Struct ServerConfig 

pub struct ServerConfig {

    pub schema_path: PathBuf,
    pub database_url: String,
    pub bind_addr: SocketAddr,
    pub cors_enabled: bool,
    pub cors_origins: Vec<String>,
    pub compression_enabled: bool,
    pub tracing_enabled: bool,
    pub apq_enabled: bool,
    pub cache_enabled: bool,
    pub graphql_path: String,
    pub health_path: String,
    pub introspection_path: String,
    pub metrics_path: String,
    pub metrics_json_path: String,
    pub playground_path: String,
    pub playground_enabled: bool,
    pub playground_tool: PlaygroundTool,
    pub subscription_path: String,
    pub subscriptions_enabled: bool,
    pub metrics_enabled: bool,
    pub metrics_token: Option<String>,
    pub admin_api_enabled: bool,
    pub admin_token: Option<String>,
    pub introspection_enabled: bool,
    pub introspection_require_auth: bool,
    pub design_api_require_auth: bool,
    pub pool_min_size: usize,
    pub pool_max_size: usize,
    pub pool_timeout_secs: u64,
    pub auth: Option<OidcConfig>,
    pub tls: Option<TlsServerConfig>,
    pub database_tls: Option<DatabaseTlsConfig>,
    pub require_json_content_type: bool,
    pub max_request_body_bytes: usize,
    pub rate_limiting: Option<RateLimitingConfig>,
}

Server configuration.

Fields

schema_path: PathBuf

Path to compiled schema JSON file.

database_url: String

Database connection URL (PostgreSQL, MySQL, SQLite, SQL Server).

bind_addr: SocketAddr

Server bind address.

cors_enabled: bool

Enable CORS.

cors_origins: Vec<String>

CORS allowed origins (if empty, allows all).

compression_enabled: bool

Enable compression.

tracing_enabled: bool

Enable request tracing.

apq_enabled: bool

Enable APQ (Automatic Persisted Queries).

cache_enabled: bool

Enable query caching.

graphql_path: String

GraphQL endpoint path.

health_path: String

Health check endpoint path.

introspection_path: String

Introspection endpoint path.

metrics_path: String

Metrics endpoint path (Prometheus format).

metrics_json_path: String

Metrics JSON endpoint path.

playground_path: String

Playground (GraphQL IDE) endpoint path.

playground_enabled: bool

Enable GraphQL playground/IDE (default: false for production safety).

When enabled, serves a GraphQL IDE (GraphiQL or Apollo Sandbox) at the configured playground_path.

Security: Disabled by default for production safety. Set to true for development environments only. The playground exposes schema information and can be a reconnaissance vector for attackers.

playground_tool: PlaygroundTool

Which GraphQL IDE to use.

• graphiql: The classic GraphQL IDE (default)
• apollo-sandbox: Apollo’s embeddable sandbox

subscription_path: String

WebSocket endpoint path for GraphQL subscriptions.

subscriptions_enabled: bool

Enable GraphQL subscriptions over WebSocket.

When enabled, provides graphql-ws (graphql-transport-ws) protocol support for real-time subscription events.

metrics_enabled: bool

Enable metrics endpoints.

Security: Disabled by default for production safety. When enabled, requires metrics_token to be set for authentication.

metrics_token: Option<String>

Bearer token for metrics endpoint authentication.

Required when metrics_enabled is true. Requests must include: Authorization: Bearer <token>

Security: Use a strong, random token (e.g., 32+ characters).

admin_api_enabled: bool

Enable admin API endpoints (default: false for production safety).

Security: Disabled by default. When enabled, requires admin_token to be set. Admin endpoints allow schema reloading, cache management, and config inspection.

admin_token: Option<String>

Bearer token for admin API authentication.

Required when admin_api_enabled is true. Requests must include: Authorization: Bearer <token>

Security: Use a strong, random token (minimum 32 characters). This token grants access to sensitive operations like schema reloading.

introspection_enabled: bool

Enable introspection endpoint (default: false for production safety).

Security: Disabled by default. When enabled, the introspection endpoint exposes the complete GraphQL schema structure. Combined with introspection_require_auth, you can optionally protect it with OIDC authentication.

introspection_require_auth: bool

Require authentication for introspection endpoint (default: true).

When true and OIDC is configured, introspection requires same auth as GraphQL endpoint. When false, introspection is publicly accessible (use only in development).

design_api_require_auth: bool

Require authentication for design audit API endpoints (default: true).

Design audit endpoints expose system architecture and optimization opportunities. When true and OIDC is configured, design endpoints require same auth as GraphQL endpoint. When false, design endpoints are publicly accessible (use only in development).

pool_min_size: usize

Database connection pool minimum size.

pool_max_size: usize

Database connection pool maximum size.

pool_timeout_secs: u64

Database connection pool timeout in seconds.

auth: Option<OidcConfig>

OIDC authentication configuration (optional).

When set, enables JWT authentication using OIDC discovery. Supports Auth0, Keycloak, Okta, Cognito, Azure AD, and any OIDC-compliant provider.

Example (TOML)

[auth]
issuer = "https://your-tenant.auth0.com/"
audience = "your-api-identifier"

tls: Option<TlsServerConfig>

TLS/SSL configuration for HTTPS and encrypted connections.

When set, enables TLS enforcement for HTTP/gRPC endpoints and optionally requires mutual TLS (mTLS) for client certificates.

Example (TOML)

[tls]
enabled = true
cert_path = "/etc/fraiseql/cert.pem"
key_path = "/etc/fraiseql/key.pem"
require_client_cert = false
min_version = "1.2"  # "1.2" or "1.3"

database_tls: Option<DatabaseTlsConfig>

Database TLS configuration.

Enables TLS for database connections and configures per-database TLS settings (PostgreSQL, Redis, ClickHouse, etc.).

Example (TOML)

[database_tls]
postgres_ssl_mode = "require"  # disable, allow, prefer, require, verify-ca, verify-full
redis_ssl = true               # Use rediss:// protocol
clickhouse_https = true         # Use HTTPS
elasticsearch_https = true      # Use HTTPS
verify_certificates = true      # Verify server certificates

require_json_content_type: bool

Require Content-Type: application/json on POST requests (default: true).

CSRF protection: rejects POST requests with non-JSON Content-Type (e.g. text/plain, application/x-www-form-urlencoded) with 415.

max_request_body_bytes: usize

Maximum request body size in bytes (default: 1 MB).

Requests exceeding this limit receive 413 Payload Too Large. Set to 0 to use axum’s default (no limit).

rate_limiting: Option<RateLimitingConfig>

Rate limiting configuration for GraphQL requests.

When configured, enables per-IP and per-user rate limiting with token bucket algorithm. Defaults to enabled with sensible per-IP limits for security-by-default.

Example (TOML)

[rate_limiting]
enabled = true
rps_per_ip = 100      # 100 requests/second per IP
rps_per_user = 1000   # 1000 requests/second per authenticated user
burst_size = 500      # Allow bursts up to 500 requests

Implementations

impl ServerConfig

pub fn is_production_mode() -> bool

Check if running in production mode.

Production mode is detected via FRAISEQL_ENV environment variable.

• production or prod (or any value other than development/dev) → production mode
• development or dev → development mode

pub fn validate(&self) -> Result<(), String>

Validate configuration.

Errors

Returns error if:

• metrics_enabled is true but metrics_token is not set
• metrics_token is set but too short (< 16 characters)
• auth config is set but invalid (e.g., empty issuer)
• tls is enabled but cert or key path is missing
• TLS minimum version is invalid
• In production mode: playground_enabled is true
• In production mode: cors_enabled is true but cors_origins is empty

pub fn auth_enabled(&self) -> bool

Check if authentication is enabled.

Trait Implementations

impl Clone for ServerConfig

fn clone(&self) -> ServerConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ServerConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for ServerConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ServerConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.