Module server 

Long-running TLS server: router + listener + reconcile loop + polls.

Modules

middleware 🔒

Auth + protocol middleware for the v1 router.

route_error 🔒

Shared route-handler error helpers. Each returns a FnOnce(E) -> StatusCode that logs and converts - paired with ? to drop the 4-line map_err blocks.

routes 🔒

Noun-based HTTP route modules.

state 🔒

Shared state + configuration types for the long-running server.

Structs

AppState

ClosureUpstream

IssuancePaths

ServeArgs

Default defaults are bogus on purpose; prod paths fail at first IO if clap parsing is skipped.

VerifiedFleetSnapshot

(fleet, hash, raw_bytes) tuple under one lock prevents readers seeing fresh fleet with stale hash or stale bytes. artifact_bytes + signature_bytes are the canonical signed bytes the cp_manifest_poll worker fetched + verified; the /v1/fleet.resolved route serves them directly so agents see the exact bytes CP verified, not stale closure-embedded content from the --artifact flag.

Constants

HTTP_DRAIN_DEADLINE 🔒

Listener drain budget; remaining 5s of TASK_SHUTDOWN_DEADLINE is for background drain.

TASK_SHUTDOWN_DEADLINE 🔒

30s = systemd TimeoutStopSec= default; stay under to avoid SIGKILL.

Functions

build_router 🔒

/healthz outside /v1; /v1/enroll is anonymous; all other /v1/* require mTLS. /v1/* is gated by require_ready_layer (#95) so agents get 503 + Retry-After until the first signed artifact is verified - no stale-state serving.

drain_background_tasks 🔒

Tasks past TASK_SHUTDOWN_DEADLINE are abandoned (handles dropped -> abort).

prime_from_artifact_files 🔒

File-fallback verify+parse for the –artifact / –signature CLI args. Synchronous; called once at startup before the listener opens. Hash is computed against the received bytes (not a re-serialised parsed struct) so additive schema changes the CP’s proto doesn’t yet know about don’t shift the rolloutId anchor — same load-bearing reason as in manifest_poll::poll_once.

serve

version_layer 🔒