Struct ServerConfig 

pub struct ServerConfig {

    pub database_url: Option<String>,
    pub jwt_secret: String,
    pub worker_token: String,
    pub port: u16,
    pub allowed_origins: Option<String>,
    pub dashboard_dir: Option<PathBuf>,
    pub webhook_url: Option<String>,
    pub artifacts_dir: Option<PathBuf>,
    pub artifact_max_bytes: u64,
    pub purge_max_age_days: u32,
    pub purge_max_runs_per_workflow: u32,
    pub purge_dry_run: bool,
    pub purge_interval_secs: u64,
    pub provider_account_usage_retention_days: u32,
    pub signal_retention_days: u32,
    pub is_production: bool,
    pub cookie_secure: bool,
    pub rate_limit_auth: Option<u32>,
    pub rate_limit_general: Option<u32>,
    pub trusted_proxies: TrustedProxies,
    pub artifact_backend: String,
    pub artifact_s3_bucket: Option<String>,
    pub artifact_s3_region: String,
    pub artifact_s3_endpoint: Option<String>,
    pub artifact_s3_prefix: Option<String>,
    pub artifact_gc_interval_secs: u64,
    pub artifact_gc_grace_days: u32,
    pub artifact_gc_dry_run: bool,
}

Server configuration loaded from environment variables.

Use ServerConfig::from_env to load and validate at startup.

Examples

use ironflow_api::config::ServerConfig;

let config = ServerConfig::from_env()?;
assert!(config.port > 0);

Fields

database_url: Option<String>

PostgreSQL connection string. Required in production.

jwt_secret: String

JWT signing secret.

worker_token: String

Worker-to-API authentication token.

port: u16

HTTP listen port.

allowed_origins: Option<String>

Comma-separated list of allowed CORS origins.

dashboard_dir: Option<PathBuf>

Filesystem path to dashboard assets (overrides embedded).

webhook_url: Option<String>

Outbound webhook URL for event notifications.

artifacts_dir: Option<PathBuf>

Filesystem root for artifact blobs.

None leaves artifacts disabled: the artifact routes answer 501 and a step that declares one fails explicitly. Every other endpoint is unaffected, so an existing deployment upgrades without changes.

Read from ARTIFACTS_DIR.

artifact_max_bytes: u64

Maximum size of a single artifact, in bytes.

Read from ARTIFACT_MAX_BYTES, defaulting to 100 MiB.

purge_max_age_days: u32

Maximum age of a run before it becomes eligible for purging, in days.

Read from PURGE_MAX_AGE_DAYS, defaulting to 90.

purge_max_runs_per_workflow: u32

Maximum number of terminal runs to keep per workflow.

Read from PURGE_MAX_RUNS_PER_WORKFLOW, defaulting to 1000.

purge_dry_run: bool

When true, the purger logs what would be deleted but does not delete.

Read from PURGE_DRY_RUN, defaulting to false.

purge_interval_secs: u64

Interval between purge ticks, in seconds.

Read from PURGE_INTERVAL_SECS, defaulting to 86400 (once per day).

provider_account_usage_retention_days: u32

Days of Provider Account usage history kept by the purger.

Read from PROVIDER_ACCOUNT_USAGE_RETENTION_DAYS, defaulting to 30.

signal_retention_days: u32

Days received signals are kept by the purger.

Read from SIGNAL_RETENTION_DAYS, defaulting to 7.

is_production: bool

Whether the server is running in production mode.

cookie_secure: bool

Whether session cookies carry the Secure flag.

Always true in production. In development it defaults to true and is switched off only by IRONFLOW_INSECURE_COOKIES=1 (or true), for local setups served over plain HTTP from a non-localhost origin.

rate_limit_auth: Option<u32>

Rate limit for auth credential routes (sign-in, sign-up) in requests per minute per IP. None disables rate limiting on these routes.

rate_limit_general: Option<u32>

Rate limit for general public API routes in requests per minute per IP. None disables rate limiting on these routes.

trusted_proxies: TrustedProxies

Reverse proxies whose X-Forwarded-For / X-Real-IP the rate limiters believe, from TRUSTED_PROXIES (comma-separated IPs or CIDR ranges). Unset: none, the client IP is the TCP peer.

artifact_backend: String

Blob storage backend: local or s3.

artifact_s3_bucket: Option<String>

S3 bucket name (required when artifact_backend is s3).

artifact_s3_region: String

S3 region, defaults to eu-west-1.

artifact_s3_endpoint: Option<String>

Custom S3 endpoint for MinIO, R2, or GCS S3-compat.

artifact_s3_prefix: Option<String>

Key prefix within the S3 bucket.

artifact_gc_interval_secs: u64

Seconds between GC ticks, defaults to 86400 (once per day).

artifact_gc_grace_days: u32

Days before an orphan blob is eligible for deletion, defaults to 7.

artifact_gc_dry_run: bool

When true, the GC logs what would be deleted without deleting.

Implementations

impl ServerConfig

pub fn from_env() -> Result<Self, ConfigError>

Load configuration from environment variables and validate.

JWT_SECRET and WORKER_TOKEN must be set, at least 32 bytes long and must not carry the prefix ironflow-dev- of the development values once published in the repository. DATABASE_URL is also required in production (IRONFLOW_ENV=production).

Only an explicit IRONFLOW_ENV=development relaxes this: a missing secret is then generated at random for this process (the worker token is logged so a worker can be started with it), and the length check is waived. The ironflow-dev- prefix and empty values are refused in every mode. No secret is compiled into the binary.

Session cookies are Secure unless IRONFLOW_INSECURE_COOKIES is 1 or true outside production. In production the variable is ignored with a warning.

Errors

Returns ConfigError with all validation failures collected, so the operator can fix everything in one pass.

Examples

use ironflow_api::config::ServerConfig;

let config = ServerConfig::from_env()?;

Trait Implementations

impl Clone for ServerConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.