actuator

package module
v0.4.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 10, 2026 License: Apache-2.0 Imports: 29 Imported by: 0

Documentation

Overview

Package actuator mounts a Spring-Actuator-equivalent debug/introspection surface (modules, startup, routes, health, info, config, pprof, expvar, goroutine dump, DI graph, live log-level control) on its own loopback fiber listener. All dependencies are optional so it degrades gracefully: an absent source makes its endpoint return 501/empty rather than fail boot.

Index

Constants

View Source
const (
	ShowNever          = "never"
	ShowAlways         = "always"
	ShowWhenAuthorized = "when_authorized"
)

ShowValues enum values for the show_values config key.

Variables

This section is empty.

Functions

This section is empty.

Types

type Config

type Config struct {
	// Name is the instance name.
	Name string `koanf:"-"`

	// Enabled gates the whole module; when false Init/Start are no-ops. Default false.
	Enabled bool `koanf:"enabled"`

	// Host to bind the private actuator listener. Default 127.0.0.1.
	Host string `koanf:"host"`

	// Port to bind. Default 6060.
	Port uint16 `koanf:"port"`

	// BasePath prefixes every endpoint. Default /debug.
	BasePath string `koanf:"base_path"`

	// ShowValues controls config-value masking: never|always|when_authorized.
	// Default never (matched leaves render as ******).
	ShowValues string `enum:"never,always,when_authorized" koanf:"show_values"`

	// RedactPatterns extends (does not replace) the default key-redaction set.
	RedactPatterns []string `koanf:"redact_patterns"`

	// Endpoints toggles optional endpoint groups. All default true.
	Endpoints EndpointToggles `koanf:"endpoints"`

	// AllowInsecure downgrades the fail-closed security refusals (non-loopback
	// without auth; sensitive endpoints without auth) to a warn. Default false.
	AllowInsecure bool `koanf:"allow_insecure"`

	// Mount, when set, mounts endpoints under the caller's router instead of a
	// private listener (escape hatch, code-only).
	Mount fiber.Router `code_only:"WithMount" koanf:"-"`

	// Auth is caller-supplied middleware gating sensitive (and optionally all)
	// endpoints (code-only). The real JWT verifier is a later phase.
	Auth fiber.Handler `code_only:"WithAuth" koanf:"-"`
}

Config represents configuration for the actuator Module. Defaults are security-conservative: disabled, loopback-bound, values masked.

func NewConfig

func NewConfig(options ...Option) Config

NewConfig returns configuration with provided options based on defaults.

func NewDefaultConfig

func NewDefaultConfig() Config

NewDefaultConfig returns default configuration.

func (*Config) LoadFromKoanf

func (c *Config) LoadFromKoanf(k *koanf.Koanf, path string) error

LoadFromKoanf loads configuration from koanf at the given path.

func (*Config) RequiresAuth

func (c *Config) RequiresAuth(endpoint string) bool

RequiresAuth reports whether the endpoint (BasePath-relative, e.g. "/goroutine") requires auth on any bind. True for goroutine/pprof/vars/loggers.

func (*Config) SecretRedactor

func (c *Config) SecretRedactor() (*Redactor, error)

SecretRedactor compiles the default key patterns plus RedactPatterns into a ready Redactor honoring ShowValues.

type ConfigResponse

type ConfigResponse struct {
	Values     map[string]any    `json:"values"`
	Provenance map[string]string `json:"provenance,omitempty"`
}

ConfigResponse is the /config JSON contract.

type DIResponse

type DIResponse struct {
	Format string `json:"format"`
	Graph  string `json:"graph"`
}

DIResponse is the /di JSON contract.

type EndpointToggles

type EndpointToggles struct {
	Pprof   bool `koanf:"pprof"`
	Expvar  bool `koanf:"expvar"`
	UI      bool `koanf:"ui"`
	Loggers bool `koanf:"loggers"`
}

EndpointToggles gates the optional endpoint groups. UI is kept as a config flag but has no handler this phase (dashboard deferred).

type InfoResponse

type InfoResponse struct {
	GoVersion string            `json:"go_version"`
	Path      string            `json:"path"`
	Main      ModuleVersion     `json:"main"`
	Settings  map[string]string `json:"settings"`
	Deps      []ModuleVersion   `json:"deps"`
}

InfoResponse is the /info JSON contract.

type InstanceRoutes

type InstanceRoutes struct {
	Instance string      `json:"instance"`
	Routes   []RouteView `json:"routes"`
}

InstanceRoutes is one fiber instance's routes.

type LoggersRequest

type LoggersRequest struct {
	Level string `json:"level"`
}

LoggersRequest is the POST /loggers JSON body.

type LoggersResponse

type LoggersResponse struct {
	Level string `json:"level"`
}

LoggersResponse reports the effective default level after a change.

type Module

type Module struct {
	lakta.NamedBase
	lakta.SyncCtx
	// contains filtered or unexported fields
}

Module is the actuator [SyncModule].

func NewModule

func NewModule(options ...Option) *Module

NewModule creates a new actuator module.

func (*Module) Addr

func (m *Module) Addr() net.Addr

Addr returns the listener's network address, or nil before Start.

func (*Module) ConfigPath

func (m *Module) ConfigPath() string

ConfigPath returns modules.debug.actuator.<name>.

func (*Module) Dependencies

func (m *Module) Dependencies() ([]reflect.Type, []reflect.Type)

Dependencies declares no required deps; all optional so the module degrades to 501/empty when a source is absent.

func (*Module) Init

func (m *Module) Init(ctx context.Context) error

Init resolves optional sources from DI, builds the private *fiber.App (or the WithMount target), registers all endpoint handlers under BasePath, and applies the fail-closed security model. No-op when Enabled is false.

func (*Module) LoadConfig

func (m *Module) LoadConfig(k *koanf.Koanf) error

LoadConfig loads configuration from koanf.

func (*Module) Shutdown

func (m *Module) Shutdown(ctx context.Context) error

Shutdown drains the private listener.

func (*Module) Start

func (m *Module) Start(ctx context.Context) error

Start listens on Host:Port with graceful shutdown, mirroring pkg/http/fiber (incl. OnPreStartupMessage suppression). No-op when Enabled is false or when WithMount delegated serving to the host app.

type ModuleVersion

type ModuleVersion struct {
	Path    string `json:"path"`
	Version string `json:"version"`
}

ModuleVersion is a build-info module path/version pair.

type ModuleView

type ModuleView struct {
	Name         string   `json:"name"`
	Type         string   `json:"type"`
	InitOrder    int      `json:"init_order"`
	Provides     []string `json:"provides"`
	Requires     []string `json:"requires"`
	Optional     []string `json:"optional"`
	Lifecycle    string   `json:"lifecycle"`
	State        string   `json:"state"`
	InitDuration string   `json:"init_duration"`
}

ModuleView is one module's rendered metadata.

type ModulesResponse

type ModulesResponse struct {
	Modules []ModuleView `json:"modules"`
}

ModulesResponse is the /modules JSON contract.

type Option

type Option func(m *Config)

Option manipulates Config.

func WithAuth

func WithAuth(h fiber.Handler) Option

WithAuth sets the auth middleware gating sensitive endpoints (code-only).

func WithEnabled

func WithEnabled(enabled bool) Option

WithEnabled toggles the module in code (config normally drives this).

func WithHost

func WithHost(host string) Option

WithHost sets the bind host in code.

func WithMount

func WithMount(router fiber.Router) Option

WithMount mounts endpoints under the caller's router instead of a private listener (code-only escape hatch).

func WithName

func WithName(name string) Option

WithName sets the instance name.

func WithPort

func WithPort(port uint16) Option

WithPort sets the bind port in code.

type Redactor

type Redactor struct {
	// contains filtered or unexported fields
}

Redactor walks koanf-produced structures redacting secrets. Constructed via Config.SecretRedactor/NewRedactor. Stateless after construction; safe for concurrent reads. Redaction is best-effort: value-level scrubbing is regex-based and cannot guarantee every embedded secret is caught — the wholesale redaction of passthrough (,remain) subtrees is the backstop.

func NewRedactor

func NewRedactor(additive []string, showValues string) (*Redactor, error)

NewRedactor compiles the default key patterns plus any additive patterns into a Redactor honoring showValues (never|always|when_authorized).

func (*Redactor) Redact

func (r *Redactor) Redact(in map[string]any, authorized bool) map[string]any

Redact returns a redacted deep copy of a koanf structure. Recurses nested map[string]any AND []any elements, wholesale-redacts subtrees under matched or passthrough keys, and scrubs value-level URI/DSN secrets in every string. When show_values disables masking, returns an unmodified deep copy.

type RouteView

type RouteView struct {
	Method string `json:"method"`
	Path   string `json:"path"`
	Name   string `json:"name,omitempty"`
}

RouteView is one registered route.

type RoutesResponse

type RoutesResponse struct {
	Instances []InstanceRoutes `json:"instances"`
}

RoutesResponse is the /routes JSON contract.

type StartupEntry

type StartupEntry struct {
	Name         string `json:"name"`
	InitOrder    int    `json:"init_order"`
	InitDuration string `json:"init_duration"`
}

StartupEntry is one module's init timing.

type StartupResponse

type StartupResponse struct {
	Total   string         `json:"total_init_duration"`
	Entries []StartupEntry `json:"entries"`
}

StartupResponse is the /startup JSON contract (init waterfall).

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL