| 1 | //! Server configuration: loaded from a TOML file with sensible defaults. |
| 2 | |
| 3 | use std::path::{ |
| 4 | Path, |
| 5 | PathBuf, |
| 6 | }; |
| 7 | |
| 8 | use serde::{ |
| 9 | Deserialize, |
| 10 | Serialize, |
| 11 | }; |
| 12 | |
| 13 | use crate::error::{ |
| 14 | Error, |
| 15 | Result, |
| 16 | }; |
| 17 | |
| 18 | /// Top-level anvil configuration. |
| 19 | /// |
| 20 | /// Load with [`Config::load`] (from a TOML file) or [`Config::default`]. |
| 21 | #[derive(Clone, Debug, Deserialize, Serialize)] |
| 22 | #[serde(default)] |
| 23 | pub struct Config { |
| 24 | /// Root directory holding all server state (database + repositories). |
| 25 | pub data_dir: PathBuf, |
| 26 | /// HTTP server settings. |
| 27 | pub http: HttpConfig, |
| 28 | /// SSH server settings. |
| 29 | pub ssh: SshConfig, |
| 30 | /// Continuous-deployment settings (the single-repo redeploy webhook). |
| 31 | pub ci: CiConfig, |
| 32 | /// Periodic background job settings. |
| 33 | pub periodic: PeriodicConfig, |
| 34 | } |
| 35 | |
| 36 | /// CI configuration: job sandbox limits and the single-repo redeploy webhook. |
| 37 | /// |
| 38 | /// On a successful CI run of [`deploy_branch`](CiConfig::deploy_branch) in the |
| 39 | /// single repository named by [`deploy_repo`](CiConfig::deploy_repo), anvil |
| 40 | /// POSTs to [`deploy_webhook`](CiConfig::deploy_webhook). This is deliberately |
| 41 | /// scoped to **one** repository — no other repo can trigger the deploy, even |
| 42 | /// with its own passing CI. |
| 43 | #[derive(Clone, Debug, Deserialize, Serialize)] |
| 44 | #[serde(default)] |
| 45 | pub struct CiConfig { |
| 46 | /// The one repository (`owner/name`) permitted to trigger the deploy |
| 47 | /// webhook. Empty disables deploys entirely. |
| 48 | pub deploy_repo: String, |
| 49 | /// URL POSTed to when `deploy_repo`'s `deploy_branch` goes green. Should be |
| 50 | /// a host-local plaintext HTTP endpoint (a small deploy-script receiver); |
| 51 | /// HTTPS is intentionally unsupported to keep the build TLS-free. |
| 52 | pub deploy_webhook: String, |
| 53 | /// Shared secret sent as the `X-Anvil-Deploy-Secret` header so the receiver |
| 54 | /// can authenticate the call. Empty sends no header. |
| 55 | pub deploy_secret: String, |
| 56 | /// Branch whose successful run triggers a deploy. Defaults to `main`. |
| 57 | pub deploy_branch: String, |
| 58 | /// Images a pipeline may run in. Empty allows any image. An entry without a |
| 59 | /// tag (e.g. `rust`) allows every tag of that image; an entry with a tag |
| 60 | /// (e.g. `rust:1.95-bookworm`) allows exactly that image. |
| 61 | pub allowed_images: Vec<String>, |
| 62 | /// Memory cap for a job container, in MiB (swap is capped to the same |
| 63 | /// value). `0` means unlimited. Defaults to 2048. |
| 64 | pub memory_mb: i64, |
| 65 | /// CPU cap for a job container, in (possibly fractional) CPUs. `0` means |
| 66 | /// unlimited. Defaults to 2. |
| 67 | pub cpus: f64, |
| 68 | /// Process-count cap inside a job container. `0` means unlimited. |
| 69 | /// Defaults to 512. |
| 70 | pub pids_limit: i64, |
| 71 | /// Wall-clock timeout for a job, in seconds; on expiry the container is |
| 72 | /// force-removed and the run errors. `0` disables the timeout. Defaults to |
| 73 | /// 1800 (30 minutes). |
| 74 | pub timeout_secs: u64, |
| 75 | /// Whether job containers get network access (the default Docker network). |
| 76 | /// Most builds need it to fetch dependencies; disable for stricter |
| 77 | /// isolation. Defaults to `true`. |
| 78 | pub network: bool, |
| 79 | /// User to run the job as inside the container (`uid[:gid]` or a name known |
| 80 | /// to the image). Empty keeps the image's default user. Note many base |
| 81 | /// images assume root for e.g. `apt-get`. |
| 82 | pub run_as: String, |
| 83 | /// Size cap for a single artifact, in MiB; larger artifacts are skipped |
| 84 | /// (with a log note), never failing the run. `0` means unlimited. |
| 85 | /// Defaults to 256. |
| 86 | pub artifact_max_mb: i64, |
| 87 | /// Combined size cap for one run's artifacts, in MiB. Artifacts that would |
| 88 | /// push the run over it are skipped. `0` means unlimited. Defaults to 512. |
| 89 | pub artifact_run_max_mb: i64, |
| 90 | /// Combined artifact budget per repository, in MiB. After each run, oldest |
| 91 | /// commits' artifacts are deleted until the repo fits (branch-head commits |
| 92 | /// are pinned). `0` means unlimited. Defaults to 4096. |
| 93 | pub artifact_quota_mb: i64, |
| 94 | } |
| 95 | |
| 96 | #[derive(Clone, Debug, Deserialize, Serialize)] |
| 97 | #[serde(default)] |
| 98 | pub struct HttpConfig { |
| 99 | /// Address the HTTP server binds to, e.g. `127.0.0.1:3000`. |
| 100 | pub listen: String, |
| 101 | /// Externally visible base URL, used when constructing clone URLs. |
| 102 | pub base_url: String, |
| 103 | /// Memory budget, in MiB, for the cache of syntax-highlighted file views |
| 104 | /// (rendered HTML keyed by blob oid). Highlighting large files is the most |
| 105 | /// CPU-expensive page render, so repeat views are served from this cache. |
| 106 | /// `0` disables it — lowest memory, every view re-highlights. Defaults |
| 107 | /// to 16. |
| 108 | pub highlight_cache_mb: usize, |
| 109 | /// Maximum size, in MiB, of a single uploaded attachment (e.g. an image |
| 110 | /// pasted into the file editor). Uploads over this are rejected. Defaults |
| 111 | /// to 16. |
| 112 | pub attachment_max_mb: usize, |
| 113 | /// Per-repository cap, in MiB, on total stored attachments. A new upload |
| 114 | /// that would push a repo over this is rejected (re-uploading existing, |
| 115 | /// deduped content is always free). `0` means unlimited. Defaults to 0. |
| 116 | pub attachment_quota_mb: usize, |
| 117 | } |
| 118 | |
| 119 | #[derive(Clone, Debug, Deserialize, Serialize)] |
| 120 | #[serde(default)] |
| 121 | pub struct SshConfig { |
| 122 | /// Whether the SSH git transport is enabled. |
| 123 | pub enabled: bool, |
| 124 | /// Address the SSH server binds to internally, e.g. `0.0.0.0:2222`. Under |
| 125 | /// Docker this is the in-container bind, which may differ from the |
| 126 | /// externally forwarded port — see the `clone_*` fields below. |
| 127 | pub listen: String, |
| 128 | /// Hostname shown in SSH clone URLs (what users actually connect to). |
| 129 | pub clone_host: String, |
| 130 | /// Port shown in SSH clone URLs. Set this to the *externally forwarded* |
| 131 | /// port when it differs from the internal bind (e.g. Docker `-p 2200:2222`). |
| 132 | pub clone_port: u16, |
| 133 | /// Username shown in SSH clone URLs (conventionally `git`). |
| 134 | pub clone_user: String, |
| 135 | } |
| 136 | |
| 137 | #[derive(Clone, Debug, Deserialize, Serialize)] |
| 138 | #[serde(default)] |
| 139 | pub struct PeriodicConfig { |
| 140 | /// Interval (seconds) between repository language-detection scans. |
| 141 | /// Defaults to 3600 (1 hour). |
| 142 | pub language_detection_interval_secs: u64, |
| 143 | /// Interval (seconds) between repository preview-image extractions from README. |
| 144 | /// Defaults to 3600 (1 hour). |
| 145 | pub preview_image_interval_secs: u64, |
| 146 | /// Interval (seconds) between disk-usage cache refreshes. |
| 147 | /// Defaults to 3600 (1 hour). |
| 148 | pub disk_usage_interval_secs: u64, |
| 149 | } |
| 150 | |
| 151 | impl Default for Config { |
| 152 | fn default() -> Self { |
| 153 | Self { |
| 154 | data_dir: PathBuf::from("data"), |
| 155 | http: HttpConfig::default(), |
| 156 | ssh: SshConfig::default(), |
| 157 | ci: CiConfig::default(), |
| 158 | periodic: PeriodicConfig::default(), |
| 159 | } |
| 160 | } |
| 161 | } |
| 162 | |
| 163 | impl Default for CiConfig { |
| 164 | fn default() -> Self { |
| 165 | Self { |
| 166 | deploy_repo: String::new(), |
| 167 | deploy_webhook: String::new(), |
| 168 | deploy_secret: String::new(), |
| 169 | deploy_branch: "main".to_string(), |
| 170 | allowed_images: Vec::new(), |
| 171 | memory_mb: 2048, |
| 172 | cpus: 2.0, |
| 173 | pids_limit: 512, |
| 174 | timeout_secs: 1800, |
| 175 | network: true, |
| 176 | run_as: String::new(), |
| 177 | artifact_max_mb: 256, |
| 178 | artifact_run_max_mb: 512, |
| 179 | artifact_quota_mb: 4096, |
| 180 | } |
| 181 | } |
| 182 | } |
| 183 | |
| 184 | impl CiConfig { |
| 185 | /// Whether `owner/name` on `branch` is the configured deploy target. |
| 186 | pub fn is_deploy_target(&self, owner: &str, name: &str, branch: &str) -> bool { |
| 187 | !self.deploy_repo.is_empty() |
| 188 | && !self.deploy_webhook.is_empty() |
| 189 | && self.deploy_repo == format!("{owner}/{name}") |
| 190 | && self.deploy_branch == branch |
| 191 | } |
| 192 | |
| 193 | /// Whether `image` passes [`allowed_images`](CiConfig::allowed_images). |
| 194 | /// An empty allowlist permits any image; a tagless entry permits every tag |
| 195 | /// of that image; a tagged entry permits exactly itself. |
| 196 | pub fn image_allowed(&self, image: &str) -> bool { |
| 197 | self.allowed_images.is_empty() |
| 198 | || self.allowed_images.iter().any(|allowed| { |
| 199 | image == allowed |
| 200 | || (!allowed.contains(':') |
| 201 | && image |
| 202 | .strip_prefix(allowed.as_str()) |
| 203 | .is_some_and(|rest| rest.starts_with(':'))) |
| 204 | }) |
| 205 | } |
| 206 | } |
| 207 | |
| 208 | impl Default for HttpConfig { |
| 209 | fn default() -> Self { |
| 210 | Self { |
| 211 | listen: "127.0.0.1:3000".to_string(), |
| 212 | base_url: "http://localhost:3000".to_string(), |
| 213 | highlight_cache_mb: 16, |
| 214 | attachment_max_mb: 16, |
| 215 | attachment_quota_mb: 0, |
| 216 | } |
| 217 | } |
| 218 | } |
| 219 | |
| 220 | impl Default for SshConfig { |
| 221 | fn default() -> Self { |
| 222 | Self { |
| 223 | enabled: false, |
| 224 | listen: "127.0.0.1:2222".to_string(), |
| 225 | clone_host: "localhost".to_string(), |
| 226 | clone_port: 2222, |
| 227 | clone_user: "git".to_string(), |
| 228 | } |
| 229 | } |
| 230 | } |
| 231 | |
| 232 | impl Default for PeriodicConfig { |
| 233 | fn default() -> Self { |
| 234 | Self { |
| 235 | language_detection_interval_secs: 3600, |
| 236 | preview_image_interval_secs: 3600, |
| 237 | disk_usage_interval_secs: 3600, |
| 238 | } |
| 239 | } |
| 240 | } |
| 241 | |
| 242 | impl Config { |
| 243 | /// Load configuration from a TOML file. Missing fields fall back to defaults. |
| 244 | pub fn load(path: impl AsRef<Path>) -> Result<Self> { |
| 245 | let path = path.as_ref(); |
| 246 | let text = std::fs::read_to_string(path) |
| 247 | .map_err(|e| Error::Config(format!("reading {}: {e}", path.display())))?; |
| 248 | toml::from_str(&text).map_err(|e| Error::Config(format!("parsing {}: {e}", path.display()))) |
| 249 | } |
| 250 | |
| 251 | /// Load from `path` if it exists, otherwise return defaults. |
| 252 | pub fn load_or_default(path: impl AsRef<Path>) -> Result<Self> { |
| 253 | let path = path.as_ref(); |
| 254 | if path.exists() { |
| 255 | Self::load(path) |
| 256 | } else { |
| 257 | Ok(Self::default()) |
| 258 | } |
| 259 | } |
| 260 | |
| 261 | /// Filesystem path to the SQLite database file. |
| 262 | pub fn database_path(&self) -> PathBuf { |
| 263 | self.data_dir.join("anvil.db") |
| 264 | } |
| 265 | |
| 266 | /// Root directory under which bare repositories are stored. |
| 267 | pub fn repositories_dir(&self) -> PathBuf { |
| 268 | self.data_dir.join("repositories") |
| 269 | } |
| 270 | |
| 271 | /// Root directory under which CI artifacts are stored |
| 272 | /// (`artifacts/{repo_id}/{commit}/…` — see `docs/ci-artifacts.md`). |
| 273 | pub fn artifacts_dir(&self) -> PathBuf { |
| 274 | self.data_dir.join("artifacts") |
| 275 | } |
| 276 | |
| 277 | /// Root directory under which uploaded attachments are stored |
| 278 | /// (`attachments/{repo_id}/{hash}`). Kept out of `repositories/` so the |
| 279 | /// files are never git objects. |
| 280 | pub fn attachments_dir(&self) -> PathBuf { |
| 281 | self.data_dir.join("attachments") |
| 282 | } |
| 283 | |
| 284 | /// Whether session cookies should carry the `Secure` attribute (HTTPS-only). |
| 285 | /// Derived from the public base URL's scheme, so local plaintext dev still |
| 286 | /// works while production behind TLS gets `Secure` automatically. |
| 287 | pub fn secure_cookies(&self) -> bool { |
| 288 | self.http.base_url.starts_with("https://") |
| 289 | } |
| 290 | |
| 291 | /// The HTTP clone URL for `<owner>/<name>`, e.g. |
| 292 | /// `http://localhost:3000/alice/hello.git`. |
| 293 | pub fn http_clone_url(&self, owner: &str, name: &str) -> String { |
| 294 | format!( |
| 295 | "{}/{owner}/{name}.git", |
| 296 | self.http.base_url.trim_end_matches('/') |
| 297 | ) |
| 298 | } |
| 299 | |
| 300 | /// The SSH clone URL for `<owner>/<name>`, using the externally advertised |
| 301 | /// host/port/user (which may differ from the internal bind under Docker). |
| 302 | /// The port is omitted when it is the SSH default (22). |
| 303 | pub fn ssh_clone_url(&self, owner: &str, name: &str) -> String { |
| 304 | let ssh = &self.ssh; |
| 305 | if ssh.clone_port == 22 { |
| 306 | format!( |
| 307 | "ssh://{}@{}/{owner}/{name}.git", |
| 308 | ssh.clone_user, ssh.clone_host |
| 309 | ) |
| 310 | } else { |
| 311 | format!( |
| 312 | "ssh://{}@{}:{}/{owner}/{name}.git", |
| 313 | ssh.clone_user, ssh.clone_host, ssh.clone_port |
| 314 | ) |
| 315 | } |
| 316 | } |
| 317 | } |
| 318 | |
| 319 | #[cfg(test)] |
| 320 | mod tests { |
| 321 | use super::*; |
| 322 | |
| 323 | #[test] |
| 324 | fn image_allowlist_semantics() { |
| 325 | let mut ci = CiConfig::default(); |
| 326 | assert!(ci.image_allowed("anything:latest"), "empty list allows all"); |
| 327 | |
| 328 | ci.allowed_images = vec!["rust".to_string(), "alpine:3.20".to_string()]; |
| 329 | assert!(ci.image_allowed("rust"), "tagless entry, tagless image"); |
| 330 | assert!( |
| 331 | ci.image_allowed("rust:1.95-bookworm"), |
| 332 | "tagless entry allows any tag" |
| 333 | ); |
| 334 | assert!(ci.image_allowed("alpine:3.20"), "tagged entry, exact match"); |
| 335 | assert!(!ci.image_allowed("alpine:3.21"), "tagged entry, other tag"); |
| 336 | assert!(!ci.image_allowed("alpine"), "tagged entry, tagless image"); |
| 337 | assert!( |
| 338 | !ci.image_allowed("rustlang/rust:nightly"), |
| 339 | "no prefix bleed" |
| 340 | ); |
| 341 | assert!(!ci.image_allowed("rusty:latest"), "no name-prefix bleed"); |
| 342 | } |
| 343 | } |