milestone 8: web server, rest api, sse, auth, metrics and static assets

2026-08-02 00:54:13 +02:00
parent a8092bb1b9
commit 5253c47303
59 changed files with 19640 additions and 150 deletions
@@ -108,6 +108,10 @@ pub const Web = struct {
    password_hash: []const u8 = "",
    session_ttl_hours: u16 = 24,
    api_rate_limit_per_min: u32 = 300,
+    /// Requests from the box itself skip the API rate limit. On by default: a
+    /// local script or health probe is the operator's own traffic, not the
+    /// abuse the limiter defends against (PLAN §10).
+    api_localhost_exempt: bool = true,
    sse_max_connections_per_ip: u16 = 3,
 };

@@ -506,6 +510,7 @@ const expected_keys = [_][]const u8{
    "upstream.connect_timeout_ms",
    "upstream.read_timeout_ms",
    "upstream.total_timeout_ms",
+    "web.api_localhost_exempt",
    "web.api_rate_limit_per_min",
    "web.bind",
    "web.enabled",
@@ -571,6 +576,7 @@ test "toSettings and fromSettings round-trip a non-default config" {
            .password_hash = "$argon2id$v=19$m=19456,t=2,p=1$abc$def",
            .session_ttl_hours = 23,
            .api_rate_limit_per_min = 29,
+            .api_localhost_exempt = false,
            .sse_max_connections_per_ip = 31,
        },
        .doh_server = .{