Struct AppConfig 

#[non_exhaustive]
pub struct AppConfig {

    pub db_uri: String,
    pub db_schemas: Vec<String>,
    pub db_anon_role: Option<String>,
    pub db_pool_size: u32,
    pub db_pool_timeout: u64,
    pub db_tx_isolation: IsolationLevel,
    pub db_prepared_statements: bool,
    pub db_extra_search_path: Vec<String>,
    pub db_channel: String,
    pub db_channel_enabled: bool,
    pub db_pre_request: Option<String>,
    pub db_max_rows: Option<i64>,
    pub db_aggregates_enabled: bool,
    pub server_host: String,
    pub server_port: u16,
    pub server_cors_origins: Vec<String>,
    pub max_body_size: usize,
    pub server_unix_socket: Option<String>,
    pub admin_server_port: Option<u16>,
    pub jwt_secret: Option<String>,
    pub jwt_secret_is_base64: bool,
    pub jwt_aud: Option<String>,
    pub jwt_iss: Option<String>,
    pub jwt_role_claim_key: String,
    pub jwt_cache_enabled: bool,
    pub jwt_cache_max_lifetime: u64,
    pub jwt_jwks_url: Option<String>,
    pub jwt_jwks_refresh: u64,
    pub hasura_admin_secret: Option<String>,
    pub hasura_unauthorized_role: Option<String>,
    pub openapi_server_proxy_uri: Option<String>,
    pub openapi_mode: OpenApiMode,
    pub log_level: LogLevel,
    pub log_format: LogFormat,
    pub otel_db_statement: bool,
    pub role_settings: HashMap<String, RoleSettings>,
    pub app_settings: HashMap<String, String>,
    pub graphql_federation: bool,
    pub graphql_type_prefix: Option<String>,
    pub compat_mode: bool,
}

Main application configuration.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

db_uri: String

PostgreSQL connection URI

db_schemas: Vec<String>

Schemas to expose via the API

db_anon_role: Option<String>

Role for unauthenticated requests

db_pool_size: u32

Connection pool size

db_pool_timeout: u64

Pool acquisition timeout in seconds

db_tx_isolation: IsolationLevel

Isolation level for the transaction every request runs in.

READ COMMITTED unless set, which is PostgreSQL’s own default; a stricter level is issued as SET TRANSACTION ISOLATION LEVEL on the request’s transaction.

db_prepared_statements: bool

Use prepared statements

db_extra_search_path: Vec<String>

Schemas added to the search_path of every request, after the request’s own schema.

These are not exposed as API endpoints; they are where a function an exposed one calls, or a type it references, is allowed to live. An aggregate returning a domain declared elsewhere cannot resolve that domain without this. public by default, as in PostgREST.

db_channel: String

LISTEN/NOTIFY channel for schema reload

db_channel_enabled: bool

Enable NOTIFY-based schema cache reload

db_pre_request: Option<String>

Function called on the request’s transaction before its own query, after every setting is applied. Anything it raises aborts the request.

db_max_rows: Option<i64>

Maximum rows allowed in a response

db_aggregates_enabled: bool

Enable aggregate functions in select.

Off by default, as in PostgREST: an aggregate over a large table costs far more than the request looks like it asks for.

server_host: String

Server host to bind

server_port: u16

Server port

server_cors_origins: Vec<String>

Origins allowed by CORS.

Empty means every origin is allowed, which is the default and what PGRST_SERVER_CORS_ORIGINS="*" selects explicitly. A non-empty list restricts the Access-Control-Allow-Origin response to exactly those origins; anything else gets no CORS headers and is refused by the browser.

max_body_size: usize

Maximum accepted request body, in bytes.

The REST handler applies this when it reads the body; the routes that take a body extractor get it through axum’s DefaultBodyLimit. Before this was read, the limit in force was a 10 MiB constant in the request handler, whatever the variable said.

server_unix_socket: Option<String>

Listen on a Unix domain socket instead of host and port.

admin_server_port: Option<u16>

Serve liveness and readiness on a second port of their own.

jwt_secret: Option<String>

JWT secret: an HMAC secret, or a JSON Web Key or JWK Set.

jwt_secret_is_base64: bool

JWT secret as base64

jwt_aud: Option<String>

JWT audience claim to validate

jwt_iss: Option<String>

The issuer a token’s iss claim must name (PGRST_JWT_ISS). Unset, iss is not checked.

jwt_role_claim_key: String

JWT claim that contains the role

jwt_cache_enabled: bool

Cache validated tokens, so a repeated token is not verified again.

jwt_cache_max_lifetime: u64

How long a cached validation may be reused, in seconds.

A token’s own exp bounds this; the cache never answers with a token past its expiry. 0 turns the cache off, as in PostgREST.

jwt_jwks_url: Option<String>

Where to fetch a JSON Web Key Set from (PGRST_JWT_JWKS_URL), and keep fetching it as the identity provider rotates its keys.

https, or http to a loopback host; checked when the server is built. With jwt_secret also set, a token either one verifies is accepted. See docs/authentication.md.

jwt_jwks_refresh: u64

How often to fetch jwt_jwks_url again, in seconds, when its response carries no Cache-Control: max-age (PGRST_JWT_JWKS_REFRESH).

hasura_admin_secret: Option<String>

The shared secret that authenticates an administrator, and the switch that makes x-hasura-* headers mean anything at all.

Unset, this server ignores those headers and reads session variables only from a verified token – because honouring a header nothing authenticated would let any caller name its own identity, and a policy reading a value the caller chose is not a policy. Hasura instead treats an unsecured deployment as wholly administrative; the divergence is deliberate and is recorded in postrust_auth::hasura.

hasura_unauthorized_role: Option<String>

The role a request falls to when nothing authenticated it. Hasura’s HASURA_GRAPHQL_UNAUTHORIZED_ROLE; unset means such a request is refused rather than answered as a stranger.

openapi_server_proxy_uri: Option<String>

Address to advertise in the specification’s servers, for when the server sits behind a reverse proxy and its own address is not the one clients use.

openapi_mode: OpenApiMode

OpenAPI mode: disabled, follow-privileges, ignore-privileges

log_level: LogLevel

Log level: crit, error, warn, info, debug

log_format: LogFormat

How log lines are written: text for a person at a terminal, json for a log shipper. JSON lines carry the fields of every span the event happened in, so each one names its request_id and trace_id.

Like log_level, the binaries read the variable themselves before the configuration is loaded – the subscriber has to exist first to report what loading it rejects – and this field is that same value, kept for anything that reads the configuration afterwards.

otel_db_statement: bool

Record the SQL of a request’s main query on its db.query span, as OpenTelemetry’s db.query.text.

Off by default. The statement is parameterized, so the values a client sent are not in it – but the table, column and function names are, and whatever collects traces may be read by more people than the schema is meant for. Formatting it costs nothing while it is off.

role_settings: HashMap<String, RoleSettings>

Per-role settings (isolation level, timeout)

app_settings: HashMap<String, String>

App-level settings to expose via GUC

graphql_federation: bool

Expose the GraphQL API as an Apollo Federation subgraph.

graphql_type_prefix: Option<String>

Namespace applied to generated GraphQL table types and root fields.

compat_mode: bool

PostgREST compatibility mode.

When enabled, the REST surface is also served at the root (so canonical PostgREST paths like /rpc/<name> and /<table> work in addition to the /api-prefixed paths), and RPC responses are un-wrapped to match PostgREST’s shape (bare object/scalar for non-set-returning functions, a top-level array for set-returning ones) instead of the array-wrapped, function-name-keyed default.

Implementations

impl AppConfig

pub fn from_env() -> Self

Load configuration from environment variables.

Panics

Panics if a boolean environment variable has an unsupported value. Use Self::try_from_env when the caller can propagate a startup error.

pub fn try_from_env() -> Result<Self, ConfigError>

Load configuration from environment variables, rejecting invalid boolean values.

pub fn try_from_vars<I, K, V>(vars: I) -> Result<Self, ConfigError>

where I: IntoIterator<Item = (K, V)>, K: Into<String>, V: Into<String>,

Load configuration from name/value pairs spelled as the environment variables are, for a host with no process environment – a Cloudflare Worker reads its bindings instead. Where a name appears twice, the last one wins. Names are matched exactly, case included.

pub fn default_schema(&self) -> &str

Get the default schema (first in the list).

Trait Implementations

impl Clone for AppConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AppConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AppConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AppConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for AppConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.