2c2b62639e
Two complementary changes to reduce clean workspace build time from
~13min to ~8:43:
1. Per-package codegen-units overrides
Default for all release builds: codegen-units = 16 (parallel LLVM).
Numerical-sensitive crates (ml-* family, ndarray, nalgebra, cudarc,
simba, etc.) override back to 1 to preserve bit-exact LLVM
optimization decisions for the DQN regression suite.
Non-numerical plumbing (arrow, sqlx, tokio, parquet, ...) compiles
in parallel via 16 CGUs, no numerical impact.
2. Dependency deduplication
- axum 0.7 → 0.8 (workspace + services/api): dedupes vs tonic 0.14's
transitive axum 0.8. Eliminates a full duplicate compile of axum
and axum-core.
- statrs 0.17 → 0.18: dedupes nalgebra 0.32 vs 0.33. Also closes a
numerical concern (two nalgebra versions linked simultaneously).
- governor 0.6 → 0.10 (services/api + crates/data): dedupes dashmap
5 vs 6. dashmap is heavy; eliminating one full compile is a real
win.
- hashbrown 0.14 → 0.16 (workspace): partial dedupe (dashmap 6.1
still pulls 0.14 transitively).
- Workspace Cargo.toml documents residual unfixable duplicates with
reasons (base64, chacha20, phf, darling, itertools, getrandom,
hashbrown, syn, thiserror — all blocked by third-party crates we
can't bump without breakage).
Verified: cargo check --workspace passes. Numerical crates remain
at codegen-units = 1 — DQN bit-exact reproducibility preserved.
156 lines
4.0 KiB
TOML
156 lines
4.0 KiB
TOML
[package]
|
|
name = "api"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
authors.workspace = true
|
|
license.workspace = true
|
|
description = "Foxhunt API Service — unified gRPC gateway with tonic-web for browser access"
|
|
|
|
[[bin]]
|
|
name = "api"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
# Core async and utilities
|
|
tokio = { workspace = true, features = ["sync", "time"] }
|
|
anyhow.workspace = true
|
|
tracing.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
once_cell.workspace = true
|
|
clap.workspace = true
|
|
|
|
# gRPC and networking (Tonic 0.14)
|
|
tonic = { workspace = true, features = ["transport", "server", "tls-ring", "tls-webpki-roots"] }
|
|
# Used by generated proto code: tonic_prost::ProstCodec
|
|
tonic-prost.workspace = true
|
|
tonic-reflection.workspace = true
|
|
tonic-health.workspace = true
|
|
# Used by generated proto code: ::prost::Message derive
|
|
prost.workspace = true
|
|
tower = { workspace = true, features = ["util"] }
|
|
http-body-util.workspace = true
|
|
|
|
# Async streams and futures
|
|
async-stream.workspace = true
|
|
futures.workspace = true
|
|
|
|
# Performance monitoring
|
|
prometheus = { workspace = true, features = ["process"] }
|
|
|
|
# Cryptography and security
|
|
sha2.workspace = true
|
|
x509-parser = { version = "0.16", features = ["verify"] }
|
|
reqwest = { version = "0.12", features = ["rustls-tls", "json"], default-features = false }
|
|
base64.workspace = true
|
|
jsonwebtoken.workspace = true
|
|
chrono.workspace = true
|
|
ocsp = "0.4"
|
|
lru = "0.12"
|
|
|
|
# MFA/TOTP dependencies (optional, enabled by default via "mfa" feature)
|
|
totp-rs = { version = "5.6", optional = true }
|
|
qrcode = { version = "0.14", optional = true }
|
|
image = { version = "0.25", optional = true }
|
|
base32 = { version = "0.5", optional = true }
|
|
hmac = { version = "0.12", optional = true }
|
|
sha1 = "0.10"
|
|
urlencoding = { version = "2.1", optional = true }
|
|
secrecy = { version = "0.8", features = ["serde"] }
|
|
|
|
thiserror.workspace = true
|
|
uuid.workspace = true
|
|
sqlx = { workspace = true, features = ["postgres", "chrono", "uuid", "json", "macros"] }
|
|
|
|
rand.workspace = true
|
|
|
|
# Internal workspace crates
|
|
common = { workspace = true, features = ["database"] }
|
|
config = { workspace = true, features = ["postgres"] }
|
|
|
|
# Redis for JWT revocation and rate limiting
|
|
redis = { workspace = true, features = ["tokio-comp", "connection-manager"] }
|
|
|
|
# Kubernetes API client for pod listing
|
|
kube = { version = "3.0", features = ["client", "runtime", "derive"] }
|
|
k8s-openapi = { version = "0.27", features = ["latest"] }
|
|
|
|
# Rate limiting (governor 0.10 dedupes dashmap to v6)
|
|
governor = "0.10"
|
|
dashmap = { workspace = true }
|
|
|
|
# HTTP and networking
|
|
http = "1.1"
|
|
|
|
# Regex for validation
|
|
regex = "1.11"
|
|
|
|
# Circuit breaker for fault tolerance (using tower's timeout + buffer for now)
|
|
# Note: Full circuit breaker can be implemented using tower-layer
|
|
|
|
# TLS crypto provider for kube-rs in-cluster client
|
|
rustls = { version = "0.23", default-features = false, features = ["ring"] }
|
|
|
|
# HTTP server for Prometheus metrics endpoint (workspace pinned to 0.8 to dedupe with tonic)
|
|
axum.workspace = true
|
|
|
|
# gRPC-Web support for browser access
|
|
tonic-web = "0.13"
|
|
tower-http = { workspace = true, features = ["cors"] }
|
|
|
|
[build-dependencies]
|
|
tonic-prost-build.workspace = true
|
|
prost-build.workspace = true
|
|
|
|
[dev-dependencies]
|
|
criterion = { version = "0.5", features = ["html_reports"] }
|
|
tokio-test = "0.4"
|
|
fxt.workspace = true # Required for proto definitions in tests
|
|
|
|
[features]
|
|
default = ["minimal", "mfa"]
|
|
minimal = []
|
|
database = []
|
|
mfa = ["dep:totp-rs", "dep:qrcode", "dep:image", "dep:base32", "dep:hmac", "dep:urlencoding"]
|
|
|
|
[[bench]]
|
|
name = "rate_limiter_bench"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "auth_overhead"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "routing_latency"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "rate_limiting_perf"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "cache_performance"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "throughput"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "revocation_cache_perf"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "authz_dashmap_benchmark"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "dashmap_rate_limiter_bench"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "proxy_latency"
|
|
harness = false
|