AkurAI-Drive / backend/src/config.rs

Latest change 6e3a0824f4ec4d2bea2524a20b4960c7ab9e2766 - backend: akurai-drive-api (OIDC RP + per-tenant S3 provisioning) by olibuijr

use std::sync::LazyLock;

/// Process configuration, loaded once from the environment.
///
/// Everything is read from env via `std::env::var` — no secrets in code. On the
/// box these are injected by systemd from `EnvironmentFile=/etc/akurai-drive-api.env`.
/// AWS credentials (`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`) are intentionally
/// NOT read here: the `aws` CLI inherits them from the process environment directly.
pub struct Config {
    pub port: u16,
    pub listen_addr: String,
    pub db_path: String,
    /// Plain HTTP, same box, no TLS — used for back-channel /token and /userinfo.
    pub idp_internal_url: String,
    /// Public issuer — used to build the browser-facing /authorize redirect.
    pub idp_issuer: String,
    pub oidc_client_id: String,
    pub oidc_client_secret: String,
    pub oidc_redirect_uri: String,
    pub drive_public_url: String,
    pub drive_access_code: String,
    pub drive_admin_group: String,
    pub drive_bucket_prefix: String,
    pub aws_region: String,
}

static CONFIG: LazyLock<Config> = LazyLock::new(|| {
    let port = std::env::var("DRIVE_PORT")
        .ok()
        .and_then(|v| v.parse().ok())
        .unwrap_or(8096u16);

    Config {
        port,
        listen_addr: format!("127.0.0.1:{port}"),
        db_path: std::env::var("DRIVE_DB_PATH")
            .unwrap_or_else(|_| "./data/drive.sqlite".to_string()),
        idp_internal_url: std::env::var("IDP_INTERNAL_URL")
            .unwrap_or_else(|_| "http://127.0.0.1:3500".to_string())
            .trim_end_matches('/')
            .to_string(),
        idp_issuer: std::env::var("IDP_ISSUER")
            .unwrap_or_else(|_| "https://auth.olibuijr.com".to_string())
            .trim_end_matches('/')
            .to_string(),
        oidc_client_id: std::env::var("OIDC_CLIENT_ID").unwrap_or_default(),
        oidc_client_secret: std::env::var("OIDC_CLIENT_SECRET").unwrap_or_default(),
        oidc_redirect_uri: std::env::var("OIDC_REDIRECT_URI")
            .unwrap_or_else(|_| "https://akurai-drive.olibuijr.com/auth/callback".to_string()),
        drive_public_url: std::env::var("DRIVE_PUBLIC_URL")
            .unwrap_or_else(|_| "https://akurai-drive.olibuijr.com".to_string())
            .trim_end_matches('/')
            .to_string(),
        drive_access_code: std::env::var("DRIVE_ACCESS_CODE").unwrap_or_default(),
        drive_admin_group: std::env::var("DRIVE_ADMIN_GROUP")
            .unwrap_or_else(|_| "drive-admins".to_string()),
        drive_bucket_prefix: std::env::var("DRIVE_BUCKET_PREFIX")
            .unwrap_or_else(|_| "akurai-drive".to_string()),
        aws_region: std::env::var("AWS_DEFAULT_REGION").unwrap_or_else(|_| "us-east-1".to_string()),
    }
});

pub fn get() -> &'static Config {
    &CONFIG
}