Module server 

Axum router builder and listener.

Constants

ENV_METRICS_TOKEN

SECURITY (H3): environment variable carrying an optional bearer token that gates GET /metrics. When set to a non-empty value the metrics scrape endpoint requires Authorization: Bearer <token> matching this value (constant-time compared); when unset or empty the endpoint stays unauthenticated (the historical Prometheus-scrape posture) and a one-shot warn! is emitted at startup. See MetricsAuth and metrics_auth_gate.

Functions

build_router

Build the axum Router with all routes and middleware applied.

build_router_with_audit

Build the router with full configuration including the audit sink and the CORS allowlist.

build_router_with_config

Build the router with explicit auth / tenant config and the rate limiter disabled. Backwards-compatible shim retained for integration tests that pre-date the per-token rate limiter; new tests should call build_router_with_full_config.

build_router_with_full_config

Build the router with explicitly supplied auth, tenant, and rate-limit config. Used by integration tests so they can drive the gateway without poisoning the process environment.

build_router_with_kernel_publish_tokens

Build the router with every override exposed, including the explicit KernelPublishTokens allowlist for POST /kernels.

build_router_with_trusted_proxies

Build the router with full configuration and an explicit XFCC trusted-proxy allowlist.

serve

Bind and serve the router on the given address.