chore: publish clean community baseline

apps/admin-api/src/main.rs

@@ -0,0 +1,156 @@
+use std::{env, net::SocketAddr, path::PathBuf};
+
+use admin_api::{
+    app::build_app,
+    auth::{AuthSettings, BootstrapAdminConfig},
+    service::AdminServiceBuilder,
+    state::AppState,
+};
+use crank_community_auth::PasswordIdentityProvider;
+use crank_registry::{PostgresPoolConfig, PostgresRegistry};
+use crank_runtime::{
+    RequestRateLimitConfig, RequestRateLimiter, RuntimeCacheConfig, RuntimeCacheStores,
+    RuntimeLimits, SecretCrypto, community_default,
+};
+use sqlx::postgres::PgConnectOptions;
+use tokio::net::TcpListener;
+use tracing::info;
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            env::var("CRANK_LOG_LEVEL").unwrap_or_else(|_| "admin_api=info,tower_http=info".into()),
+        )
+        .init();
+
+    let storage_root = PathBuf::from(
+        env::var("CRANK_STORAGE_ROOT").unwrap_or_else(|_| "/var/lib/crank/storage".into()),
+    );
+    let bind_addr = env::var("CRANK_ADMIN_BIND").unwrap_or_else(|_| "0.0.0.0:3001".into());
+    let base_url = env::var("CRANK_BASE_URL").unwrap_or_else(|_| "http://localhost:3000".into());
+    let socket_addr: SocketAddr = bind_addr.parse()?;
+    let pool_config = PostgresPoolConfig::from_env()?;
+    let registry = PostgresRegistry::connect_with_options_and_pool_config(
+        database_options_from_env()?,
+        pool_config,
+    )
+    .await?;
+    let auth_settings = AuthSettings {
+        session_secret: env::var("CRANK_SESSION_SECRET")?,
+        password_pepper: env::var("CRANK_PASSWORD_PEPPER")?,
+        session_ttl_hours: env::var("CRANK_SESSION_TTL_HOURS")
+            .ok()
+            .and_then(|value| value.parse::<i64>().ok())
+            .unwrap_or(24),
+        cookie_secure: base_url.starts_with("https://"),
+        bootstrap_admin: BootstrapAdminConfig {
+            email: env::var("CRANK_BOOTSTRAP_ADMIN_EMAIL")?,
+            password: env::var("CRANK_BOOTSTRAP_ADMIN_PASSWORD")?,
+            display_name: env::var("CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME")
+                .unwrap_or_else(|_| "Crank Owner".into()),
+        },
+    };
+    let runtime_limits = RuntimeLimits::from_env()?;
+    let cache_config = RuntimeCacheConfig::from_env()?;
+    let cache_stores = RuntimeCacheStores::from_config(&cache_config).await?;
+    let api_rate_limit = admin_api_rate_limit_config_from_env()?;
+    let secret_crypto = SecretCrypto::new(&env::var("CRANK_MASTER_KEY")?)?;
+    let runtime = community_default()
+        .with_limits(runtime_limits)
+        .with_response_cache(cache_stores.response.clone())
+        .build();
+    let identity_provider =
+        PasswordIdentityProvider::new(registry.clone(), auth_settings.password_pepper.clone());
+    let service = AdminServiceBuilder::new(
+        registry,
+        storage_root,
+        auth_settings,
+        secret_crypto,
+        runtime,
+    )
+    .with_identity_provider(std::sync::Arc::new(identity_provider))
+    .build();
+    service.bootstrap_admin_user().await?;
+    if env_flag("CRANK_DEMO_SEED") {
+        service.seed_demo_assets().await?;
+    }
+    let state = AppState {
+        service,
+        api_rate_limiter: if cache_config.backend.is_external() {
+            RequestRateLimiter::new_shared(api_rate_limit, cache_stores.rate_limit.clone())
+        } else {
+            RequestRateLimiter::new(api_rate_limit)
+        },
+    };
+    let app = build_app(state);
+    let listener = TcpListener::bind(socket_addr).await?;
+
+    info!(
+        runtime_max_concurrent_unary = runtime_limits.max_concurrent_unary,
+        runtime_max_concurrent_window = runtime_limits.max_concurrent_window,
+        runtime_max_concurrent_sessions = runtime_limits.max_concurrent_sessions,
+        runtime_max_concurrent_jobs = runtime_limits.max_concurrent_jobs,
+        admin_rate_limit_rps = api_rate_limit.requests_per_second,
+        admin_rate_limit_burst = api_rate_limit.burst,
+        cache_backend = %cache_config.backend,
+        max_connections = pool_config.max_connections,
+        min_connections = pool_config.min_connections,
+        acquire_timeout_ms = pool_config.acquire_timeout_ms,
+        idle_timeout_ms = pool_config.idle_timeout_ms,
+        max_lifetime_ms = pool_config.max_lifetime_ms,
+        "postgres pool configured"
+    );
+    info!("admin-api listening on {}", socket_addr);
+
+    axum::serve(listener, app).await?;
+
+    Ok(())
+}
+
+fn env_flag(name: &str) -> bool {
+    matches!(
+        env::var(name)
+            .ok()
+            .as_deref()
+            .map(str::to_ascii_lowercase)
+            .as_deref(),
+        Some("1" | "true" | "yes" | "on")
+    )
+}
+
+fn admin_api_rate_limit_config_from_env()
+-> Result<RequestRateLimitConfig, Box<dyn std::error::Error>> {
+    let requests_per_second = env::var("CRANK_ADMIN_RATE_LIMIT_RPS")
+        .ok()
+        .and_then(|value| value.parse::<u32>().ok())
+        .unwrap_or(30);
+    let burst = env::var("CRANK_ADMIN_RATE_LIMIT_BURST")
+        .ok()
+        .and_then(|value| value.parse::<u32>().ok())
+        .unwrap_or(60);
+
+    Ok(RequestRateLimitConfig::new(requests_per_second, burst)?)
+}
+
+fn database_options_from_env() -> Result<PgConnectOptions, Box<dyn std::error::Error>> {
+    if let Ok(database_url) = env::var("CRANK_DATABASE_URL") {
+        return Ok(database_url.parse::<PgConnectOptions>()?);
+    }
+
+    let host = env::var("POSTGRES_HOST").unwrap_or_else(|_| "postgres".into());
+    let port = env::var("POSTGRES_PORT")
+        .ok()
+        .and_then(|value| value.parse::<u16>().ok())
+        .unwrap_or(5432);
+    let database = env::var("POSTGRES_DB").unwrap_or_else(|_| "crank".into());
+    let username = env::var("POSTGRES_USER").unwrap_or_else(|_| "crank".into());
+    let password = env::var("POSTGRES_PASSWORD").unwrap_or_else(|_| "crank".into());
+
+    Ok(PgConnectOptions::new()
+        .host(&host)
+        .port(port)
+        .database(&database)
+        .username(&username)
+        .password(&password))
+}