6a5e0d872b
Stdlib per-tenant service: trusted-header identity (router/relay/worker, constant-time keys, slot pinned to the pod), fail-closed card flags with capability negotiation, tenant-scoped store (atomic writes, revisions, append-only ledgers, content-addressed blobs, manifest), audit outcome for every request, and the /hux/v1 pipeline that maps errors to hux.error.v1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNPhwu2bsaRNg3DETSAZoM
49 lines
1.6 KiB
Python
49 lines
1.6 KiB
Python
"""Process entry point: ``python -m hux.server``.
|
|
|
|
Environment: ``HUX_DATA_ROOT`` (tenant PVC path, default /opt/data),
|
|
``HUX_BIND`` (default 127.0.0.1), ``HUX_PORT`` (default 8790), ``HUX_FLAGS``,
|
|
``HUX_RELAY_KEY``, ``HUX_WORKER_KEY``, ``HUX_BUILD_COMMIT``, ``HUX_IMAGE_DIGEST``.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import importlib
|
|
import os
|
|
from pathlib import Path
|
|
|
|
from hux.http import Router, serve
|
|
|
|
FAMILIES = ("foundation", "events", "memory", "privacy", "organization", "artifacts", "research", "policy")
|
|
|
|
|
|
def build_router(data_root: Path, environ: dict[str, str] | None = None) -> Router:
|
|
"""Create a router with every family module that is present registered."""
|
|
router = Router(data_root, environ)
|
|
for name in FAMILIES:
|
|
try:
|
|
module = importlib.import_module(f"hux.{name}")
|
|
except ModuleNotFoundError:
|
|
continue
|
|
module.register(router)
|
|
return router
|
|
|
|
|
|
def bind_address(env: dict[str, str]) -> str:
|
|
"""Loopback only: the router is in the same pod, nothing else may reach the service."""
|
|
bind = env.get("HUX_BIND", "127.0.0.1")
|
|
if bind not in {"127.0.0.1", "::1", "localhost"}:
|
|
raise SystemExit(f"refusing to bind {bind}: hux-foundation is loopback-only")
|
|
return bind
|
|
|
|
|
|
def main() -> None:
|
|
"""Run the server until killed."""
|
|
env = dict(os.environ)
|
|
router = build_router(Path(env.get("HUX_DATA_ROOT", "/opt/data")), env)
|
|
server = serve(router, bind_address(env), int(env.get("HUX_PORT", "8790")))
|
|
server.serve_forever()
|
|
|
|
|
|
if __name__ == "__main__": # pragma: no cover
|
|
main()
|