9c3d741a08
Move 17 library crates into crates/, CLI binary into bin/fxt, consolidate 10 test crates into testing/, split config crate from deployment config files. Root directory reduced from 38+ to ~17 directories. All Cargo.toml paths and build.rs proto refs updated. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
web-gateway
REST and WebSocket gateway for the Foxhunt web dashboard. Built with Axum 0.7.9, it proxies HTTP requests to backend gRPC services and bridges gRPC streams to WebSocket clients.
Configuration
All settings are read from environment variables.
| Variable | Default | Description |
|---|---|---|
GATEWAY_LISTEN_ADDR |
0.0.0.0:3000 |
HTTP listen address |
JWT_SECRET |
(required, min 32 chars) | HMAC key for JWT validation |
CORS_ORIGINS |
http://localhost:5173 |
Comma-separated allowed origins |
TRADING_SERVICE_URL |
https://localhost:50051 |
Trading gRPC upstream |
BACKTESTING_SERVICE_URL |
https://localhost:50052 |
Backtesting gRPC upstream |
ML_TRAINING_SERVICE_URL |
https://localhost:50053 |
ML training gRPC upstream |
Routes
All API routes are under /api. Authentication is required unless noted.
| Tier | Rate Limit | Endpoints |
|---|---|---|
| Public | 10 req/min | POST /api/auth/login |
| Trading | 200 req/min | /api/trading/*, /api/risk/*, /api/ml/*, /api/performance/*, /api/config/* |
| Compute | 30 req/min | /api/training/*, /api/backtest/*, /api/tune/* |
| WebSocket | 50 msg/min | GET /api/ws (JWT via token query param) |
| Health | none | GET /health, GET /ready |
Security
- JWT authentication middleware (32-character minimum secret enforced at startup)
- Per-IP rate limiting across three tiers
- 1 MB request body size limit
- CORS with explicit methods (
GET,POST,PUT,DELETE) and headers (Authorization,Content-Type) - Response headers: HSTS,
x-frame-options: DENY,x-content-type-options: nosniff,referrer-policy: strict-origin-when-cross-origin - WebSocket topic whitelist (8 valid topics), per-connection rate limit, max 20 subscriptions
X-Request-Idpropagation (generated if absent, echoed on response)
Modules
| Module | Purpose |
|---|---|
auth |
JWT validation and login handler |
config |
GatewayConfig loaded from environment |
error |
Unified error types and HTTP error responses |
grpc |
Tonic clients and gRPC stream bridges |
rate_limit |
Per-IP token-bucket rate limiter (3 tiers) |
routes |
Axum router construction and all HTTP handlers |
state |
AppState (gRPC channels, WS broadcast, config) |
ws |
WebSocket upgrade, topic subscriptions, keepalive |
Running
export JWT_SECRET="your-secret-at-least-32-characters-long"
cargo run -p web-gateway