Struct Config 

pub struct Config {

    pub data_dir: PathBuf,
    pub rest_addr: SocketAddr,
    pub grpc_addr: SocketAddr,
    pub api_keys: Vec<ApiKey>,
    pub encryption_key: Option<String>,
    pub master_key_file: Option<PathBuf>,
    pub tls_cert: Option<PathBuf>,
    pub tls_key: Option<PathBuf>,
    pub tls_client_ca: Option<PathBuf>,
    pub audit_log: Option<PathBuf>,
    pub leader_url: Option<String>,
    pub leader_api_key: Option<String>,
    pub insecure: bool,
    pub limits: Limits,
    pub embedding: HashMap<String, EmbeddingConfig>,
    pub rerank: HashMap<String, RerankConfig>,
    pub rate_limit: RateLimitConfig,
    pub otlp: OtlpConfig,
    pub mvcc_reads: bool,
    pub cluster_shards: Vec<String>,
    pub cluster_replicas: Vec<String>,
    pub cluster_shard_key: Option<String>,
    pub coordinator: bool,
    pub coordinator_url: Option<String>,
    pub coordinator_state: Option<PathBuf>,
    pub autoscale: AutoscaleConfig,
    pub raft_node_id: Option<u64>,
    pub raft_members: Vec<String>,
}

Server configuration, layered defaults → quiver.toml → QUIVER_* env and validated at startup (ADR-0013).

Fields

data_dir: PathBuf

Data directory for the storage engine.

rest_addr: SocketAddr

REST (HTTP/1.1) bind address.

grpc_addr: SocketAddr

gRPC (HTTP/2) bind address.

api_keys: Vec<ApiKey>

Accepted API keys with their RBAC scopes (ADR-0011). A bare secret — from a comma-separated QUIVER_API_KEYS (the env form) or a plain TOML array entry — is an all-collections admin key; a structured {secret, role, collections} entry pins a narrower scope. Empty is allowed only with insecure = true.

encryption_key: Option<String>

Hex-encoded 256-bit master key for encryption-at-rest (64 hex characters). It wraps per-collection data-encryption keys (ADR-0010). Required unless insecure = true or master_key_file is set; source it from the environment or a secret store, never the committed config. None ⇒ data is stored unencrypted (only valid in insecure mode).

master_key_file: Option<PathBuf>

Path to a file holding the hex master key, as an alternative to encryption_key (set exactly one). Lets the key arrive as a mounted secret (Docker/Kubernetes) or a KMS-decrypted file rather than an environment variable. It should be mode 0600; a group/world-accessible file is warned about at startup.

tls_cert: Option<PathBuf>

Path to the PEM-encoded TLS certificate chain. Must be set together with tls_key. Required for a non-loopback bind unless insecure = true.

tls_key: Option<PathBuf>

Path to the PEM-encoded TLS private key. Must be set together with tls_cert.

tls_client_ca: Option<PathBuf>

Path to a PEM-encoded CA certificate that signs accepted client certificates. When set, both transports require mutual TLS: a client must present a certificate chaining to this CA to connect (ADR-0011). Requires tls_cert/tls_key; bearer API keys still carry the RBAC scope.

audit_log: Option<PathBuf>

Path to an append-only audit log file (ADR-0011). When set, every mutating and administrative operation and every access-control denial is appended as one JSON object per line (JSON Lines); records are always also emitted as tracing events. Unset ⇒ tracing only. Secrets are never written — see docs/security/audit.md.

leader_url: Option<String>

Run as a read-replica follower (ADR-0030): connect to a leader’s gRPC endpoint at this URL (e.g. http://leader:6334) and continuously apply its committed operations, serving reads. A follower refuses writes. Unset ⇒ this node is a normal read-write leader. (Plaintext http:// for now; TLS to the leader is a follow-up — run replication over a trusted network.)

leader_api_key: Option<String>

API key the follower presents to the leader’s admin-scoped Replicate stream (used with leader_url). Source it like any secret.

insecure: bool

Opt out of the secure defaults (no auth, no encryption-at-rest, allow a non-loopback bind without TLS). For local development only; never the default.

limits: Limits

Per-request cost limits (ADR-0040). Set with a [limits] table in quiver.toml or the QUIVER_MAX_* environment variables.

embedding: HashMap<String, EmbeddingConfig>

Opt-in server-side embedding providers, keyed by collection name (ADR-0047). Configured with [embedding.<collection>] tables in quiver.toml; default empty, so the engine stays model-agnostic and library mode is unaffected. API keys are referenced by env-var name and resolved at startup, never stored. Enables search_text / upsert_text for the named collections.

rerank: HashMap<String, RerankConfig>

Opt-in server-side rerank providers, keyed by collection name (ADR-0047). Configured with [rerank.<collection>] tables; enables the one-call retrieve→rerank stage of search_text.

rate_limit: RateLimitConfig

Opt-in per-key rate limiting (ADR-0049). Set a [rate_limit] table in quiver.toml or the QUIVER_RATE_LIMIT_* env vars; requests_per_second = 0 (the default) disables it.

otlp: OtlpConfig

Opt-in OpenTelemetry traces export (ADR-0059). Set an [otlp] table or the QUIVER_OTLP_* env vars; an empty endpoint (the default) disables it. Export additionally requires the server’s otlp build feature.

mvcc_reads: bool

Lock-free MVCC reads (ADR-0064), experimental and default-off. Serves reads of single-vector, in-memory collections from an arc-swap snapshot so pure-vector reads never block on a concurrent writer. Also settable via QUIVER_MVCC_READS. See docs/adr/0064-mvcc-reads-implementation.md.

cluster_shards: Vec<String>

Opt-in cluster router mode (ADR-0065): a non-empty list of shard base URLs (e.g. ["http://s1:6333","http://s2:6333"], or the bracketed QUIVER_CLUSTER_SHARDS env array [http://s1:6333,http://s2:6333]) makes this server a stateless router that shards writes and scatter-gathers searches across the shards. Empty (the default) = an ordinary single-node server.

cluster_replicas: Vec<String>

Optional per-shard read replicas (ADR-0065 increment 2). Each entry is "<shard_index>=<replica_url>" (repeat the index for several replicas of one shard), e.g. ["0=http://s1b:6333", "1=http://s2b:6333"] or the bracketed QUIVER_CLUSTER_REPLICAS env list. A replica is an ordinary follower (ADR-0030) of its shard’s primary; the router fans searches across {primary} ∪ replicas to spread read load. A shard with no entry is primary-only. Empty (the default) = no replicas.

cluster_shard_key: Option<String>

Optional API key the router presents to its shards (a cluster runs over a trusted network). None = shards are unauthenticated.

coordinator: bool

Run this process as the cluster coordinator (ADR-0066) instead of a normal server: it owns the authoritative versioned shard map and serves the /cluster/* membership API, off the data path. It seeds its map from cluster_shards/cluster_replicas (or recovers it from coordinator_state). Default false.

coordinator_url: Option<String>

Base URL of the cluster coordinator (ADR-0066). When set on a router, the router refreshes its shard map from GET {url}/cluster/map on an interval, so a membership change propagates without a restart. None = a static map from cluster_shards (increments 1–2 behaviour).

coordinator_state: Option<PathBuf>

Where the coordinator persists its versioned map + id counter, so a restart recovers the exact membership (and never reuses a shard id). None = in-memory only (lost on restart). Only meaningful with coordinator = true.

autoscale: AutoscaleConfig

Opt-in automatic scale-out policy for a coordinator (ADR-0065 increment 5). Set an [autoscale] table in quiver.toml (or QUIVER_AUTOSCALE_*): enabled, a per-shard high_water_points threshold, a standby_urls pool to grow into, and interval_secs / cooldown_secs / max_shards. Default off.

raft_node_id: Option<u64>

This node’s Raft member id within its shard’s group (ADR-0067, write HA). Setting it opts the node into per-shard Raft: it joins the group described by raft_members, commits writes only after a quorum commit, and fails over automatically if the leader dies. None (the default) = the single-primary shard of increments 1–3, unchanged. Requires the server’s raft build feature.

raft_members: Vec<String>

The Raft group’s members as "<id>=<grpc-url>" entries (ADR-0067), e.g. ["1=http://n1:6334","2=http://n2:6334","3=http://n3:6334"] or the bracketed QUIVER_RAFT_MEMBERS env array. Each URL is the member’s gRPC address (the RaftService rides the existing gRPC server). Used only when raft_node_id is set; the lowest id bootstraps the group.

Implementations

impl Config

pub fn load() -> Result<Self, Error>

Load configuration from defaults, an optional quiver.toml, and QUIVER_* environment variables.

pub fn validate(&self) -> Result<(), Error>

Reject insecure configurations unless explicitly opted out (ADR-0013): no anonymous access, encryption-at-rest on by default with a valid key, and no non-loopback bind without TLS.

Trait Implementations

impl Clone for Config

fn clone(&self) -> Config

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Config

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Config

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Config

where Config: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Config

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.