railwatch-server 0.1.0-x86_64-linux

data/app/controllers/railwatch/server/proxy_controller.rb

@@ -0,0 +1,323 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "socket"
+
+module Railwatch
+  module Server
+    # /railwatch/* in the app, forwarded to the bundled server on loopback.
+    #
+    # The gate is the railwatch gem's, so one setting covers the dashboard
+    # whichever gem serves it: HTTP Basic, on and closed by default
+    # (Railwatch.config.http_basic_auth_*), or the app's own controller
+    # (Railwatch.config.base_controller_class, with Basic off), whose
+    # before_actions run first. Past the gate, each request carries a signed,
+    # 60-second X-Railwatch-Proxy-Auth naming the visitor, which the server
+    # trusts (railwatch-rs trusted proxy auth); nobody signs in twice.
+    #
+    # The server is served under the same path (RAILWATCH_BASE_PATH), so
+    # paths, redirects, cookies, asset URLs and the live channel pass through
+    # unrewritten. CSRF is the server's: it checks Origin and its own token
+    # on every write, so Rails' check is skipped here.
+    #
+    # No Puma thread waits for the server. Past the gate, the request (which
+    # Puma has read in full) is left to ProxyHandoff, which takes the socket
+    # from Puma and gives it to the process's one Relay thread; the Relay
+    # writes the request to the server and the response back, then closes
+    # the connection (Connection: close: the browser, or the proxy in front
+    # of the app, opens a new one for the next request). Where the socket
+    # can't be taken (a server without Rack hijack, Puma's own TLS) the
+    # response is streamed from this thread instead (#stream).
+    class ProxyController < Railwatch.config.base_controller_class.constantize
+      # One upstream request whose response body is read as Puma writes it.
+      # Net::HTTP reads a body only inside the block of #request; a Fiber
+      # runs that block, handing back the response first and then each
+      # chunk, so headers can be returned before the body is read. Puma
+      # iterates the body on the thread that called the controller, which
+      # is the thread the Fiber was made on.
+      class Upstream
+        def initialize(request, headers, port:)
+          @http = Net::HTTP.new("127.0.0.1", port)
+          @http.open_timeout = Railwatch::Server.config.proxy_connect_timeout
+          @http.read_timeout = Railwatch::Server.config.proxy_first_byte_timeout
+          @http.max_retries = 0
+          # Byte-transparent: the browser's Accept-Encoding, or identity. A
+          # request built without one gets Net::HTTP's gzip default and its
+          # body decoded under the server's Content-Length.
+          headers = headers.merge("Accept-Encoding" => request.headers["Accept-Encoding"].presence || "identity")
+          @upstream = Net::HTTPGenericRequest.new(request.request_method, !request.content_length.to_i.zero? || chunked_input?(request),
+                                                  !request.head?, request.fullpath, headers)
+          return unless @upstream.request_body_permitted?
+
+          input = request.body
+          input.rewind if input.respond_to?(:rewind)
+          @upstream.body_stream = input
+          if request.content_length
+            @upstream["Content-Length"] = request.content_length.to_s
+          else
+            @upstream["Transfer-Encoding"] = "chunked"
+          end
+        end
+
+        def start
+          @fiber = Fiber.new do
+            @http.start
+            @http.request(@upstream) do |response|
+              Fiber.yield response
+              response.read_body { |chunk| Fiber.yield chunk }
+            end
+            nil
+          ensure
+            @http.finish if @http.started?
+          end
+          @fiber.resume
+        end
+
+        def each
+          while (chunk = @fiber.resume)
+            yield chunk
+          end
+        end
+
+        # Called by Rack when Puma is done with the body, read to the end or
+        # not (the browser went away): the connection is closed either way.
+        def close
+          @http.finish if @http.started?
+        rescue IOError
+          nil
+        end
+
+        private
+
+        def chunked_input?(request)
+          request.get_header("HTTP_TRANSFER_ENCODING").to_s.include?("chunked")
+        end
+      end
+
+      # The server's cookies only; the app's own (its session) stay here.
+      FORWARDED_COOKIES = %w[_railwatch_session session_token account_id XSRF-TOKEN].freeze
+      FORWARDED_HEADERS = %w[
+        Accept Accept-Encoding Accept-Language Content-Type Origin Referer User-Agent
+        X-Inertia X-Inertia-Version X-Inertia-Partial-Component X-Inertia-Partial-Data X-Inertia-Partial-Except
+        X-Inertia-Reset X-Inertia-Error-Bag X-Inertia-Except-Once-Props X-Requested-With X-XSRF-TOKEN X-CSRF-Token
+        Purpose Sec-Purpose Sec-Fetch-Site Sec-Fetch-Mode Sec-Fetch-Dest If-None-Match If-Modified-Since
+      ].freeze
+      HOP_BY_HOP = %w[connection keep-alive transfer-encoding content-length te trailer upgrade proxy-connection].freeze
+
+      skip_forgery_protection if respond_to?(:skip_forgery_protection)
+      before_action :authenticate_by_http_basic
+
+      # An app on inertia_rails has its controller module in every
+      # ActionController::Base, this one included, and two of its behaviours
+      # break the dashboard, whose Inertia protocol is the server's end to
+      # end. Its middleware compares the dashboard's X-Inertia-Version with
+      # the app's and answers 409 to every Inertia visit, so each click was
+      # a full page load. Once this controller has answered (forwarded, or
+      # refused at the gate), the request's X-Inertia is removed, so the
+      # middleware, on its way out, sees no Inertia visit (every
+      # inertia_rails version checks that header first). Its after_action
+      # wrote the app's own XSRF-TOKEN (Path=/) on every response, so the
+      # browser held two and sent the app's to the server, which refused
+      # every write; forgery protection is off here (the server checks its
+      # own token), and that after_action skips a controller without it.
+      def process_action(...)
+        super
+      ensure
+        request.delete_header("HTTP_X_INERTIA")
+      end
+
+      def protect_against_forgery? = false
+
+      def forward
+        if (error = Railwatch::Server.provision_error) && !Railwatch::Server.data_dir.provisioned?
+          return unavailable("not provisioned: #{error.message}")
+        end
+
+        secret = Railwatch::Server.data_dir.proxy_secret
+        return unavailable("not provisioned yet (no #{Railwatch::Server.data_dir.proxy_secret_file})") unless secret
+
+        if websocket?
+          tunnel(secret)
+        elsif hijackable?
+          hand_off(secret)
+        else
+          stream(secret)
+        end
+      end
+
+      private
+
+      def authenticate_by_http_basic
+        config = Railwatch.config
+        return unless config.http_basic_auth_enabled
+        return if config.http_basic_auth_ok?(request)
+
+        request_http_basic_authentication("Railwatch")
+      end
+
+      # Who the server should see: Railwatch::Server.config.user when the app
+      # names its user, else the HTTP Basic user, else one operator.
+      def visitor
+        given = Railwatch::Server.config.user&.call(self)
+        return given.to_h.transform_keys(&:to_sym).reverse_merge(role: "admin") if given
+
+        basic_user = ActionController::HttpAuthentication::Basic.user_name_and_password(request).first if request.authorization.to_s.start_with?("Basic ")
+        # Decoded base64 comes back binary; parameterize needs a real encoding.
+        name = basic_user.to_s.dup.force_encoding(Encoding::UTF_8).scrub.presence || "Operator"
+        { email: "#{name.parameterize.presence || 'operator'}@railwatch.invalid", name: name, role: "admin" }
+      end
+
+      def signed_header(secret)
+        v = visitor
+        ProxyAuth.sign(secret, email: v[:email], name: v[:name], role: v[:role])
+      end
+
+      def upstream_headers(secret)
+        headers = FORWARDED_HEADERS.each_with_object({}) do |name, h|
+          value = request.headers[name]
+          h[name] = value if value
+        end
+        cookies = request.cookies.slice(*FORWARDED_COOKIES)
+        headers["Cookie"] = cookies.map { |k, v| "#{k}=#{v}" }.join("; ") if cookies.any?
+        # The server compares Origin with Host, and builds absolute URLs (an
+        # Inertia version-mismatch reload) from Host and X-Forwarded-Proto.
+        headers["Host"] = request.host_with_port
+        headers["X-Forwarded-Proto"] = request.scheme
+        # The visitor, as the app sees it (RemoteIp: the proxies in front of
+        # the app are trusted, the browser's own X-Forwarded-For is not),
+        # and only that: the server (RAILWATCH_TRUST_PROXY) keys its per-IP
+        # limits on the last address here.
+        headers["X-Forwarded-For"] = request.remote_ip
+        headers[ProxyAuth::HEADER] = signed_header(secret)
+        headers
+      end
+
+      # The browser's socket can be taken from the app server and moved with
+      # IO.select: Rack hijack, and a plain socket (not Puma's own TLS, whose
+      # socket wrapper keeps decrypted bytes the relay could not see).
+      def hijackable?
+        return false unless request.env["rack.hijack"]
+
+        socket = request.env["puma.socket"]
+        socket.nil? || socket.is_a?(::BasicSocket)
+      end
+
+      # Connects to the server and leaves the request to ProxyHandoff; the
+      # empty 200 here is never sent. Past max_proxied_requests the visitor
+      # gets a 503 at once.
+      def hand_off(secret)
+        relay = Relay.current
+        if relay.full?(:proxied)
+          Rails.logger.warn("[railwatch-server] #{relay.max(:proxied)} dashboard requests in flight (max_proxied_requests); refusing another")
+          response.headers["Retry-After"] = "1"
+          return render(plain: "The dashboard is busy (#{relay.max(:proxied)} requests in flight in this process). Try again in a moment.",
+                        status: :service_unavailable)
+        end
+
+        upstream = connect
+        request_head, body = upstream_request(secret)
+        request.env[ProxyHandoff::ENV_KEY] = ProxyHandoff::Handoff.new(upstream, request_head, body)
+        head :ok
+      rescue SystemCallError, IOError => e
+        upstream&.close rescue nil
+        unavailable("#{e.class}: #{e.message}")
+      end
+
+      def connect
+        TCPSocket.new("127.0.0.1", Railwatch::Server.config.port, connect_timeout: Railwatch::Server.config.proxy_connect_timeout)
+      rescue IO::TimeoutError => e
+        raise Errno::ETIMEDOUT, e.message
+      end
+
+      # The request as the server gets it: its head (and its body, when Puma
+      # kept that in memory), and the body Puma spooled to a tempfile, as a
+      # second descriptor of it (Puma closes its own when this thread
+      # returns). Puma has read the body in full and decoded a chunked one,
+      # so it always has a length.
+      def upstream_request(secret)
+        input = request.body
+        input.rewind if input.respond_to?(:rewind)
+        length = request.content_length.to_i
+        body = input.is_a?(::File) ? input.dup : nil
+        # The browser's HTTP version: an HTTP/1.0 client (nginx's default
+        # upstream protocol) can't read a chunked response, and the server
+        # doesn't send one to an HTTP/1.0 request.
+        version = request.get_header("SERVER_PROTOCOL") == "HTTP/1.0" ? "HTTP/1.0" : "HTTP/1.1"
+        headers = upstream_headers(secret)
+        headers["Accept-Encoding"] = request.headers["Accept-Encoding"].presence || "identity"
+        headers["Content-Length"] = length.to_s if length.positive? || request.content_length
+        headers["Connection"] = "close"
+        head = "#{request.request_method} #{request.fullpath} #{version}\r\n" \
+               "#{headers.map { |k, v| "#{k}: #{v.to_s.delete("\r\n")}\r\n" }.join}\r\n".b
+        head << input.read.to_s.b if body.nil? && length.positive?
+        [ head, body ]
+      end
+
+      # Without hijack: the response is streamed from this thread, status and
+      # headers as soon as the server sends them, then the body as the app
+      # server writes it (Upstream#each), so a large export never sits whole
+      # in this process. The request body is streamed too, from rack.input.
+      def stream(secret)
+        upstream = Upstream.new(request, upstream_headers(secret), port: Railwatch::Server.config.port)
+        response = upstream.start
+        response.each_header do |name, _|
+          next if HOP_BY_HOP.include?(name) || Relay::APP_OWNED.include?(name)
+
+          values = response.get_fields(name)
+          self.response.headers[name] = name == "set-cookie" ? values : values.join(", ")
+        end
+        # The server's length is the body's: Upstream asks for it unencoded
+        # unless the browser accepts an encoding, and never decodes it.
+        self.response.headers["content-length"] = response["content-length"] if response["content-length"] && !response.chunked?
+        self.status = response.code.to_i
+        self.response_body = request.head? || !response.class.body_permitted? ? (upstream.close; []) : upstream
+      rescue Errno::ECONNREFUSED, Errno::ECONNRESET, Net::OpenTimeout, EOFError => e
+        unavailable("#{e.class}: #{e.message}")
+      end
+
+      def websocket?
+        request.get? && request.headers["Upgrade"].to_s.casecmp?("websocket")
+      end
+
+      # The live channel: the handshake is sent on with the signed header and
+      # the connection is spliced to the server's by the process's one relay
+      # thread (Relay), at most config.max_live_connections at a time. Needs
+      # a server with full Rack hijack (Puma).
+      def tunnel(secret)
+        hijack = request.env["rack.hijack"]
+        return head(:not_implemented) unless hijack
+
+        relay = Relay.current
+        if relay.full?(:live)
+          Rails.logger.warn("[railwatch-server] #{relay.max(:live)} live-channel connections open (max_live_connections); refusing another")
+          return head(:service_unavailable)
+        end
+        upstream = connect
+        handshake = upstream_headers(secret).merge(
+          "Connection" => "Upgrade", "Upgrade" => "websocket",
+          "Sec-WebSocket-Key" => request.headers["Sec-WebSocket-Key"],
+          "Sec-WebSocket-Version" => request.headers["Sec-WebSocket-Version"],
+          "Sec-WebSocket-Protocol" => request.headers["Sec-WebSocket-Protocol"],
+          "Sec-WebSocket-Extensions" => request.headers["Sec-WebSocket-Extensions"]
+        ).compact
+        upstream.write("GET #{request.fullpath} HTTP/1.1\r\n#{handshake.map { |k, v| "#{k}: #{v}\r\n" }.join}\r\n")
+        client = hijack.call
+        unless relay.add(client, upstream)
+          [ client, upstream ].each { |io| io.close rescue nil }
+        end
+        self.status = -1
+        self.response_body = []
+      rescue SystemCallError => e
+        unavailable("#{e.class}: #{e.message}")
+      end
+
+      def unavailable(why)
+        message = "The Railwatch server is not answering on 127.0.0.1:#{Railwatch::Server.config.port} (#{why}). " \
+                  "It is started by `plugin :railwatch_server` in config/puma.rb or `bin/rails railwatch_server:start`; " \
+                  "its log is #{Railwatch::Server.data_dir.log_file}."
+        Rails.logger.error("[railwatch-server] #{message}")
+        render plain: message, status: :service_unavailable
+      end
+    end
+  end
+end

data/lib/puma/plugin/railwatch_server.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+require "puma/plugin"
+
+# `plugin :railwatch_server` in config/puma.rb: runs the bundled Railwatch
+# server as a child of Puma's master (single or cluster mode; never in a
+# worker), restarts it with backoff when it dies, and stops it after Puma
+# has drained its requests and flushed its reporter.
+#
+# The shape is the railwatch gem's own writer plugin
+# (lib/puma/plugin/railwatch.rb). A bare `puma` fires plugin starts before
+# it loads the Rack app, so there a background supervisor waits for
+# after_booted. Under `bin/rails server` the app is loaded first, and the
+# server is started in `start` itself, before Puma accepts a request: an
+# agent whose first delivery is refused counts it as backpressure and
+# samples fewer requests for the next second or two. Stopping is in at_exit,
+# not after_stopped: Puma fires after_stopped from its TERM trap BEFORE it
+# drains in-flight requests, and those requests' records still have to
+# reach this server.
+Puma::Plugin.create do
+  POLL = 1
+
+  def start(launcher)
+    @log_writer = launcher.log_writer
+    @puma_pid = $$
+    @booted = false
+    @shutting_down = false
+
+    start_server_now if app_loaded?
+    in_background { supervise }
+    launcher.events.after_booted { @booted = true }
+    # A hot restart (USR2) re-execs this process: the server is stopped
+    # first and the new master starts its own.
+    launcher.events.before_restart { stop_server if Process.pid == @puma_pid }
+    launcher.events.after_stopped { @shutting_down = true }
+    at_exit { shutdown if Process.pid == @puma_pid }
+  end
+
+  private
+
+  def active?
+    defined?(::Railwatch::Server) && ::Railwatch::Server.enabled?
+  end
+
+  def app_loaded?
+    defined?(::Rails) && ::Rails.respond_to?(:application) && ::Rails.application&.initialized?
+  end
+
+  def start_server_now
+    return unless active?
+
+    build_server
+    @server.ensure_running
+  rescue StandardError => e
+    log "Railwatch server NOT started: #{e.class}: #{e.message}"
+    @server = nil
+  end
+
+  def build_server
+    ::Railwatch::Server.provision!(log: method(:log))
+    @server = ::Railwatch::Server::Process.new(
+      config: ::Railwatch::Server.config, data_dir: ::Railwatch::Server.data_dir,
+      binary: ::Railwatch::Server::Binary.path, log: method(:log)
+    )
+  end
+
+  def supervise
+    sleep 0.05 until @server || @booted || @shutting_down
+    return unless active?
+
+    build_server unless @server
+    until @shutting_down
+      @server.ensure_running
+      sleep POLL
+    end
+  rescue StandardError => e
+    log "Railwatch server NOT started: #{e.class}: #{e.message}"
+  end
+
+  # The app's own reporter first, while the server still listens: the last
+  # requests' records (and in single mode, every request's) go out now.
+  #
+  # Under `bin/rails server` the app loads before Puma starts this plugin,
+  # so this at_exit was registered after the railwatch gem's and runs
+  # BEFORE them (at_exit is LIFO). Those stop the health sampler and flush
+  # the session tracker, which emits records; run them here first, so their
+  # records are in the final flush rather than produced after the server is
+  # gone. Each stop! is idempotent; the gem's own at_exit then does nothing.
+  def shutdown
+    @shutting_down = true
+    if defined?(::Railwatch) && ::Railwatch.respond_to?(:enabled?) && ::Railwatch.enabled? && !::Railwatch.config.local?
+      [ "Health", "Sessions", "Maintenance", "Export::Sender" ].each do |name|
+        mod = ::Railwatch.const_get(name) if ::Railwatch.const_defined?(name)
+        mod.stop! if mod.respond_to?(:stop!)
+      end
+      ::Railwatch.reporter.shutdown
+    end
+    stop_server
+  rescue StandardError => e
+    log "Railwatch server shutdown failed (#{e.class}: #{e.message})"
+  end
+
+  def stop_server
+    @server&.stop
+  end
+
+  def log(message)
+    @log_writer.log("[railwatch-server] #{message}")
+  end
+end

data/lib/railwatch/server/binary.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Railwatch
+  module Server
+    # The bundled `railwatch` executable, the way tailwindcss-ruby finds its
+    # own: one directory per platform under exe/, and the platform gem for
+    # this machine carries exactly one of them. The plain "ruby" gem has
+    # none and says so.
+    module Binary
+      PLATFORMS = %w[x86_64-linux aarch64-linux x86_64-darwin arm64-darwin].freeze
+      DIR = File.expand_path("../../../exe", __dir__)
+      GEM_NAME = "railwatch-server"
+
+      class NotFound < StandardError; end
+
+      module_function
+
+      def path
+        own = Railwatch::Server.config.binary
+        if own
+          raise NotFound, "RAILWATCH_SERVER_BINARY=#{own} is not an executable file" unless File.executable?(own)
+
+          return own
+        end
+
+        found = Dir.glob(File.join(DIR, "*", "railwatch")).find do |file|
+          Gem::Platform.match_gem?(Gem::Platform.new(File.basename(File.dirname(file))), GEM_NAME)
+        end
+        return found if found && File.executable?(found)
+
+        raise NotFound, <<~MESSAGE.strip
+          railwatch-server has no Railwatch server binary for #{local_platform}.
+          Prebuilt binaries ship in the #{PLATFORMS.join(', ')} gems; this is the plain one.
+          Either let Bundler pick the platform gem (`bundle lock --add-platform #{local_platform}`,
+          and check `bundle config force_ruby_platform` is not true), or install the server
+          yourself (https://github.com/Rebulk/railwatch-rs, docs/SELF-HOST.md) and set
+          RAILWATCH_SERVER_BINARY=/path/to/railwatch.
+        MESSAGE
+      end
+
+      def local_platform
+        [ Gem::Platform.local.cpu, Gem::Platform.local.os ].join("-")
+      end
+    end
+  end
+end

data/lib/railwatch/server/configuration.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+module Railwatch
+  module Server
+    # Everything is an env var first (RAILWATCH_SERVER_*), then assignment in
+    # an initializer:
+    #
+    #   Railwatch::Server.configure do |c|
+    #     c.port = 28790
+    #     c.user = ->(controller) { { email: controller.current_user.email, name: controller.current_user.name, role: "admin" } }
+    #   end
+    #
+    # The dashboard's gate is the railwatch gem's (Railwatch.config): HTTP
+    # Basic on and closed by default, or `base_controller_class` with Basic
+    # off. One set of credentials for /railwatch whichever gem serves it.
+    class Configuration
+      attr_accessor :enabled, :port, :data_dir, :mount_path, :binary, :url, :stop_timeout, :setup_timeout, :user, :wire_agent,
+                    :max_live_connections, :max_proxied_requests, :proxy_connect_timeout, :proxy_first_byte_timeout,
+                    :proxy_idle_timeout, :nice, :smtp, :mail_from, :backup, :google, :retention, :alert_delivery, :server_env
+
+      def initialize
+        # nil: on, except under Rails.env.test (a test run on a machine with
+        # a development server running would report into it). See #enabled.
+        @enabled = env_bool("RAILWATCH_SERVER_ENABLED", nil)
+        # One fixed port per app, not a free one picked at boot: every process
+        # of the app (Puma workers, Solid Queue, a rake task) must find the
+        # server without asking, and a second Puma on the same host and data
+        # dir must hit the same server (docs: two processes, one data dir).
+        @port = Integer(ENV.fetch("RAILWATCH_SERVER_PORT", "28790"))
+        # nil: storage/railwatch/<Rails.env>, one per environment, as Rails
+        # keeps storage/<env>.sqlite3. See #data_path.
+        @data_dir = ENV["RAILWATCH_SERVER_DATA_DIR"]
+        @mount_path = ENV.fetch("RAILWATCH_SERVER_MOUNT_PATH", "/railwatch")
+        # A railwatch binary of your own (another version, a platform this
+        # gem has no build for). Default: the one in this platform's gem.
+        @binary = ENV["RAILWATCH_SERVER_BINARY"]
+        # The public URL of the dashboard's host, for links in alert emails
+        # and the Secure cookie flag. Default: the loopback address.
+        @url = ENV["RAILWATCH_SERVER_URL"]
+        # How long Puma's exit waits for the server to drain after TERM. The
+        # server answers SIGTERM by finishing in-flight requests and committing
+        # queued writes; an idle one is gone in well under a second.
+        @stop_timeout = Float(ENV.fetch("RAILWATCH_SERVER_STOP_TIMEOUT", "15"))
+        # How long the first start of a data dir waits for `railwatch setup`
+        # (it takes about a second), before Puma listens. Past it the setup is
+        # KILLed and the app boots without the server; the next start retries.
+        @setup_timeout = Float(ENV.fetch("RAILWATCH_SERVER_SETUP_TIMEOUT", "30"))
+        # Who the dashboard's visitor is, as the server should see them:
+        # ->(controller) { { email:, name:, role: "admin" | "member" } }.
+        @user = nil
+        # Point the railwatch agent at the bundled server when the app has not
+        # configured one (no RAILWATCH_TOKEN). Off: the app wires it itself.
+        @wire_agent = env_bool("RAILWATCH_SERVER_WIRE_AGENT", true)
+        # Open live-channel connections (one per dashboard tab) per app
+        # process, all spliced by one relay thread. Past it the dashboard
+        # still works, without live updates.
+        @max_live_connections = Integer(ENV.fetch("RAILWATCH_SERVER_MAX_LIVE_CONNECTIONS", "64"))
+        # Dashboard requests waiting on the server or streaming back, per app
+        # process, all moved by that same relay thread instead of a Puma
+        # thread each. Past it a dashboard request gets 503 and Retry-After
+        # at once; the app's own requests are never affected.
+        @max_proxied_requests = Integer(ENV.fetch("RAILWATCH_SERVER_MAX_PROXIED_REQUESTS", "64"))
+        # Seconds: to connect to the server (on loopback: it is down, or past
+        # its own connection cap), for it to start answering a dashboard
+        # request (504 past it; the slowest page at 30 days takes seconds),
+        # and for a response that has started to move again (cut off past it).
+        # The first-byte timeout is under the 30 s after which Thruster and
+        # kamal-proxy drop a response that has not started: past theirs the
+        # visitor gets an empty reply, under it this proxy's 504 that says why.
+        @proxy_connect_timeout = Float(ENV.fetch("RAILWATCH_SERVER_PROXY_CONNECT_TIMEOUT", "2"))
+        @proxy_first_byte_timeout = Float(ENV.fetch("RAILWATCH_SERVER_PROXY_FIRST_BYTE_TIMEOUT", "25"))
+        @proxy_idle_timeout = Float(ENV.fetch("RAILWATCH_SERVER_PROXY_IDLE_TIMEOUT", "60"))
+        # How much lower than the app's the server's CPU priority is (nice
+        # increment, 0-19; 0 keeps the app's). The server can keep every core
+        # busy rendering dashboards; at 10 the app's requests come first. Not
+        # under a CPU quota (docker --cpus, Kubernetes limits), which stalls
+        # the app with the server whatever the priority.
+        @nice = Integer(ENV.fetch("RAILWATCH_SERVER_NICE", "10"))
+        # The server's own settings (Settings): nil means "from the app"
+        # (Action Mailer's SMTP and From, credentials.railwatch_server's
+        # backup and google), false/{} turns one off.
+        #   smtp:      { address:, port:, user_name:, password:, enable_starttls:, tls: }
+        #   backup:    { endpoint:, bucket:, access_key_id:, secret_access_key:, region:, prefix:, interval_seconds: }
+        #   google:    { client_id:, client_secret: }
+        #   retention: { detail_days:, core_days_max: }
+        @smtp = nil
+        @mail_from = nil
+        @backup = nil
+        @google = nil
+        @retention = nil
+        # true/false: send alerts or only record them. nil: the server's default (on).
+        @alert_delivery = nil
+        # Any other RAILWATCH_* setting of the server, by name.
+        @server_env = {}
+      end
+
+      def enabled
+        @enabled.nil? ? environment != "test" : @enabled
+      end
+
+      # The environment the server's data dir holds: Rails.env, else
+      # RAILS_ENV/RACK_ENV, else production. One per data dir.
+      def environment
+        (defined?(::Rails) && ::Rails.respond_to?(:env) ? ::Rails.env : ENV["RAILS_ENV"] || ENV["RACK_ENV"] || "production").to_s
+      end
+
+      def data_path
+        path = Pathname.new(data_dir || File.join("storage", "railwatch", environment))
+        path.relative? && defined?(Rails) && Rails.root ? Rails.root.join(path) : path.expand_path
+      end
+
+      def local_url = "http://127.0.0.1:#{port}"
+
+      def normalized_mount_path
+        "/#{mount_path.to_s.delete_prefix('/').delete_suffix('/')}"
+      end
+
+      private
+
+      def env_bool(name, default)
+        value = ENV[name]
+        return default if value.nil? || value.strip.empty?
+
+        %w[1 true yes on].include?(value.strip.downcase)
+      end
+    end
+  end
+end