Struct Control 

pub struct Control { /* private fields */ }

The control plane: owns the Host (and thus the trust policy + epoch ticker) and the artifact store, and holds the active filter set behind an ArcSwap for lock-free reads and atomic reload. manifest_path is Some only when the plane was built from an on-disk manifest — that is what reload_from_disk (and the SIGHUP loop) re-reads.

Implementations

impl Control

pub fn filter_metrics(&self) -> MetricsSnapshot

A snapshot of the host-aggregated filter-execution metrics (ADR 000009): the tally the MetricsSink wired at construction has accumulated. The fast path’s admin /metrics endpoint renders this alongside its native RED metrics.

pub fn admin_addr(&self) -> Option<&str>

The admin endpoint bind address ([observability] admin_addr), or None when no admin listener is configured (the default). The fast path binds a separate listener there for /metrics + liveness/readiness (ADR 000009 Stage A).

pub fn access_log_enabled(&self) -> bool

Whether the structured access log is enabled ([observability] access_log, ADR 000009).

pub fn otlp_endpoint(&self) -> Option<&str>

The OTLP/HTTP collector base URL ([observability] otlp_endpoint, ADR 000040), or None when trace export is off (the default). The exporter appends /v1/traces.

pub fn otlp_buffer(&self) -> Option<Arc<OtlpBuffer>>

The OTLP span buffer (ADR 000040): filter spans fan into it from the host sink, the fast path pushes its request span, and the export pump drains it. Present iff otlp_endpoint is set.

pub fn listen_addr(&self) -> Option<&str>

The manifest’s data-plane bind address ([listen] addr), or None for the binary default. Captured at construction, like admin_addr — a reload does not re-bind; the CLI’s explicit positional arg overrides it.

pub fn advertised_port(&self) -> Option<u16>

The Alt-Svc h3 advertisement port override ([listen] advertised_port), or None to advertise the bound port. For container port mappings where the published port differs from the bound one (moka-1 field report §3.4).

pub fn proxy_protocol_trust(&self) -> Option<ProxyProtocolTrust>

The parsed [listen.proxy_protocol] trusted networks (ADR 000057), or None when PROXY v2 reception is off (the default). Captured at construction like listen_addr — the TCP listener consults it once at startup; a reload does not change it. The h3/UDP listener is out of scope (ADR 000057 decision 5).

pub fn readiness_grace(&self) -> Duration

The readiness grace ([listen.drain] readiness_grace_ms, ADR 000059): how long /readyz reports not-ready — while connections are still accepted — before the drain starts, so a front load balancer can take the replica out of rotation first. Zero (the default) starts the drain immediately. Captured at construction like the rest of [listen].

pub fn drain_window(&self) -> Option<Duration>

The drain window ([listen.drain] window_ms, ADR 000059): how long in-flight work may finish at shutdown before remaining connections are cut. None = the server’s default (30 s). One setting shared by every drain path (TCP requests, h3 GOAWAY, tunnels).

impl Control

pub fn reload(&self, manifest: &Manifest) -> Result<(), ControlError>

Atomically swap to a new manifest’s filter set + chain (ADR 000007: build the new set fully, then switch in one store; the old set is drained as its Arc refs drop). If any filter fails to resolve / verify / load, the swap does not happen and the current set stays live — reload is all-or-nothing. The trust policy is fixed at construction.

pub fn reload_from_disk(&self) -> Result<ReloadOutcome, ControlError>

Re-read the on-disk manifest and reload if its config version changed. The trigger (SIGHUP, serve_reloads) is content-free, so this is where the new config is actually read. Idempotent: an unchanged manifest (same semantic content_hash) is a no-op — no rebuild, no drain. A changed one is built fully and swapped atomically; on any build failure the running set is left untouched (fail-closed) and the error returned.

Errors with NoManifestPath if this plane was not built from an on-disk manifest (load / from_manifest); use from_manifest_path / load_at for a reloadable plane.

pub fn config_version(&self) -> String

The active config’s content_hash (ADR 000008 config version): the audit identity of what is loaded right now, and the unit a future opt-in consensus layer would agree on.

impl Control

pub fn snapshot(&self) -> ConfigSnapshot

Pin the active config for one request transaction (see ConfigSnapshot). The fast-path server takes one snapshot per request and drives both halves through it, so a concurrent reload cannot desync the request and response sides of the same transaction.

pub fn snapshot_with_trace(&self, trace: RequestTrace) -> ConfigSnapshot

Like [Control::snapshot], but continue an inbound trace context (ADR 000009): the fast-path server parses the request’s W3C traceparent into a RequestTrace and passes it here, so the chain’s spans join the caller’s distributed trace instead of starting a fresh root.

pub fn on_request(&self, request: HttpRequest) -> ChainOutcome

Drive a request through the chain. Returns whether to forward the (possibly edited) request upstream, or to respond now (a filter short-circuited, or the chain failed closed on a trap / deadline). Convenience for a one-shot caller; a request transaction that also runs a response should use [Control::snapshot] to pin one config.

pub fn on_response( &self, request: &HttpRequest, response: HttpResponse, ) -> ResponseOutcome

Drive a response back through the chain in reverse, applying response edits. A trapped filter yields a fail-closed 5xx; a replace yields the synthesised response (both as ResponseOutcome::Respond). See [Control::snapshot] for the transaction-pinned form.

impl Control

pub fn tls_config(&self) -> Option<Arc<ServerConfig>>

The active TLS server config (ADR 000014), or None for plain HTTP/1.1. The fast-path server reads this per accepted connection, so a reload’s new certs apply to new connections while in-flight ones keep the cert they negotiated with.

pub fn quic_tls_config(&self) -> Option<Arc<ServerConfig>>

The active QUIC TLS config for HTTP/3 (ADR 000016): ALPN h3, TLS 1.3, sharing the TCP config’s SNI cert resolver. None whenever there is no [[tls]] (h3 requires TLS, so it is only offered alongside TLS termination). The fast-path server reads this once to decide whether to bind a QUIC listener and what to advertise via Alt-Svc.

impl Control

pub fn upstream_groups(&self) -> Vec<Arc<UpstreamGroup>>

A snapshot of the current upstream groups (ADR 000017), for the fast-path server’s health-check supervisor to probe. Reflects the latest reconcile, so a reload’s added / removed instances are picked up on the supervisor’s next tick without restarting it.

impl Control

pub fn from_manifest( manifest: &Manifest, base_dir: &Path, ) -> Result<Self, ControlError>

Build a control plane entirely from a manifest and a base directory — the ops entrypoint. Reads the trusted-key PEMs (ADR 000006), constructs the Host, and resolves filters from offline OCI image-layouts under base_dir (ADR 000007). Every path in the manifest (trust.keys, each filter source) is resolved relative to base_dir. Remote fetch (wkg) is an out-of-band step that populates those layouts.

pub fn load( host: Host, manifest: &Manifest, store: Box<dyn ArtifactStore>, ) -> Result<Self, ControlError>

Build from a pre-constructed Host (carrying its TrustPolicy) and an artifact store — the testable core. Each manifest filter is resolved through store (digest pin), loaded through the host’s ADR 000006 gate (signature + SBOM), and the chain order is validated against the loaded set. Any failure aborts the build (nothing is loaded half-way into a live set).

pub fn from_manifest_path(manifest_path: &Path) -> Result<Self, ControlError>

Build the whole control plane from a single on-disk manifest file — the disk-reloadable ops entrypoint (ADR 000007 / 000008). Like from_manifest, but reads and remembers the manifest path so SIGHUP / reload_from_disk can pick up an operator’s edits. Trusted-key PEMs and filter layouts resolve relative to the manifest’s own directory.

pub fn load_at( host: Host, manifest_path: &Path, store: Box<dyn ArtifactStore>, ) -> Result<Self, ControlError>

Like load, but the manifest lives on disk at manifest_path: the path is remembered so reload_from_disk can re-read it, while artifacts still resolve through the injected store (so a test can pair an on-disk manifest with an in-memory artifact store). The trust policy stays fixed on host.

pub fn loaded_ids(&self) -> Vec<String>

The ids currently loaded (for diagnostics / tests). Order is unspecified.