AkurAI-Drive / backend/src/config.rs

Latest change feb03c4c2e9a6b0e869a63e52329c938e68dc8e8 - backend: device-token auth, SigV4 presigning, and file API for the sync client by olibuijr

use std::sync::LazyLock;

/// Process configuration, loaded once from the environment.
///
/// Everything is read from env via `std::env::var` — no secrets in code. On the
/// box these are injected by systemd from `EnvironmentFile=/etc/akurai-drive-api.env`.
/// The `aws` CLI inherits its credentials from the process environment directly; the
/// SigV4 presigner (`sigv4.rs`) is in-process and signs locally, so it also needs
/// `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` read into the config here.
pub struct Config {
    pub port: u16,
    pub listen_addr: String,
    pub db_path: String,
    /// Plain HTTP, same box, no TLS — used for back-channel /token and /userinfo.
    pub idp_internal_url: String,
    /// Public issuer — used to build the browser-facing /authorize redirect.
    pub idp_issuer: String,
    pub oidc_client_id: String,
    pub oidc_client_secret: String,
    pub oidc_redirect_uri: String,
    pub drive_public_url: String,
    pub drive_access_code: String,
    pub drive_admin_group: String,
    pub drive_bucket_prefix: String,
    pub aws_region: String,
    /// Used by the in-process SigV4 presigner (and shared with the `aws` CLI via env).
    pub aws_access_key_id: String,
    pub aws_secret_access_key: String,
}

static CONFIG: LazyLock<Config> = LazyLock::new(|| {
    let port = std::env::var("DRIVE_PORT")
        .ok()
        .and_then(|v| v.parse().ok())
        .unwrap_or(8096u16);

    Config {
        port,
        listen_addr: format!("127.0.0.1:{port}"),
        db_path: std::env::var("DRIVE_DB_PATH")
            .unwrap_or_else(|_| "./data/drive.sqlite".to_string()),
        idp_internal_url: std::env::var("IDP_INTERNAL_URL")
            .unwrap_or_else(|_| "http://127.0.0.1:3500".to_string())
            .trim_end_matches('/')
            .to_string(),
        idp_issuer: std::env::var("IDP_ISSUER")
            .unwrap_or_else(|_| "https://auth.olibuijr.com".to_string())
            .trim_end_matches('/')
            .to_string(),
        oidc_client_id: std::env::var("OIDC_CLIENT_ID").unwrap_or_default(),
        oidc_client_secret: std::env::var("OIDC_CLIENT_SECRET").unwrap_or_default(),
        oidc_redirect_uri: std::env::var("OIDC_REDIRECT_URI")
            .unwrap_or_else(|_| "https://akurai-drive.olibuijr.com/auth/callback".to_string()),
        drive_public_url: std::env::var("DRIVE_PUBLIC_URL")
            .unwrap_or_else(|_| "https://akurai-drive.olibuijr.com".to_string())
            .trim_end_matches('/')
            .to_string(),
        drive_access_code: std::env::var("DRIVE_ACCESS_CODE").unwrap_or_default(),
        drive_admin_group: std::env::var("DRIVE_ADMIN_GROUP")
            .unwrap_or_else(|_| "drive-admins".to_string()),
        drive_bucket_prefix: std::env::var("DRIVE_BUCKET_PREFIX")
            .unwrap_or_else(|_| "akurai-drive".to_string()),
        aws_region: std::env::var("AWS_DEFAULT_REGION").unwrap_or_else(|_| "us-east-1".to_string()),
        aws_access_key_id: std::env::var("AWS_ACCESS_KEY_ID").unwrap_or_default(),
        aws_secret_access_key: std::env::var("AWS_SECRET_ACCESS_KEY").unwrap_or_default(),
    }
});

pub fn get() -> &'static Config {
    &CONFIG
}