b7cd2b1
#![recursion_limit = "256"]
mod cli;
use std::net::SocketAddr;
use std::path::PathBuf;
use anyhow::{Context, anyhow};
use clap::Parser;
use crate::cli::{Cli, Command};
fn main() -> anyhow::Result<()> {
match Cli::parse().command.unwrap_or(Command::Serve) {
Command::Serve => serve(),
Command::Migrate => migrate(),
Command::Openapi { check } => openapi(check),
Command::IdentityOpenapi => identity_openapi(),
}
}
#[tokio::main]
async fn serve() -> anyhow::Result<()> {
use actix_web::middleware::from_fn;
use actix_web::{App, HttpServer, web};
use config::scoped::{ApihostConfig, ScopedConfig};
use tokio_util::sync::CancellationToken;
use tracing::{info, warn};
use utoipa_swagger_ui::SwaggerUi;
use webapi::openapi::api_doc;
export::telemetry::init_tracing();
let cfg = ApihostConfig::load().context("loading configuration")?;
if !cfg.apihost.enabled() {
info!("apihost is disabled by config; exiting");
return Ok(());
}
let cancel = CancellationToken::new();
let app_config = cfg.clone().into_app_config();
let database = std::sync::Arc::new(
export::AppDatabase::connect(app_config.database.clone())
.await
.context("connecting to the shared database")?,
);
let identity = match identity_config()? {
Some(identity_config) => {
let db =
kenoauth::db::DbConn::new(database.primary().clone(), database.replicas().to_vec());
Some(
kenoauth::oauth::start(&identity_config, db)
.await
.context("starting identity service")?,
)
}
None => None,
};
let client = identity.as_ref().map(|runtime| {
std::sync::Arc::new(kenauth::KenAuthClient::local(
runtime.service().clone(),
cfg.oauth.http_timeout_ms,
))
});
if let Some(runtime) = &identity
&& cfg.oauth.enabled
&& runtime.service().signing().issuer().trim_end_matches('/')
!= cfg.oauth.issuer.trim_end_matches('/')
{
anyhow::bail!("oauth.issuer must match identity.jwt.issuer");
}
let state = export::AppState::with_identity(app_config, database, client)
.await
.context("building AppState")?;
info!("dependencies ready");
if let Err(err) = export::telemetry::init_meter_provider() {
warn!(error = %err, "failed to init meter provider; metrics disabled");
}
export::metrics::spawn_queue_depth_reporter(
state.redis.clone(),
&[
("push.jobs", export::push::QUEUE_TOPIC.to_string()),
("push.jobs.dlq", export::push::DLQ_TOPIC.to_string()),
],
);
tokio::spawn(chat::worker::run_background_tasks(state.clone()));
tokio::spawn(deletion::run_worker(state.clone()));
let conn = queue::RocketMqConn::init(&cfg.rocketmq)
.await
.map_err(|err| anyhow::anyhow!("failed to start the rocketmq producer: {err}"))?;
let relay_task = tokio::spawn(queue::relay::run(
state.database.primary().clone(),
queue::Publisher::new(conn.clone()),
cancel.clone(),
));
info!("event outbox relay started");
let mut push_tasks = Vec::new();
if cfg.push.enabled {
for _ in 0..cfg.push.workers.max(1) {
let worker = push::PushWorker::new(state.clone(), cancel.clone())
.map_err(|err| anyhow::anyhow!("failed to start push worker: {err}"))?;
push_tasks.push(tokio::spawn(worker.run()));
}
info!(
workers = cfg.push.workers.max(1),
"web push workers started"
);
}
let verifier = webapi::verifier(&state);
if let Some(verifier) = &verifier {
let warm = verifier.clone();
tokio::spawn(async move { warm.warm_up().await });
}
let doc = api_doc();
let app_state = state.clone();
let bind_addr = cfg.apihost.bind_addr().to_string();
let port = cfg.apihost.port();
let addr: SocketAddr = format!("{bind_addr}:{port}")
.parse()
.with_context(|| format!("parsing bind address {bind_addr}:{port}"))?;
let server = HttpServer::new(move || {
let state = app_state.clone();
let mut app = App::new()
.app_data(web::Data::new(state.clone()))
.app_data(
web::JsonConfig::default()
.limit(webapi::MAX_REQUEST_BODY_BYTES)
.error_handler(export::http::json_error),
)
.app_data(web::PayloadConfig::new(webapi::MAX_REQUEST_BODY_BYTES));
if let Some(verifier) = verifier.clone() {
app = app.app_data(web::Data::new(verifier));
}
app.wrap(webapi::build_cors(&state.config.web))
.wrap(from_fn(export::middleware::trace_request))
.wrap(from_fn(export::telemetry::http_telemetry))
.wrap(from_fn(auth::oauth::revalidate::revalidate))
.service(web::resource("/api/docs").route(web::get().to(|| async {
actix_web::HttpResponse::Found()
.insert_header((actix_web::http::header::LOCATION, "/api/docs/"))
.finish()
})))
.service(SwaggerUi::new("/api/docs/{_:.*}").url("/api/docs/openapi.json", doc.clone()))
.service(webapi::scope(state))
})
.disable_signals()
.bind(addr)
.with_context(|| format!("binding {addr}"))?
.run();
info!(%addr, "apihost listening");
let handle = server.handle();
let api_cancel = cancel.clone();
tokio::spawn(async move {
api_cancel.cancelled().await;
handle.stop(true).await;
});
let api = async move { server.await.context("actix server error") };
let identity_cancel = cancel.clone();
let identity_server = async move {
match identity {
Some(runtime) => runtime.serve_until(identity_cancel).await,
None => {
identity_cancel.cancelled().await;
Ok(())
}
}
};
let signal = async {
tokio::select! {
_ = export::telemetry::shutdown_signal() => cancel.cancel(),
_ = cancel.cancelled() => {},
}
};
let (api_result, identity_result, ()) = tokio::join!(api, identity_server, signal);
let _ = relay_task.await;
for task in push_tasks {
let _ = task.await;
}
conn.shutdown().await;
api_result?;
identity_result?;
export::telemetry::shutdown_telemetry();
info!("apihost shut down");
Ok(())
}
#[tokio::main]
async fn migrate() -> anyhow::Result<()> {
use config::scoped::{MigrateConfig, ScopedConfig};
use models::migrate::sync_schema;
use sea_orm::Database;
use tracing::info;
const DEFAULT_LOG_FILTER: &str = "info,kenapi=debug";
tracing_subscriber::fmt()
.with_env_filter(
tracing_subscriber::EnvFilter::try_from_default_env()
.unwrap_or_else(|_| tracing_subscriber::EnvFilter::new(DEFAULT_LOG_FILTER)),
)
.init();
let cfg = MigrateConfig::load().context("loading configuration")?;
let opts = cfg
.database
.primary_connect_options()
.map_err(|e| anyhow::anyhow!(e))?;
let db = Database::connect(opts)
.await
.context("connecting to postgres")?;
info!("running schema migration");
sync_schema(&db).await.context("running schema sync")?;
if let Some(identity) = identity_config()? {
let identity_db = kenoauth::db::DbConn::new(db.clone(), Vec::new());
kenoauth::auth::migrate::sync_schema(&identity_db)
.await
.context("synchronizing identity schema")?;
drop(identity);
}
info!("schema migration completed");
Ok(())
}
fn openapi(check: bool) -> anyhow::Result<()> {
fn generate<F>(generate: F) -> anyhow::Result<String>
where
F: FnOnce() -> anyhow::Result<String> + Send + 'static,
{
std::thread::Builder::new()
.stack_size(256 * 1024 * 1024)
.spawn(generate)
.context("spawn generator thread")?
.join()
.map_err(|_| anyhow!("openapi generation panicked (stack overflow?)"))?
}
fn check_file(path: &std::path::Path, json: &str) -> anyhow::Result<()> {
let existing =
std::fs::read_to_string(path).with_context(|| format!("reading {}", path.display()))?;
if existing.trim_end() != json.trim_end() {
eprintln!(
"{} is out of date; run `cargo run -p kenapi -- openapi` to regenerate",
path.display()
);
std::process::exit(1);
}
Ok(())
}
let web = generate(|| {
let doc = webapi::openapi::api_doc();
doc.to_pretty_json().context("serializing web openapi doc")
})?;
let crate_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
let root = crate_dir
.ancestors()
.nth(1)
.ok_or_else(|| anyhow!("workspace root not found above {}", crate_dir.display()))?;
let web_path = root.join("openapi.json");
if check {
check_file(&web_path, &web)?;
println!("openapi.json is up to date");
return Ok(());
}
std::fs::write(&web_path, web).with_context(|| format!("writing {}", web_path.display()))?;
println!("wrote {}", web_path.display());
Ok(())
}
fn identity_config() -> anyhow::Result<Option<kenoauth::config::Config>> {
let figment = config::loader::figment();
let enabled = figment
.extract_inner::<bool>("identity.enabled")
.context("loading identity.enabled")?;
if !enabled {
return Ok(None);
}
let value: serde_json::Value = figment
.extract_inner("identity")
.context("loading [identity] configuration")?;
Ok(Some(kenoauth::config::Config::from_value(value)))
}
fn identity_openapi() -> anyhow::Result<()> {
use utoipa_identity::OpenApi;
let doc = kenoauth::auth::openapi::ApiDoc::openapi();
let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../lib/identity/OpenApi.Auth.json");
std::fs::write(&path, doc.to_pretty_json()?).context("writing identity OpenAPI")?;
println!("wrote {}", path.display());
Ok(())
}