use std::{
env,
net::SocketAddr,
path::Path,
time::Duration,
};
use buck2_resources::Buck2Resources;
use derive_builder::Builder;
use serde::{
Deserialize,
Serialize,
};
use si_data_pg::PgPoolConfig;
use si_jwt_public_key::JwtAlgo;
use si_posthog::PosthogConfig;
pub use si_settings::{
StandardConfig,
StandardConfigFile,
};
use si_std::{
CanonicalFile,
CanonicalFileError,
};
use si_tls::CertificateSource;
use telemetry::prelude::*;
use thiserror::Error;
use tower::limit::RateLimitLayer;
use ulid::Ulid;
use crate::s3::S3Config;
#[remain::sorted]
#[derive(Debug, Error)]
pub enum ConfigError {
#[error("config builder")]
Builder(#[from] ConfigBuilderError),
#[error("canonical file error: {0}")]
CanonicalFile(#[from] CanonicalFileError),
#[error("error configuring for development")]
Development(#[source] Box<dyn std::error::Error + 'static + Sync + Send>),
#[error("settings error: {0}")]
Settings(#[from] si_settings::SettingsError),
}
impl ConfigError {
fn development(err: impl std::error::Error + 'static + Sync + Send) -> Self {
Self::Development(Box::new(err))
}
}
type Result<T> = std::result::Result<T, ConfigError>;
fn get_default_socket_addr() -> SocketAddr {
SocketAddr::from(([0, 0, 0, 0], 5157))
}
fn default_auth_api_url() -> String {
auth_api_client::PROD_AUTH_API_ENDPOINT.to_string()
}
#[derive(Debug, Builder)]
pub struct Config {
#[builder(default = "get_default_socket_addr()")]
socket_addr: SocketAddr,
#[builder(default = "PgPoolConfig::default()")]
pg_pool: PgPoolConfig,
#[builder(default = "random_instance_id()")]
instance_id: String,
#[builder(default = "default_auth_api_url()")]
auth_api_url: String,
jwt_signing_public_key_path: CanonicalFile,
jwt_signing_public_key_algo: JwtAlgo,
#[builder(default)]
jwt_secondary_signing_public_key_path: Option<CanonicalFile>,
#[builder(default)]
jwt_secondary_signing_public_key_algo: Option<JwtAlgo>,
#[builder(default = "PosthogConfig::default()")]
posthog: PosthogConfig,
#[builder(default)]
rate_limit: RateLimitConfig,
s3: S3Config,
}
impl StandardConfig for Config {
type Builder = ConfigBuilder;
}
impl Config {
/// Gets a reference to the config's pg pool.
#[must_use]
pub fn pg_pool(&self) -> &PgPoolConfig {
&self.pg_pool
}
/// Gets the socket address
pub fn socket_addr(&self) -> &SocketAddr {
&self.socket_addr
}
/// Gets the config's instance ID.
pub fn instance_id(&self) -> &str {
self.instance_id.as_ref()
}
/// Gets the auth API URL.
pub fn auth_api_url(&self) -> &str {
&self.auth_api_url
}
/// Gets a reference to the config's jwt signing public key path.
#[must_use]
pub fn jwt_signing_public_key_path(&self) -> &CanonicalFile {
&self.jwt_signing_public_key_path
}
/// Gets a reference to the config's jwt signing public key path.
#[must_use]
pub fn jwt_signing_public_key_algo(&self) -> JwtAlgo {
self.jwt_signing_public_key_algo
}
/// Gets a reference to the config's jwt secondary signing public key path.
#[must_use]
pub fn jwt_secondary_signing_public_key_path(&self) -> Option<&CanonicalFile> {
self.jwt_secondary_signing_public_key_path.as_ref()
}
#[must_use]
pub fn jwt_secondary_signing_public_key_algo(&self) -> Option<JwtAlgo> {
self.jwt_secondary_signing_public_key_algo
}
/// Gets a reference to the config's posthog config.
#[must_use]
pub fn posthog(&self) -> &PosthogConfig {
&self.posthog
}
/// Gets a reference to the config's rate limit layer.
#[must_use]
pub fn rate_limit(&self) -> &RateLimitConfig {
&self.rate_limit
}
/// Gets a config's s3 details
#[must_use]
pub fn s3(&self) -> &S3Config {
&self.s3
}
}
#[derive(Clone, Debug, Deserialize, Serialize)]
pub struct ConfigFile {
#[serde(default)]
pg: PgPoolConfig,
#[serde(default = "get_default_socket_addr")]
socket_addr: SocketAddr,
#[serde(default = "random_instance_id")]
instance_id: String,
#[serde(default)]
auth_api_url: String,
#[serde(default = "default_jwt_signing_public_key_path")]
pub jwt_signing_public_key_path: String,
#[serde(default = "default_jwt_signing_public_key_algo")]
pub jwt_signing_public_key_algo: JwtAlgo,
#[serde(default)]
pub jwt_secondary_signing_public_key_path: Option<String>,
#[serde(default)]
pub jwt_secondary_signing_public_key_algo: Option<JwtAlgo>,
#[serde(default)]
pub posthog: PosthogConfig,
#[serde(default)]
pub rate_limit: RateLimitConfig,
#[serde(default)]
pub s3: S3Config,
}
impl Default for ConfigFile {
fn default() -> Self {
Self {
// config from toml file is not working at the moment
// so we just override from the base defaults here
pg: PgPoolConfig {
dbname: "si_module_index".to_owned(),
application_name: "si-module-index".to_owned(),
..Default::default()
},
socket_addr: get_default_socket_addr(),
instance_id: random_instance_id(),
auth_api_url: default_auth_api_url(),
jwt_signing_public_key_path: default_jwt_signing_public_key_path(),
jwt_signing_public_key_algo: default_jwt_signing_public_key_algo(),
jwt_secondary_signing_public_key_path: None,
jwt_secondary_signing_public_key_algo: None,
posthog: Default::default(),
rate_limit: Default::default(),
s3: Default::default(),
}
}
}
impl StandardConfigFile for ConfigFile {
type Error = ConfigError;
}
impl TryFrom<ConfigFile> for Config {
type Error = ConfigError;
fn try_from(mut value: ConfigFile) -> Result<Self> {
detect_and_configure_development(&mut value)?;
let mut config = Config::builder();
config.pg_pool(value.pg);
config.socket_addr(value.socket_addr);
config.instance_id(value.instance_id);
config.auth_api_url(value.auth_api_url);
config.jwt_signing_public_key_path(value.jwt_signing_public_key_path.try_into()?);
config.jwt_signing_public_key_algo(value.jwt_signing_public_key_algo);
config.posthog(value.posthog);
config.s3(value.s3);
config.build().map_err(Into::into)
}
}
fn random_instance_id() -> String {
Ulid::new().to_string()
}
fn default_jwt_signing_public_key_path() -> String {
"/run/sdf/jwt_signing_public_key.pem".to_string()
}
fn default_jwt_signing_public_key_algo() -> JwtAlgo {
JwtAlgo::RS256
}
#[derive(Clone, Debug, Deserialize, Serialize)]
pub struct RateLimitConfig {
requests: u64,
per_second: Duration,
}
impl Default for RateLimitConfig {
fn default() -> Self {
Self {
requests: 128,
per_second: Duration::from_secs(1),
}
}
}
impl From<RateLimitConfig> for RateLimitLayer {
fn from(val: RateLimitConfig) -> Self {
RateLimitLayer::new(val.requests, val.per_second)
}
}
#[allow(clippy::disallowed_methods)] // Used to determine if running in development
pub fn detect_and_configure_development(config: &mut ConfigFile) -> Result<()> {
if env::var("BUCK_RUN_BUILD_ID").is_ok() || env::var("BUCK_BUILD_ID").is_ok() {
buck2_development(config)
} else if let Ok(dir) = env::var("CARGO_MANIFEST_DIR") {
cargo_development(dir, config)
} else {
Ok(())
}
}
fn buck2_development(config: &mut ConfigFile) -> Result<()> {
let resources = Buck2Resources::read().map_err(ConfigError::development)?;
#[allow(clippy::disallowed_methods)] // Used in development with a local auth services
// Note(victor): If the user has set a custom auth ip url via env variable we assume dev mode
let jwt_signing_public_key_path = if env::var("SI_AUTH_API_URL").is_ok() {
resources
.get_ends_with("dev.jwt_signing_public_key.pem")
.map_err(ConfigError::development)?
.to_string_lossy()
.to_string()
} else {
resources
.get_ends_with("prod.jwt_signing_public_key.pem")
.map_err(ConfigError::development)?
.to_string_lossy()
.to_string()
};
let postgres_cert = resources
.get_ends_with("dev.postgres.root.crt")
.map_err(ConfigError::development)?
.to_string_lossy()
.to_string();
warn!(
jwt_signing_public_key_path = jwt_signing_public_key_path.as_str(),
postgres_cert = postgres_cert.as_str(),
"detected development run",
);
config.jwt_signing_public_key_path = jwt_signing_public_key_path;
config.pg.certificate = Some(CertificateSource::Path(postgres_cert.try_into()?));
Ok(())
}
fn cargo_development(dir: String, config: &mut ConfigFile) -> Result<()> {
#[allow(clippy::disallowed_methods)] // Used in development with a local auth services
// Note(victor): If the user has set a custom auth ip url via env variable we assume dev mode
let jwt_signing_public_key_path = if env::var("SI_AUTH_API_URL").is_ok() {
Path::new(&dir)
.join("../../config/keys/dev.jwt_signing_public_key.pem")
.to_string_lossy()
.to_string()
} else {
Path::new(&dir)
.join("../../config/keys/prod.jwt_signing_public_key.pem")
.to_string_lossy()
.to_string()
};
let postgres_cert = Path::new(&dir)
.join("../../config/keys/dev.postgres.root.crt")
.to_string_lossy()
.to_string();
warn!(
jwt_signing_public_key_path = jwt_signing_public_key_path.as_str(),
postgres_cert = postgres_cert.as_str(),
"detected development run",
);
config.jwt_signing_public_key_path = jwt_signing_public_key_path;
config.pg.certificate = Some(CertificateSource::Path(postgres_cert.try_into()?));
// todo!();
// config.veritech_encryption_key_path = veritech_encryption_key_path;
Ok(())
}
