0.34.6_repo_cleanup

src/settings.rs

@@ -1,12 +1,8 @@
-//! Persisted listener intent and response controls. Listener changes require restart.
 use anyhow::{ensure, Context as _, Result};
 use http::{HeaderMap, HeaderValue};
 use serde::{Deserialize, Serialize};
 use std::{net::SocketAddr, time::Duration};
 
-/// Listener addresses explicitly supplied by the service manager/CLI. These
-/// are process-level contracts and cannot be removed or rewritten through the
-/// persisted control plane while the process is started with those values.
 #[derive(Debug, Clone, Copy, Default)]
 pub struct StartupLocks {
     pub http: Option<SocketAddr>,
@@ -16,9 +12,6 @@ pub struct StartupLocks {
 impl StartupLocks {
     pub fn ensure_config(&self, config: &mut crate::config::Config) {
         if self.administration.is_some() {
-            // Explicit startup administration bind remains authoritative. `None`
-            // means "use startup value" and also preserves the plain-HTTP safety
-            // gate handled by main.
             config.administration.listen = None;
         }
         if let Some(address) = self.http {
@@ -73,10 +66,6 @@ fn ensure_locked_listener(config: &mut crate::config::Config, address: SocketAdd
         endpoint.enabled = true;
         return;
     }
-    // An explicit startup HTTP/HTTPS address overrides the canonical default
-    // listener created by earlier starts. Keep separately named/custom listeners
-    // intact, but do not retain the old default :80/:443 binding alongside a
-    // command-line/systemd override.
     let canonical_id = if tls { "https" } else { "http" };
     if let Some(endpoint) = config.listeners.endpoints.iter_mut().find(|endpoint| {
         endpoint.id == canonical_id && endpoint.binding.tls == tls
@@ -127,11 +116,8 @@ fn ensure_locked_listener(config: &mut crate::config::Config, address: SocketAdd
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(default, deny_unknown_fields)]
 pub struct Http2Connections {
-    /// Close an otherwise unused HTTP/2 connection after this inactivity period.
     pub idle_timeout_seconds: u64,
-    /// Absolute connection age limit. Zero disables the lifetime limit.
     pub max_connection_lifetime_seconds: u64,
-    /// Maximum time after GOAWAY for active streams to finish before TCP is closed.
     pub drain_timeout_seconds: u64,
 }
 impl Default for Http2Connections {
@@ -172,9 +158,6 @@ impl Http2Connections {
     }
 }
 
-/// Allowed encodings for the authenticated panel document. Codec preference is
-/// zstd, then Brotli, then gzip for equal Accept-Encoding quality. These
-/// settings are independent from downstream proxy response compression.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(default, deny_unknown_fields)]
 pub struct PanelCompression {
@@ -189,20 +172,11 @@ impl Default for PanelCompression {
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(default, deny_unknown_fields)]
 pub struct Administration {
-    /// None keeps the startup/CLI administration address for backward compatibility.
-    /// A persisted address is applied on the next process start.
     pub listen: Option<SocketAddr>,
     pub tls: bool,
-    /// None uses the application-managed default certificate pair.
     pub certificate_id: Option<String>,
-    /// Optional additional DNS Host allowlist. The hostname of public_origin is
-    /// included automatically at runtime, never duplicated in persisted config.
-    /// With no public_origin, an empty HTTPS list retains the legacy DNS policy.
     pub allowed_hosts: Vec<String>,
-    /// Optional fixed browser-facing HTTPS origin for the panel behind a trusted
-    /// reverse proxy. It is NEVER inferred from forwarded headers.
     pub public_origin: Option<String>,
-    /// Absolute browser-session lifetime. Existing sessions are bounded by the current value.
     pub session_days: u16,
     pub panel_compression: PanelCompression,
 }
@@ -273,8 +247,6 @@ impl Administration {
         if let Some(public_origin) = self.public_origin.as_mut() {
             *public_origin = normalize_public_admin_origin(public_origin)?;
         }
-        // Accept old 0.31.4 saved configs, but never retain a second explicit
-        // copy of the pinned hostname in a validated or newly saved config.
         if let Some(host) = self.public_origin_host().map(str::to_owned) {
             self.allowed_hosts.retain(|allowed| !allowed.eq_ignore_ascii_case(&host));
         }
@@ -285,7 +257,6 @@ impl Administration {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 pub struct Listeners {
-    /// All proxy sockets are configured here and referenced by vhosts by ID.
     pub endpoints: Vec<NamedListener>,
 }
 impl Listeners {
@@ -364,7 +335,6 @@ impl Listeners {
         Ok(())
     }
 }
-/// Labels describe operator intent, never firewall or access-control enforcement.
 #[derive(Debug, Clone, Copy, Default, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum ListenerScope {
@@ -383,7 +353,6 @@ pub struct NamedListener {
     #[serde(default = "enabled")]
     pub enabled: bool,
     pub binding: crate::vhost::Listener,
-    /// Extra explicit local addresses that share the same transport/protocol policy.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub additional_addresses: Vec<SocketAddr>,
 }