it well.