pub struct Docs {
pub enabled: bool,
pub max_size: usize,
pub build_timeout_seconds: u64,
pub build_wrapper: Vec<String>,
}Fields§
§enabled: boolEnable documentation hosting
Building docs runs the build scripts and proc macros of every
published crate on the Kellnr host. See build_wrapper before
enabling this for publishers you do not fully trust.
max_size: usizeMax docs size in MB
build_timeout_seconds: u64Max duration of a single rustdoc build in seconds (0 = unlimited). Builds that take longer are killed and the crate is skipped.
build_wrapper: Vec<String>Command prefix (comma-separated) for the rustdoc build process.
Building docs compiles the published crate, which runs its build
scripts and proc macros. Kellnr runs every build in a child process
with a cleared environment, so no KELLNR_* settings or secrets are
passed on. Cargo’s own CARGO_* variables are kept, so a registry
token in CARGO_REGISTRIES_<NAME>_TOKEN is visible to build scripts
and should belong to a dedicated read-only user.
The build still runs as the Kellnr user: it can read every
file Kellnr can read (for example the config file or the SQLite
database, e.g. via include_str!) and it has network access. Kellnr
only publishes the files rustdoc generates, but the build can write
such content into the generated docs of the crate. Only enable docs
for crates you trust, or set a wrapper that confines the build, e.g.
with bubblewrap:
["bwrap", "--ro-bind", "/", "/", "--tmpfs", "<data_dir>", "--bind", "<data_dir>/doc_queue", "<data_dir>/doc_queue", "--bind", "<cargo_home>", "<cargo_home>", "--tmpfs", "/etc/kellnr", "--dev", "/dev", "--proc", "/proc", "--tmpfs", "/tmp", "--unshare-pid", "--die-with-parent", "--"].
The wrapper is followed by the Kellnr binary and its arguments.
Implementations§
Trait Implementations§
Source§impl<'de> Deserialize<'de> for Docs
impl<'de> Deserialize<'de> for Docs
Source§fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>where
__D: Deserializer<'de>,
fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>where
__D: Deserializer<'de>,
impl Eq for Docs
impl StructuralPartialEq for Docs
Auto Trait Implementations§
impl Freeze for Docs
impl RefUnwindSafe for Docs
impl Send for Docs
impl Sync for Docs
impl Unpin for Docs
impl UnsafeUnpin for Docs
impl UnwindSafe for Docs
Blanket Implementations§
Source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> DeserializeOwned for Twhere
T: for<'de> Deserialize<'de>,
Source§impl<Q, K> Equivalent<K> for Q
impl<Q, K> Equivalent<K> for Q
Source§fn equivalent(&self, key: &K) -> bool
fn equivalent(&self, key: &K) -> bool
key and return true if they are equal.Source§impl<T> Instrument for T
impl<T> Instrument for T
Source§fn instrument(self, span: Span) -> Instrumented<Self> ⓘ
fn instrument(self, span: Span) -> Instrumented<Self> ⓘ
Source§fn in_current_span(self) -> Instrumented<Self> ⓘ
fn in_current_span(self) -> Instrumented<Self> ⓘ
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self> ⓘ
fn into_either(self, into_left: bool) -> Either<Self, Self> ⓘ
self into a Left variant of Either<Self, Self>
if into_left is true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self> ⓘ
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self> ⓘ
self into a Left variant of Either<Self, Self>
if into_left(&self) returns true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read more