lfsx_server/
lib.rs

1pub mod auth;
2pub mod config;
3pub mod dashboard;
4pub mod error;
5pub mod locks;
6pub mod metrics;
7pub mod model;
8pub mod namespace;
9pub mod page;
10pub mod range;
11pub mod routes;
12pub mod state;
13pub mod storage;
14pub mod tls;
15
16use std::sync::Arc;
17
18use axum::Router;
19
20use crate::auth::Authorizer;
21use crate::config::Config;
22use crate::locks::LockStore;
23use crate::metrics::Metrics;
24use crate::state::AppState;
25use crate::storage::s3::{Keyspace, S3Config, S3Store};
26use crate::storage::{LocalStore, Store};
27
28pub fn app(config: Config) -> Router {
29    let (store, locks) = backends(&config);
30    let authorizer = Authorizer::new(&config.auth);
31
32    routes::router(Arc::new(AppState {
33        store,
34        locks,
35        config,
36        authorizer,
37        metrics: Metrics::new(),
38    }))
39}
40
41// Everything an interrupted upload left behind, wherever it left it: a staging
42// file on the volume, or bytes under an upload key nobody ever reported. Built
43// from the same construction the server uses, so a bucket deployment does not
44// end up sweeping only half of itself.
45pub async fn reclaim(config: &Config) {
46    let reclaimed = backends(config).0.reclaim(config.staging_max_age).await;
47
48    if reclaimed.files > 0 {
49        tracing::info!(
50            files = reclaimed.files,
51            bytes = reclaimed.bytes,
52            "reclaimed what interrupted uploads left behind"
53        );
54    }
55}
56
57fn backends(config: &Config) -> (Store, LockStore) {
58    // Said out loud because it decides who can read the objects. It is off unless
59    // asked for, so this line means somebody asked: it belongs in the log so a
60    // deployment that inherited the flag from an older chart sees it rather than
61    // discovers it.
62    if let crate::config::Auth::Forge {
63        anonymous_read: true,
64        ..
65    } = config.auth
66    {
67        tracing::info!(
68            "anonymous read is on: a request with no credentials is resolved against the forge, so              objects in a repository the forge serves publicly can be read by anybody, and the              bandwidth is yours. Unset LFSX_ANONYMOUS_READ to require a token whatever the              repository's visibility"
69        );
70    }
71
72    // Refusing to start beats starting without it. A server that silently wrote
73    // plaintext because a Secret failed to mount is the one failure this feature
74    // must never have: nothing downstream would notice, and the objects written
75    // in the meantime are the ones the operator believed were covered.
76    let keys = config.encryption_key_file.as_deref().map(|path| {
77        std::sync::Arc::new(
78            crate::storage::crypt::Keyring::load(path)
79                .expect("the encryption key file is not usable"),
80        )
81    });
82
83    let local = LocalStore::new(config.storage_root.clone())
84        .with_max_object_size(config.max_object_size)
85        .with_compression(config.compression)
86        .with_encryption(keys);
87
88    // The two backends are chosen together and the lock policy is applied once,
89    // to both. Deciding it per arm is how `LFSX_LOCK_MAX_AGE` came to be silently
90    // ignored in bucket mode: the arms are far apart, only one of them had it,
91    // and nothing failed.
92    let (store, lock_backend) = match &config.storage {
93        crate::config::Storage::Local => (
94            Store::local(local),
95            LockStore::local(config.storage_root.clone()),
96        ),
97        crate::config::Storage::Bucket {
98            endpoint,
99            bucket,
100            region,
101            access_key,
102            secret_key,
103            path_style,
104            presign,
105        } => {
106            // Built once and shared: the objects and the locks are two ways of
107            // using the same bucket, not two buckets. Signing, the connection
108            // pool and the retry policy are settled here, and neither layer
109            // reaches into the other to get at them.
110            let keys = Keyspace::new(&S3Config {
111                endpoint: endpoint.clone(),
112                bucket: bucket.clone(),
113                region: region.clone(),
114                access_key: access_key.clone(),
115                secret_key: secret_key.clone(),
116                path_style: *path_style,
117                lifetime: std::time::Duration::from_secs(config.action_lifetime.into()),
118            })
119            .expect("the bucket configuration is not usable");
120
121            tracing::warn!(
122                "objects and locks are stored in a bucket: collection, deduplication, rewriting                  and verification answer 501, and the lfsx_objects_stored and lfsx_store_bytes                  gauges are not measured — read capacity from the bucket itself"
123            );
124
125            if *presign {
126                tracing::warn!(
127                    "LFSX_S3_PRESIGN=true — downloads are redirected to the bucket, so                      lfsx_downloaded_bytes stops counting them and the bucket serves the ranges"
128                );
129
130                if config.encryption_key_file.is_some() {
131                    tracing::warn!(
132                        "LFSX_ENCRYPTION_KEY_FILE is set, so uploads keep coming through this                          server rather than going straight to the bucket: an object a client                          writes itself would arrive unencrypted"
133                    );
134                } else if config.compression.is_some() {
135                    tracing::warn!(
136                        "LFSX_COMPRESSION is set, and objects clients upload straight to the                          bucket arrive uncompressed — only what passes through this server is                          compressed"
137                    );
138                }
139            }
140
141            // The locks go with the objects. Left on the volume they would make
142            // the bucket a half measure: capacity would be shared and the one
143            // piece of state a second replica must agree on would not be.
144            (
145                Store::bucket(S3Store::new(keys.clone(), *presign), local),
146                LockStore::bucket(keys),
147            )
148        }
149    };
150    (store, lock_backend.with_max_age(config.lock_max_age))
151}
lfsx_server/lib.rs

lfsx_server/
lib.rs
