durable_streams-rails 0.5.1 → 0.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 51f89c0edb96d7dd54064866985489a744f7f083608c04d8493e06855d1df102
-  data.tar.gz: 7d6f4830a2a9584ce28a8d05ad970d4ac1daa9c0f4673caeb06c1175d35968a7
+  metadata.gz: 79f28df832bb82db8fe2c8bf0204cf5c6ffededd6755c153d2a00aba4ec7f611
+  data.tar.gz: 698ea2440a5422124be37cb82ee2f988ad2e34dd008c702943f30d60797b0510
 SHA512:
-  metadata.gz: d38b7504d016c6a929d15b0aca88a70842dc8472670eeea125cf96f5418f8dcf9f5415c63b01d25342aefe6b475566cc254e8a738d8f0a4cba64f9877c9ab7ab
-  data.tar.gz: 973e68cf2d715fc58169e1b4781b169e6b288b4d21b198b4f2b2a07bac7e0924d7ee2688c4eef370f7b9072de7e4aed255092c43b4b49fad6a3c86e9e216cd91
+  metadata.gz: 407c2bcb96115a2b19207a3a10d99992b09daa273a39c935ce87adde911df3bc38c7be8b5e5ad409d6313c366ad74607ad9abe3a32eee62a6acfb4b95ce5afd3
+  data.tar.gz: 4c91ddfb552668d981f16c355876daa08c616ed42988f4eea157f1848af5b386eb9a93ace96def84a25c7abc9582e3e7d04b24e053b5146e2d15498ec5b95d5a

data/lib/durable_streams/rails/server_config.rb

@@ -4,6 +4,10 @@ require "erb"
 module DurableStreams
   module Rails
     class ServerConfig
+      LOG_FORMATS = %w[ console json ].freeze
+      LOG_LEVELS = %w[ INFO WARN ERROR DEBUG ].freeze
+      STORAGE_DIRECTIVES = %w[ data_dir max_file_handles long_poll_timeout sse_reconnect_interval ].freeze
+
       TEMPLATE = ERB.new(<<~'CADDYFILE', trim_mode: "-")
         {
         	admin off
@@ -22,16 +26,21 @@ module DurableStreams
         		level <%= log_level %>
         	}
 
-        	route <%= route_path %> {
-        		forward_auth <%= auth["url"] %> {
-        			uri <%= auth["path"] %>
-        <%- copy_headers.each do |header| -%>
-        			copy_headers <%= header %>
+        <%= route_block %>
+        }
+        <%- if internal -%>
+
+        :<%= internal["port"] %> {
+        <%- if internal["bind"] -%>
+        	bind <%= internal["bind"] %>
         <%- end -%>
-        		}
-        		durable_streams<%= plugin_block %>
+        	@allowed remote_ip <%= internal_allowed_ips.join(" ") %>
+        	handle @allowed {
+        <%= route_block(indent: 2) %>
         	}
+        	respond 403
         }
+        <%- end -%>
       CADDYFILE
 
       def self.generate(config_path, environment)
@@ -40,6 +49,7 @@ module DurableStreams
 
       def initialize(config_path, environment)
         @config = YAML.load_file(config_path, aliases: true).fetch(environment)
+        validate!
       end
 
       def generate
@@ -47,18 +57,77 @@ module DurableStreams
       end
 
       private
-        def address
-          @config["domain"] || ":#{@config.fetch("port", 4437)}"
+        def validate!
+          validate_internal!
+          validate_log!
+        end
+
+        def validate_internal!
+          if internal && !internal_allowed_ips
+            raise ArgumentError, "internal.allowed_ips is required when internal is configured"
+          end
+        end
+
+        def validate_log!
+          if log_config.key?("format") && !LOG_FORMATS.include?(log_config["format"])
+            raise ArgumentError,
+              "log.format must be one of #{LOG_FORMATS.join(", ")}, got: #{log_config["format"].inspect}"
+          end
+
+          if log_config.key?("level") && !LOG_LEVELS.include?(log_config["level"])
+            raise ArgumentError,
+              "log.level must be one of #{LOG_LEVELS.join(", ")}, got: #{log_config["level"].inspect}"
+          end
         end
 
+        # Template methods — ordered by invocation
+
         def auto_https?
           @config["domain"] && !tls_config
         end
 
+        def address
+          @config["domain"] || ":#{@config.fetch("port", 4437)}"
+        end
+
         def tls_config
           @config["tls"]
         end
 
+        def log_format
+          log_config.fetch("format", "console")
+        end
+
+        def log_level
+          log_config.fetch("level", "INFO")
+        end
+
+        def log_config
+          @config.fetch("log", {})
+        end
+
+        def route_block(indent: 1)
+          t = "\t" * indent
+          lines = []
+          lines << "#{t}route #{route_path} {"
+          lines << "#{t}\tforward_auth #{auth["url"]} {"
+          lines << "#{t}\t\turi #{auth["path"]}"
+          copy_headers.each { |h| lines << "#{t}\t\tcopy_headers #{h}" }
+          lines << "#{t}\t}"
+
+          directives = storage_directives
+          if directives.any?
+            lines << "#{t}\tdurable_streams {"
+            directives.each { |d| lines << "#{t}\t\t#{d}" }
+            lines << "#{t}\t}"
+          else
+            lines << "#{t}\tdurable_streams"
+          end
+
+          lines << "#{t}}"
+          lines.join("\n")
+        end
+
         def route_path
           @config.fetch("route", "/v1/streams/*")
         end
@@ -71,25 +140,17 @@ module DurableStreams
           auth.fetch("copy_headers", [ "Cookie" ])
         end
 
-        def log_format
-          @config.fetch("log_format", "console")
+        def storage_directives
+          storage = @config.fetch("storage", {})
+          STORAGE_DIRECTIVES.filter_map { |key| "#{key} #{storage[key]}" if storage[key] }
         end
 
-        def log_level
-          @config.fetch("log_level", "INFO")
+        def internal
+          @config["internal"]
         end
 
-        def plugin_block
-          storage = @config.fetch("storage", {})
-          directives = []
-          directives << "data_dir #{storage["data_dir"]}" if storage["data_dir"]
-          directives << "max_file_handles #{storage["max_file_handles"]}" if storage["max_file_handles"]
-          directives << "long_poll_timeout #{storage["long_poll_timeout"]}" if storage["long_poll_timeout"]
-          directives << "sse_reconnect_interval #{storage["sse_reconnect_interval"]}" if storage["sse_reconnect_interval"]
-
-          if directives.any?
-            " {\n" + directives.map { |d| "\t\t\t#{d}" }.join("\n") + "\n\t\t}"
-          end
+        def internal_allowed_ips
+          internal&.dig("allowed_ips")
         end
     end
   end

data/lib/durable_streams/rails/version.rb

@@ -1,5 +1,5 @@
 module DurableStreams
   module Rails
-    VERSION = "0.5.1"
+    VERSION = "0.5.2"
   end
 end

data/lib/generators/durable_streams/install/templates/durable_streams.yml.tt

@@ -6,9 +6,10 @@
 
 default: &default
   port: 4437
-  # route: /v1/streams/*          # URL path prefix for stream endpoints
-  # log_format: console            # "console" (human-readable) or "json" (structured)
-  # log_level: INFO                # INFO, WARN, or ERROR
+  # route: /v1/streams/*            # URL path prefix for stream endpoints. Default: /v1/streams/*
+  # log:
+  #   format: console               # "console" (human-readable) or "json" (structured). Default: console
+  #   level: INFO                   # INFO, WARN, or ERROR. Default: INFO
   auth:
     url: http://localhost:3000
     path: /durable_streams/auth/verify
@@ -24,11 +25,17 @@ test:
 production:
   <<: *default
   domain: streams.example.com
-  # tls:                           # Explicit TLS certs (disables ACME). Use with Cloudflare origin certs.
+  # tls:                             # Explicit TLS certs (disables ACME). Use with Cloudflare origin certs.
   #   cert: /etc/caddy/certs/cert.pem
   #   key: /etc/caddy/certs/key.pem
-  # log_format: json
-  # log_level: WARN
+  # internal:                        # Server-to-server listener (no TLS). Restrict to private network.
+  #   port: 4437
+  #   bind: 10.0.0.5                # Only listen on the private interface.
+  #   allowed_ips:                   # Caddy remote_ip check — 403 for everyone else.
+  #     - 10.0.0.4
+  # log:
+  #   format: json
+  #   level: WARN
   auth:
     url: https://app.example.com
     path: /durable_streams/auth/verify
@@ -37,6 +44,6 @@ production:
       - Authorization
   storage:
     data_dir: /var/data/durable-streams
-    # max_file_handles: 100        # Connection pool for segment files. Tune to ~2x concurrent active streams.
-    # long_poll_timeout: 30s       # How long to wait for new data before returning 204.
-    # sse_reconnect_interval: 60s  # Server closes SSE after this interval for CDN collapsing.
+    # max_file_handles: 100          # Connection pool for segment files. Default: 100
+    # long_poll_timeout: 30s         # How long to wait for new data before returning 204. Default: 30s
+    # sse_reconnect_interval: 60s    # Server closes SSE after this interval for CDN collapsing. Default: 60s

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: durable_streams-rails
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.5.2
 platform: ruby
 authors:
 - tokimonki