Struct Assembly 

pub struct Assembly {
    pub database: Arc<Database>,
    pub jobs: JobQueue,
    pub metrics: Arc<Metrics>,
    pub notifiers: Notifiers,
    /* private fields */
}

What survives a configuration reload.

Every generation rebuilds its profiles, its routers, its job registry, its egress clients and any signer backend whose configuration moved. The things here are built once for the life of the process and handed to each generation instead — and after three rounds of moving things off this list, everything left is here because rebuilding it would lose something, never because rebuilding it would merely cost something:

• database and jobs are the pool and its enqueue side. database.url is the one key crate::reload still refuses, and this is why.
• metrics is a correctness requirement. A registry rebuilt per generation would reset every counter on SIGHUP, and a counter going backwards is precisely how Prometheus recognises a process restart — so rate() would report the whole pre-reload total as a spike on every configuration change.
• signers is the previous generation’s backend set, kept so the next reload can reuse a backend whose configuration did not move (see signer::build_backends); infos the same for their read sides. Behind a Mutex because each is written once per generation; nothing reads either to serve a request, since a Profile holds its own read side.
• roles decides whether there are backends at all: only a process running the worker role builds one, so the others never read a CA key, log in to a token or contact a relay’s upstream — not at startup, not on reload.
• notifiers is a handle rather than a map, so [notify] can reload underneath the backends that captured it.

resolver and proxies used to be here, justified by the signers caching them at construction. They moved to Egress when that stopped being a reason to freeze [dns]/[proxy] and became a reason to rebuild a signer.

Fields

database: Arc<Database>

jobs: JobQueue

metrics: Arc<Metrics>

notifiers: Notifiers

Implementations

impl Assembly

pub fn new( roles: RoleSet, resolved: &[ProfileConfig], database: Arc<Database>, jobs: JobQueue, config: &Config, ) -> Result<(Self, GenerationParts)>

Builds everything that outlives a generation, plus the first generation’s own parts.

Those come back rather than being kept here because they are not long-lived: the caller hands them to profile::build_all_with and then forgets them, and every later generation builds its own through build_parts.

pub fn build_parts( &self, resolved: &[ProfileConfig], config: &Config, ) -> Result<GenerationParts>

Builds one generation’s egress, dispatchers and signer backends, without publishing any of them.

Separate from publish_notifiers and publish_signers because a reload must be able to fail after building all three and still leave the running generation untouched. Everything fallible is here; everything published is there.

May block: RelaySigner::from_config contacts the upstream the first time it is built for an account with no kid sidecar yet, which is why server::supervisor::supervise_reloads runs this on a blocking thread.

pub fn publish_notifiers(&self, dispatchers: DispatcherMap)

Makes dispatchers the generation every long-lived reader sees.

Synchronous, and deliberately: it is one of the sends a reload makes back-to-back so no task can observe a half-swapped generation.

pub fn publish_signers( &self, signers: SignerSet, infos: SignerSet<dyn SignerInfo>, )

Records signers as what the next reload compares against, and drops whatever the generation before it held.

That drop is the point at which a backend nobody references any more — an unmounted profile’s, or the instance a [signer] edit replaced — is finally released. Deliberately after its replacement was built and has adopted its state, never before.