Struct ServerConfig 

pub struct ServerConfig {

    pub bind: String,
    pub auth_token: Option<SecretString>,
    pub content_token_secret: SecretString,
    pub writer_id: String,
    pub runtime_cache: RuntimeCacheConfigOverrides,
    pub grep: GrepConfig,
    pub maintenance: MaintenanceMode,
    pub min_publish_interval_ms: u64,
    pub max_upload_bytes: u64,
    pub max_download_bytes: u64,
    pub max_concurrent_uploads: usize,
    pub max_concurrent_downloads: usize,
    pub max_concurrent_maintenance: usize,
    pub allow_unauthenticated_remote: bool,
    pub allow_remote_without_tls: bool,
    pub tls: Option<TlsServerConfig>,
    pub store: StoreConfig,
}

The server config file.

Secret precedence

auth_token and content_token_secret may be supplied through the LOONFS_AUTH_TOKEN and LOONFS_CONTENT_TOKEN_SECRET environment variables instead of the file, and the S3-compatible store credentials through the standard AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN. A non-blank value in the file always takes precedence; the environment variable fills the field only when the file leaves it unset (blank environment values are ignored).

Fields

bind: String

auth_token: Option<SecretString>

content_token_secret: SecretString

Signs content tokens; unset or empty here falls back to LOONFS_CONTENT_TOKEN_SECRET.

writer_id: String

runtime_cache: RuntimeCacheConfigOverrides

grep: GrepConfig

What this server does about grep, plus the bounded-step budgets its index maintenance runs under. A config with no [grep] table composes no grep at all; a table that names no mode both serves queries and maintains the index.

maintenance: MaintenanceMode

Whether this server maintains the namespaces it touches by itself. Automatic by default; see MaintenanceMode.

min_publish_interval_ms: u64

Minimum interval between publication starts per namespace, in milliseconds. A cold namespace publishes immediately; the interval paces follow-up batches so hot namespaces amortize into fewer, larger WAL segments. The server default favors batch economy over the embedded default’s latency bias.

max_upload_bytes: u64

Largest request body accepted for service-proxied upload content requests (PUT .../uploads/{upload_id}/content). Enforced incrementally while the body streams to the store, so it bounds the accepted transfer size, not per-request memory (streamed writes hold at most one internal part). Clients may use direct_put or direct multipart for larger transfers when the capability is advertised. Advertised as the upload.max_content_bytes capability limit.

max_download_bytes: u64

Largest file content a service-proxied read (GET .../filesystem/ content and inode revision content) will buffer and return. Checked against resolved metadata before any content fetch; over-limit reads answer content_too_large. Advertised to clients as the download.max_content_bytes capability limit.

max_concurrent_uploads: usize

How many proxied upload bodies the server will stream at once; requests past the cap answer server_busy before any transfer. Worst-case upload memory is this times one streamed part, since bodies forward to the store incrementally instead of buffering.

max_concurrent_downloads: usize

How many proxied content reads the server will materialize at once; requests past the cap answer server_busy before any fetch. Worst-case download memory is this times max_download_bytes.

max_concurrent_maintenance: usize

How many writer-scheduled maintenance steps may run at once across every job and namespace. Each job runs at most one step per namespace at a time; this bounds the fan-out when a write burst crosses thresholds in many namespaces together. A step that waits for a permit takes the next one that frees.

allow_unauthenticated_remote: bool

Allows serving on a non-loopback address with auth_token unset. Off by default: exposing every endpoint unauthenticated is almost always a misconfiguration, so validation rejects it unless this is explicitly set.

allow_remote_without_tls: bool

Allows serving on a non-loopback address in plaintext. Off by default for the same reason as allow_unauthenticated_remote: the wire carries the bearer token and the presigned object-store URLs the upload routes hand back, so plaintext beyond localhost is almost always a misconfiguration rather than a choice. Set it where TLS terminates in front of this process.

tls: Option<TlsServerConfig>

Terminates TLS in this process when present. Absent means plaintext HTTP, which validation only accepts on a loopback bind or with allow_remote_without_tls.

store: StoreConfig

Implementations

impl ServerConfig

pub fn runtime_cache_config(&self) -> RuntimeCacheConfig

pub fn object_store(&self) -> Result<ConfiguredObjectStore, ServerConfigError>

Trait Implementations

impl Clone for ServerConfig

fn clone(&self) -> ServerConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ServerConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.