rws_http/entry_point/config_file/
mod.rs

1use std::collections::HashMap;
2use std::env;
3use std::io::{BufRead, Cursor};
4use crate::entry_point::command_line_args::CommandLineArgument;
5use file_ext::FileExt;
6
7#[doc(hidden)]
8pub mod toml_str;
9use toml_str::{unquote, Quotes};
10
11#[cfg(test)]
12mod tests;
13
14/// Settings that have an `RWS_CONFIG_*` variable but no command-line flag.
15/// In `rws.config.toml` they're written like any other key — the variable
16/// name is the table path plus key, upper-cased: `[rate_limit] max_requests`
17/// → `RWS_CONFIG_RATE_LIMIT_MAX_REQUESTS`. Settings that do have a flag are
18/// taken from `CommandLineArgument::get_command_line_arg_list()` instead.
19/// `tests.rs` checks this list against every `RWS_CONFIG_*` name in `src/`.
20pub const SETTINGS_WITHOUT_FLAG: &[&str] = &[
21    "RWS_CONFIG_CACHE_STATUS",
22    "RWS_CONFIG_TLS_INTERNAL_DIR",
23    "RWS_CONFIG_TLS_INTERNAL_NAMES",
24    "RWS_CONFIG_ERROR_FORMAT",
25    "RWS_CONFIG_TLS_CLIENT_CRL_FILE",
26    "RWS_CONFIG_TLS_CLIENT_CRL_STRICT",
27    "RWS_CONFIG_FORWARDED_HEADER",
28    "RWS_CONFIG_TRUSTED_PROXIES",
29    "RWS_CONFIG_METRICS_ALLOW",
30    "RWS_CONFIG_SHUTDOWN_DELAY_SECS",
31    "RWS_CONFIG_SHUTDOWN_TIMEOUT_SECS",
32    "RWS_CONFIG_CLIENT_IP",
33    "RWS_CONFIG_PROXY_NAME",
34    "RWS_CONFIG_PROXY_STATUS",
35    "RWS_CONFIG_PROXY_STATUS_NEXT_HOP",
36    "RWS_CONFIG_ACME_ACCOUNT_KEY_PATH",
37    "RWS_CONFIG_ADMIN_ALLOWED_ORIGINS",
38    "RWS_CONFIG_ADMIN_USERS",
39    "RWS_CONFIG_CLUSTER_NODE",
40    "RWS_CONFIG_FLEET_SOURCE",
41    "RWS_CONFIG_FLEET_INTERVAL_SECS",
42    "RWS_CONFIG_FLEET_PUBLIC_KEY",
43    "RWS_CONFIG_FLEET_INSECURE",
44    "RWS_CONFIG_FLEET_REPORT_URL",
45    "RWS_CONFIG_FLEET_S3_ENDPOINT",
46    "RWS_CONFIG_CLUSTER_REDIS",
47    "RWS_CONFIG_CLUSTER_REDIS_PASSWORD",
48    "RWS_CONFIG_CLUSTER_PREFIX",
49    "RWS_CONFIG_ADMIN_AUDIT_LOG",
50    "RWS_CONFIG_ADMIN_OIDC_ISSUER",
51    "RWS_CONFIG_ADMIN_OIDC_PROVIDER",
52    "RWS_CONFIG_ADMIN_OIDC_TENANT",
53    "RWS_CONFIG_ADMIN_OIDC_CLIENT_ID",
54    "RWS_CONFIG_ADMIN_OIDC_CLIENT_SECRET_ENV",
55    "RWS_CONFIG_ADMIN_OIDC_COOKIE_SECRET_ENV",
56    "RWS_CONFIG_ADMIN_OIDC_ROLES",
57    "RWS_CONFIG_ADMIN_OIDC_ROLE_CLAIM",
58    "RWS_CONFIG_ADMIN_LISTEN",
59    "RWS_CONFIG_ADMIN_TOKEN_ENV",
60    "RWS_CONFIG_ACME_RENEW_BEFORE_DAYS",
61    "RWS_CONFIG_ACME_RENEW_CHECK_INTERVAL_SECS",
62    "RWS_CONFIG_CIRCUIT_BREAKER_FAILURE_THRESHOLD",
63    "RWS_CONFIG_CIRCUIT_BREAKER_MAX_HALF_OPEN_PROBES",
64    "RWS_CONFIG_CIRCUIT_BREAKER_RECOVERY_SECS",
65    "RWS_CONFIG_CLIENT_HINTS",
66    "RWS_CONFIG_CSP",
67    "RWS_CONFIG_ACME_DNS_TSIG_SECRET",
68    "RWS_CONFIG_ACME_REDIS_PASSWORD",
69    "RWS_CONFIG_ACME_DNS_API_TOKEN",
70    "RWS_CONFIG_ACCESS_LOG",
71    "RWS_CONFIG_ACCESS_LOG_KEEP",
72    "RWS_CONFIG_ACCESS_LOG_MAX_SIZE",
73    "RWS_CONFIG_ACCESS_LOG_ANONYMIZE_IP",
74    "RWS_CONFIG_ACCESS_LOG_IP_HASH_SECRET",
75    "RWS_CONFIG_ACCESS_LOG_SYSLOG",
76    "RWS_CONFIG_ACCESS_LOG_SYSLOG_FACILITY",
77    "RWS_CONFIG_LOG_REDACT_HEADERS",
78    "RWS_CONFIG_LOG_REDACT_QUERY",
79    "RWS_CONFIG_GATEWAY_API_CONTROLLER_NAME",
80    "RWS_CONFIG_GATEWAY_API_ENABLED",
81    "RWS_CONFIG_GATEWAY_API_EXPERIMENTAL",
82    "RWS_CONFIG_GATEWAY_API_GATEWAY",
83    "RWS_CONFIG_GATEWAY_API_IMAGE",
84    "RWS_CONFIG_GATEWAY_API_LEASE_NAMESPACE",
85    "RWS_CONFIG_GATEWAY_API_MESH",
86    "RWS_CONFIG_GATEWAY_API_MESH_CONFIG_URL",
87    "RWS_CONFIG_GATEWAY_API_MESH_INIT_IMAGE",
88    "RWS_CONFIG_GATEWAY_API_MESH_PORT",
89    "RWS_CONFIG_GATEWAY_API_MESH_SIDECAR_IMAGE",
90    "RWS_CONFIG_GATEWAY_API_MESH_WEBHOOK_CERT_FILE",
91    "RWS_CONFIG_GATEWAY_API_MESH_WEBHOOK_KEY_FILE",
92    "RWS_CONFIG_GATEWAY_API_MESH_WEBHOOK_PORT",
93    "RWS_CONFIG_GATEWAY_API_MODE",
94    "RWS_CONFIG_GATEWAY_API_POD_SELECTOR",
95    "RWS_CONFIG_GATEWAY_API_PORT_RANGE",
96    "RWS_CONFIG_GATEWAY_API_SERVICE_ACCOUNT",
97    "RWS_CONFIG_GATEWAY_API_SERVICE_TYPE",
98    "RWS_CONFIG_COMPRESSION_DICTIONARIES",
99    "RWS_CONFIG_EARLY_HINTS_HTTP1",
100    "RWS_CONFIG_LOG_FORMAT",
101    "RWS_CONFIG_MAX_BODY_SIZE_IN_BYTES",
102    "RWS_CONFIG_MIN_FREE_DISK",
103    "RWS_CONFIG_NANOS_HEADERS",
104    "RWS_CONFIG_OPEN_FILE_CACHE_SECS",
105    "RWS_CONFIG_OPEN_FILE_CACHE_STRICT",
106    "RWS_CONFIG_PROXY_PROTOCOL",
107    "RWS_CONFIG_RATE_LIMIT_MAX_REQUESTS",
108    "RWS_CONFIG_RATE_LIMIT_WINDOW_SECS",
109    "RWS_CONFIG_RUNTIME",
110    "RWS_CONFIG_SECURITY_HEADERS",
111    "RWS_CONFIG_SERVE_DOTFILES",
112    "RWS_CONFIG_SPA_FALLBACK",
113    "RWS_CONFIG_SPA_FALLBACK_EXCLUDE_PREFIXES",
114    "RWS_CONFIG_SPA_FALLBACK_ROUTES",
115    "RWS_CONFIG_STATIC_CACHE_CONTROL",
116    "RWS_CONFIG_DIRECTORY_LISTING",
117    "RWS_CONFIG_TEMPLATE_DIR",
118    "RWS_CONFIG_TLS_CLIENT_CA_FILE",
119    "RWS_CONFIG_WATCH",
120    "RWS_CONFIG_TRAFFIC_DATABASE_URL_ENV",
121    "RWS_CONFIG_TRAFFIC_ENABLED",
122    "RWS_CONFIG_TRAFFIC_EXCLUDE",
123    "RWS_CONFIG_TRAFFIC_GEO_DB",
124    "RWS_CONFIG_TRAFFIC_GOALS",
125    "RWS_CONFIG_TRAFFIC_HOSTING_NETWORKS",
126    "RWS_CONFIG_TRAFFIC_APPS",
127    "RWS_CONFIG_TRAFFIC_OWNER_NETWORKS",
128    "RWS_CONFIG_TRAFFIC_PROBE_ADDRESSES",
129    "RWS_CONFIG_TRAFFIC_HIDE_HOSTS",
130    "RWS_CONFIG_TRAFFIC_IGNORE_REFERRERS",
131    "RWS_CONFIG_TRAFFIC_PERSIST",
132    "RWS_CONFIG_TRAFFIC_RETENTION_DAYS",
133    "RWS_CONFIG_TRAFFIC_SCRIPT",
134];
135
136/// Tables (and their sub-tables) read by `proxy_config`'s own parser, not
137/// mapped to `RWS_CONFIG_*` variables.
138const PROXY_TABLES: &[&str] = &["route", "upstream", "tcp_proxy", "udp_proxy", "ws_proxy", "middleware", "authz"];
139
140/// `[[virtual_host]]` fields, set as `RWS_CONFIG_VIRTUAL_HOST_<n>_<FIELD>`.
141const VIRTUAL_HOST_FIELDS: &[&str] = &["DOMAIN", "CERT_FILE", "KEY_FILE"];
142
143/// The settings of a `rws.config.toml` document, resolved to the
144/// `RWS_CONFIG_*` variables they set — without touching the environment.
145#[derive(Debug, Default, PartialEq)]
146pub struct ConfigSettings {
147    /// `(RWS_CONFIG_* name, value)` in file order.
148    pub settings: Vec<(String, String)>,
149    /// Keys no setting answers to, as `key` or `[table] key`.
150    pub unknown: Vec<String>,
151}
152
153/// Resolve every setting in a `rws.config.toml` document. `prefix` is the
154/// table the document starts in (normally empty).
155///
156/// Top-level keys and keys in plain `[tables]` map to `RWS_CONFIG_<TABLE>_<KEY>`
157/// (`[cors] allow_all` → `RWS_CONFIG_CORS_ALLOW_ALL`); each `[[virtual_host]]`
158/// block maps to `RWS_CONFIG_VIRTUAL_HOST_<n>_*`. Strings keep their exact
159/// contents (spaces, quotes inside them); arrays become comma-separated lists.
160/// Proxy tables (`[[route]]`, `[[upstream]]`, …) are left to `proxy_config`.
161pub fn collect_settings(
162    cursor: Cursor<&[u8]>,
163    prefix: String) -> Result<ConfigSettings, String> {
164
165    let mut table = prefix;
166    // Index of the current [[array-table]] entry, per array-table name.
167    let mut array_table_counters: HashMap<String, usize> = HashMap::new();
168    let mut array_index: Option<usize> = None;
169    let mut resolved = ConfigSettings::default();
170    let flags = CommandLineArgument::get_command_line_arg_list();
171
172    for line in cursor.lines() {
173        let line = line.map_err(|e| e.to_string())?;
174        let line = strip_comment(&line).trim().to_string();
175        if line.is_empty() {
176            continue;
177        }
178
179        if let Some(name) = line.strip_prefix("[[").and_then(|l| l.strip_suffix("]]")) {
180            let name = name.trim().to_string();
181            let count = array_table_counters.entry(name.clone()).or_insert(0);
182            array_index = Some(*count);
183            *count += 1;
184            table = name;
185            continue;
186        }
187        if let Some(name) = line.strip_prefix('[').and_then(|l| l.strip_suffix(']')) {
188            table = name.trim().to_string();
189            array_index = None;
190            continue;
191        }
192
193        let Some((raw_key, raw_value)) = line.split_once('=') else { continue };
194        let key = raw_key.trim();
195
196        let root = table.split('.').next().unwrap_or("");
197        if PROXY_TABLES.contains(&root) {
198            continue;
199        }
200
201        // An inline table, `rate_limit = { max_requests = 5 }`, is the
202        // sub-table `[rate_limit]` (or `[<table>.rate_limit]`), as in TOML
203        // and as in the proxy sections.
204        if let Some(inner) = raw_value.trim().strip_prefix('{').and_then(|v| v.strip_suffix('}')) {
205            let sub_table = if table.is_empty() { key.to_string() } else { format!("{}.{}", table, key) };
206            for entry in split_top_level(inner) {
207                if let Some((inner_key, inner_value)) = entry.split_once('=') {
208                    resolve_setting(&sub_table, array_index, inner_key.trim(), parse_value(inner_value), &flags, &mut resolved);
209                } else if !entry.trim().is_empty() {
210                    resolved.unknown.push(qualified_key(&sub_table, entry.trim()));
211                }
212            }
213            continue;
214        }
215
216        resolve_setting(&table, array_index, key, parse_value(raw_value), &flags, &mut resolved);
217    }
218
219    Ok(resolved)
220}
221
222/// Map one `key = value` in `table` to its `RWS_CONFIG_*` setting, or record
223/// it as unknown.
224fn resolve_setting(
225    table: &str,
226    array_index: Option<usize>,
227    key: &str,
228    value: String,
229    flags: &[CommandLineArgument],
230    resolved: &mut ConfigSettings,
231) {
232    if table == "virtual_host" {
233        let field = key.to_ascii_uppercase();
234        if VIRTUAL_HOST_FIELDS.contains(&field.as_str()) {
235            let name = format!("RWS_CONFIG_VIRTUAL_HOST_{}_{}", array_index.unwrap_or(0), field);
236            resolved.settings.push((name, value));
237        } else {
238            resolved.unknown.push(qualified_key(table, key));
239        }
240        return;
241    }
242
243    let path = if table.is_empty() { key.to_string() } else { format!("{}_{}", table.replace('.', "_"), key) };
244    let long_form = path.replace('_', "-");
245    if let Some(flag) = flags.iter().find(|f| f.long_form == long_form) {
246        resolved.settings.push((flag.environment_variable.clone(), value));
247        return;
248    }
249    let name = format!("RWS_CONFIG_{}", path.to_ascii_uppercase());
250    if SETTINGS_WITHOUT_FLAG.contains(&name.as_str()) {
251        resolved.settings.push((name, value));
252    } else {
253        resolved.unknown.push(qualified_key(table, key));
254    }
255}
256
257/// Split an inline table's body on commas outside quotes and `[...]`.
258fn split_top_level(inner: &str) -> Vec<&str> {
259    let mut items = vec![];
260    let mut quote: Option<char> = None;
261    let mut depth = 0usize;
262    let mut start = 0;
263    for (i, c) in inner.char_indices() {
264        match (quote, c) {
265            (None, '"') | (None, '\'') => quote = Some(c),
266            (Some(q), c) if c == q => quote = None,
267            (None, '[') => depth += 1,
268            (None, ']') => depth = depth.saturating_sub(1),
269            (None, ',') if depth == 0 => {
270                items.push(&inner[start..i]);
271                start = i + 1;
272            }
273            _ => {}
274        }
275    }
276    items.push(&inner[start..]);
277    items
278}
279
280/// Apply every setting in a `rws.config.toml` document to the process
281/// environment (see [`collect_settings`]). Unknown keys are reported on
282/// stderr instead of being ignored silently.
283pub fn read_config_file(
284    cursor: Cursor<&[u8]>,
285    prefix: String) -> Result<bool, String> {
286    let resolved = collect_settings(cursor, prefix)?;
287    for (name, value) in &resolved.settings {
288        set_setting(name, value);
289    }
290    for key in &resolved.unknown {
291        eprintln!("    Warning: unknown setting '{}' in rws.config.toml — ignored", key);
292    }
293    Ok(true)
294}
295
296fn set_setting(name: &str, value: &str) {
297    if value.contains('\0') {
298        // env::set_var panics on NUL — a stray byte in the file must not crash startup.
299        eprintln!("    Warning: value for {} contains a NUL byte — ignored", name);
300        return;
301    }
302    env::set_var(name, value);
303    crate::server_config::invalidate();
304    println!("    Set env variable '{}' to value '{}'", name, crate::entry_point::shown(name, value));
305}
306
307fn qualified_key(table: &str, key: &str) -> String {
308    if table.is_empty() { key.to_string() } else { format!("[{}] {}", table, key) }
309}
310
311/// Drop a trailing `# comment`, ignoring `#` inside quoted strings.
312fn strip_comment(line: &str) -> &str {
313    let mut quotes = Quotes::default();
314    for (i, c) in line.char_indices() {
315        if !quotes.step(c) && c == '#' {
316            return &line[..i];
317        }
318    }
319    line
320}
321
322/// A TOML value as a plain string: quoted strings lose their quotes (basic
323/// strings also their escapes, see [`toml_str::unquote`]), arrays become
324/// `a,b,c`, anything else (numbers, booleans) is trimmed.
325fn parse_value(raw: &str) -> String {
326    let raw = raw.trim();
327    if let Some(inner) = raw.strip_prefix('[').and_then(|r| r.strip_suffix(']')) {
328        return split_array(inner)
329            .iter()
330            .map(|item| unquote(item.trim()))
331            .filter(|item| !item.is_empty())
332            .collect::<Vec<_>>()
333            .join(",");
334    }
335    unquote(raw)
336}
337
338/// Split array items on commas outside quotes.
339fn split_array(inner: &str) -> Vec<&str> {
340    let mut items = vec![];
341    let mut quotes = Quotes::default();
342    let mut start = 0;
343    for (i, c) in inner.char_indices() {
344        if !quotes.step(c) && c == ',' {
345            items.push(&inner[start..i]);
346            start = i + 1;
347        }
348    }
349    items.push(&inner[start..]);
350    items
351}
352
353/// Load `rws.config.toml` into the environment: `filepath` (relative to the
354/// working directory) when given, else the file named by `RWS_CONFIG_FILE`
355/// (absolute, or relative to the working directory) — the same variable
356/// `proxy_config` reads routes from — else `rws.config.toml` in the working
357/// directory.
358pub fn override_environment_variables_from_config(filepath: Option<&str>) {
359    println!("\n  Start of Config Section");
360
361    let from_env = env::var("RWS_CONFIG_FILE").ok().filter(|p| !p.trim().is_empty());
362    let resolved = match (filepath, from_env) {
363        (Some(path), _) => FileExt::get_static_filepath(path),
364        (None, Some(path)) => Ok(path),
365        (None, None) => FileExt::get_static_filepath("/rws.config.toml"),
366    };
367    let path = match resolved {
368        Ok(path) => path,
369        Err(e) => {
370            eprintln!("{}", e);
371            println!("  End of Config Section");
372            return;
373        }
374    };
375
376    match std::fs::read_to_string(&path) {
377        Ok(content) => {
378            if let Err(e) = read_config_file(Cursor::new(content.as_bytes()), String::new()) {
379                eprintln!("    Unable to parse {}: {}", path, e);
380            }
381        }
382        Err(e) => eprintln!("    Unable to read {}: {}", path, e),
383    }
384
385    println!("  End of Config Section");
386}
rws_http/entry_point/config_file/mod.rs

rws_http/entry_point/config_file/
mod.rs
