Crate boatramp_server 

boatramp HTTP server + publishing API.

The server is backend-agnostic: it is handed a DeployStore (blobs in any boatramp_core::Storage, metadata in any boatramp_core::kv::KvStore) and exposes:

• a publishing API used by boatramp sync — negotiate a manifest, upload missing blobs (streamed), then atomically activate;
• public serving of the currently-active deployment for each site.

Every byte path streams: uploads flow request→backend, downloads flow backend→response, and only small manifests are ever held in memory.

Modules

envelope

Secrets-at-rest envelope backends.

signer

External token signer backends: KMS / HSM / Vault-hosted control-plane root keys behind the boatramp_core::cose::Signer seam. External Signer backends for the control-plane token issuer.

sql_shim

The compute sql-shim (PLAN-compute-bindings, Phase 0).

Structs

Auth

Control-plane auth configuration: the token trust anchor (root public key) plus the KV that holds the RBAC policy (authz/policy) and revocation markers (authz/revoked/<id>). None ⇒ auth disabled (development).

DaemonRuntime

HandlerRuntime

The WebAssembly handler runtime: the shared engine plus the per-site binding backends. Cheap to clone (it is an Arc inside). Without the handlers feature it is an empty placeholder, so the serving signatures stay uniform — pass HandlerRuntime::disabled.

MeshMember

One node’s Raft membership, reported by GET /api/cluster/members.

ServerLimits

Server-tier upload limits. All None = unlimited (the default; preserves the unbounded streaming behavior for operators who front boatramp with their own limits).

ServerMetrics

Always-on HTTP + lifecycle counters. Request cells are keyed by (status_class, cache_result); the rest are scalar totals.

ServerOptions

Server runtime knobs that aren’t part of the core (deploy, auth, handlers) triple: operational request limits and an optional custom domain-ownership DomainProbe (defaults to the live network probe).

UploadGuard

Runtime guard built from ServerLimits, shared across requests as an axum extension. Holds the concurrency semaphore (if any) and the per-upload caps.

Enums

JoinOutcome

The result of a join admission (MeshControl::admit).

ServeError

A failure starting or running the HTTP server.

Traits

MeshControl

The cluster mesh control operations exposed to the control-plane API, implemented by the cluster runtime over ClusterNode; None on a non-cluster node (the routes then return 501).

Functions

config_baseline

The daemon-config file baseline derived from ServerOptions (the resolved boatramp.cfg). serve uses this to build a DaemonRuntime it can wake on SIGHUP/changelog; the posture’s upload cap is the ceiling a dynamic override may not exceed.

http_redirect_router

A standalone router for a plain :80 listener that permanently redirects every request to its HTTPS equivalent. Bound alongside the HTTPS listener so plain-HTTP visitors are upgraded even when boatramp terminates TLS itself.

require_auth

Axum middleware enforcing control-plane auth on the routes it wraps.

router

Build the application router around a DeployStore, Auth config, and the WebAssembly handler runtime (HandlerRuntime::disabled for none), with default ServerOptions (unlimited, live probe).

router_with

router with explicit ServerOptions — lets a caller set request limits or inject a custom domain-ownership probe.

serve

Bind addr and serve until a shutdown signal (Ctrl-C / SIGTERM), then drain in-flight requests under [DRAIN_DEADLINE]. Default ServerOptions.

serve_with

serve with explicit ServerOptions (e.g. operational request limits).

server_metrics

The process-wide ServerMetrics. Cheap to call (no allocation).

shutdown_signal

Resolve when the process receives Ctrl-C or SIGTERM, so in-flight requests can drain before exit.

spawn_compute_reconcile

Spawn the leader-gated compute reconcile loop: every tick, while is_leader(), run one [reconcile_once] pass over the backend registry + node inventory to converge each workload’s replicas. A no-op while not leader or with an empty registry. Detached for the server’s lifetime; the same leader-gating pattern as cron/cert issuance.

spawn_domain_verify_reconcile

Spawn the domain-verification auto-complete reconcile loop: every tick, on the leader, re-check all pending challenges and attach any that now pass — so a challenge whose HTTP/DNS token is published (e.g. by domain add --provider) but never finished with domain verify self-heals with no operator action, and no persistent background daemon is needed beyond this tick. Mirrors crate::spawn_compute_reconcile; the leader gate makes it a single-writer in a cluster.

verification_pending_page

The “verification pending” holding page — an HTTP 421 Misdirected Request served for a non-local Host that isn’t a verified, attached virtualhost (DV-2’s mandatory-verification gate). It looks up any pending challenge for the host to show the exact token / record + path; otherwise it shows generic guidance. Self-contained HTML (no JS, no external assets) — safe on an unverified host.

Type Aliases

CronLeaderGate

Predicate gating cron firing to the cluster leader (see [HandlerRuntime::set_cron_leader_gate]).