Documentation
¶
Overview ¶
Package backendapi is the backend-plane admin HTTP API.
It exposes operator endpoints (dict / acl / quota / folder / user / mailbox / ...) against the local backend's storage and pkg/dict instances. One instance runs per backend tag (or one per standalone deployment).
Concerns split:
yarilo-director hosts /api/director/... (ring / backends / users / peers) yarilo-backend-api hosts /api/backend/<service>/... (dict / acl / quota / ...)
Different binaries because director state lives in director's process memory and backend state (NFS + dicts) lives in backend pods; in multi-pod cluster these are physically separate pods, so they cannot be combined.
Wire protocol: JSON over HTTPS. Endpoints mirror the shape of internal/director's existing /api/director/... surface so the yarilo-admin CLI can speak both with identical machinery (bearer-token auth, IP allow-list, application/json bodies).
Streaming endpoints (currently dict/iterate) use NDJSON — one JSON object per line — so the CLI can pipeline display without buffering the entire response in memory.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AnvilEndpoint ¶ added in v1.24.0
AnvilEndpoint is the small slice of Options consumed by the who route. Surfaced as a separate type so the CLI / tests can call it without importing the full Server.
type Options ¶
type Options struct {
Addr string
TLSConfig *tls.Config
Token string
AllowedNets []*net.IPNet
Dicts map[string]dict.Dict
Mailbox mailbox.MailboxBackend
Index mailbox.IndexBackend
Resolver *mailbox.Resolver
NamespaceMailboxes map[string]mailbox.MailboxBackend
Namespaces []config.NamespaceConfig
Locker locks.Locker
SpecialUseDefaults map[string]string
MetadataDict dict.Dict
QuotaDict dict.Dict
// AnvilAddr / AnvilTLS configure backend-api's connection to
// yarilo-anvil for the WHO endpoint. Empty Addr disables /who
// (returns 501). Same TLS config the rest of internal cluster
// traffic uses.
AnvilAddr string
AnvilTLS *tls.Config
// AuthClient is the live yarilo-auth master-protocol client,
// dialled at startup from BackendAPIConfig.AuthMasterAddr.
// When nil, /api/backend/user/info skips the userdb-enrichment
// block and /api/backend/user/iterate returns 503. main.go
// owns the lifecycle (Close on shutdown); the Server only
// reads through it.
AuthClient *authclient.Client
}
Options configures Server.
Dicts is the live map opened by the host process; the server hands out pointers to those objects via lookups keyed by name. Mailbox / Index / Resolver / NamespaceMailboxes / Locker / SpecialUseDefaults / MetadataDict / Namespaces are the same shape session binaries already accept — backend-api opens per-user handles on demand from those (see userctx.go) so admin requests reach the same on-disk layout the IMAP path uses.
Token is the shared admin secret; empty disables auth (test/dev only). AllowedNets, when non-empty, restricts which client IPs may reach the API.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is the backend-API HTTP server. Construct with New, then call Serve (mTLS-terminated TLS listener) or ListenAndServe (plain).
func New ¶
New constructs a Server and registers the backend endpoints onto an internal ServeMux. Subsequent Server.routes additions (for ACL, quota, etc.) happen via dedicated wire registration in their own files (acl.go, quota.go); dict.go owns the dict surface.
Source Files