Module admin 

Admin API and UI server.

Runs an axum [Router] on a dedicated port, separate from the data plane. Exposes Basic-Auth-protected CRUD endpoints for routes and policies, status/health/metrics endpoints, and serves the embedded React SPA (node-graph editor) as an unauthenticated fallback (compile-time ui feature + runtime admin.ui_enabled).

Modules

acme 🔒

Admin surface for ACME-managed certificates: read-only status plus a “renew now” nudge. Configuration stays in system.yaml (restart-gated like every TLS setting), so there is deliberately no CRUD here. Responses never include key material — only what CertMeta records.

auth 🔒

HTTP Basic Auth middleware for the admin API.

cache 🔒

DELETE /api/cache/{id} – purge everything a proxy-cache pair cached.

consumers 🔒

Admin API endpoints for consumer CRUD. Mutations rewrite the in-memory gateway config and trigger SharedState::reload, which rebuilds and atomically swaps the consumer store (no graph recompile is strictly needed, but reload keeps the semantics uniform with routes/policies).

debug 🔒

Admin API for debug mode: trace listing/retrieval and the plugin sandbox.

env_vars 🔒

Admin API endpoint serving environment variable names. Consumed by the UI for dynamic configuration and secrets management.

mcp 🔒

Admin API companions to the MCP server, for the web UI: connection status (never token values) and the rendered prompt texts behind “Copy as agent prompt”. Basic-Auth like the rest of /api; answer whether or not MCP is enabled — rendering a prompt exposes nothing a Basic Auth user cannot already read.

plugin_configs 🔒

Admin API endpoints for plugin config CRUD. Mutations rewrite the in-memory gateway config and trigger validation + recompilation of every policy (plugin configs are resolved at compile time), so a breaking edit or a delete-while-referenced is rejected with 400 before anything changes.

policies 🔒

Admin API endpoints for policy CRUD, plus catalogs of available plugin types and on-disk scripts. Policy mutations rewrite the in-memory gateway config and trigger validation + graph recompilation via SharedState::reload.

routes 🔒

Admin API endpoints for route CRUD. Mutations rewrite the in-memory gateway config and trigger validation + graph recompilation via SharedState::reload.

sessions 🔒

Admin surface for server-side sessions: list and revoke. Meta only — session payloads are sealed and never leave the store through this API.

status 🔒

Operational endpoints for the admin API: liveness/readiness probes, a status summary, Prometheus metrics, and manual config reload.

stores 🔒

Admin CRUD for the stores: resource (named redis/valkey connections).

supernodes 🔒

Admin API endpoints for supernode CRUD. Mutations rewrite the in-memory gateway config and trigger validation + recompilation of every policy (supernodes are inlined at compile time), so a breaking edit or a delete-while-referenced is rejected with 400 before anything changes.

ui 🔒

Serves the admin web UI (React SPA node-graph editor) from assets embedded into the binary at build time via rust-embed. Mounted as the admin router’s unauthenticated fallback; the SPA authenticates its own calls to the admin API.

vars 🔒

Admin API endpoint serving the context-variable catalog (src/vars/catalog.rs) — consumed by the UI’s autocomplete and var legend.

Functions

build_router 🔒

Builds the admin router: authed API routes, plus — only when compiled with the ui feature AND admin.ui_enabled is true — the unauthenticated SPA fallback. Without it, non-API paths get axum’s default 404.

not_found 🔒

Unauthenticated 404 for non-API paths when the SPA fallback isn’t mounted (ui_enabled: false, or a binary built without the ui feature). See the comment in build_router for why this must be set explicitly rather than left as the router’s implicit default.

start_admin_server

Binds the admin listener on admin_config.bind:port and serves the admin API and UI until the server exits.