Files

jgrusewski 2da5bafc0e refactor: rename tli→fxt, delete legacy scripts/RunPod/deploy artifacts

- Rename tli/ directory to fxt/, update package + binary name to "fxt"
- Replace all `use tli::` → `use fxt::` across 52 Rust files
- Update build.rs proto paths (tli/proto → fxt/proto) in 6 services
- Update Dockerfiles, CI workflows, deploy.sh for new paths
- Delete ~170 legacy shell scripts (kept 15 essential ones)
- Delete RunPod Python client (runpod/), tests (tests/runpod/)
- Delete foxhunt-deploy crate (RunPod-only deployment tool)
- Delete terraform/runpod/ (moved to Scaleway)
- Delete ML Python hyperopt scripts (replaced by Rust Argmin PSO)
- Delete .gitlab-ci.yml (using GitHub + Gitea)
- Remove foxhunt-deploy from workspace members

504 files changed, -74,355 lines of legacy code removed.
Workspace compiles clean (0 errors, 0 warnings).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-24 10:32:21 +01:00

src

fix(web-gateway): use TCP peer address for rate limiting instead of X-Forwarded-For

2026-02-23 23:25:05 +01:00

build.rs

refactor: rename tli→fxt, delete legacy scripts/RunPod/deploy artifacts

2026-02-24 10:32:21 +01:00

Cargo.toml

feat(web-gateway): scaffold Axum REST gateway with all route modules

2026-02-22 00:18:18 +01:00

README.md

docs: rewrite outdated READMEs and add web-gateway docs

2026-02-22 18:39:12 +01:00

README.md

web-gateway

REST and WebSocket gateway for the Foxhunt web dashboard. Built with Axum 0.7.9, it proxies HTTP requests to backend gRPC services and bridges gRPC streams to WebSocket clients.

Configuration

All settings are read from environment variables.

Variable	Default	Description
`GATEWAY_LISTEN_ADDR`	`0.0.0.0:3000`	HTTP listen address
`JWT_SECRET`	(required, min 32 chars)	HMAC key for JWT validation
`CORS_ORIGINS`	`http://localhost:5173`	Comma-separated allowed origins
`TRADING_SERVICE_URL`	`https://localhost:50051`	Trading gRPC upstream
`BACKTESTING_SERVICE_URL`	`https://localhost:50052`	Backtesting gRPC upstream
`ML_TRAINING_SERVICE_URL`	`https://localhost:50053`	ML training gRPC upstream

Routes

All API routes are under /api. Authentication is required unless noted.

Tier	Rate Limit	Endpoints
Public	10 req/min	`POST /api/auth/login`
Trading	200 req/min	`/api/trading/`, `/api/risk/`, `/api/ml/`, `/api/performance/`, `/api/config/*`
Compute	30 req/min	`/api/training/`, `/api/backtest/`, `/api/tune/*`
WebSocket	50 msg/min	`GET /api/ws` (JWT via `token` query param)
Health	none	`GET /health`, `GET /ready`

Security

JWT authentication middleware (32-character minimum secret enforced at startup)
Per-IP rate limiting across three tiers
1 MB request body size limit
CORS with explicit methods (GET, POST, PUT, DELETE) and headers (Authorization, Content-Type)
Response headers: HSTS, x-frame-options: DENY, x-content-type-options: nosniff, referrer-policy: strict-origin-when-cross-origin
WebSocket topic whitelist (8 valid topics), per-connection rate limit, max 20 subscriptions
X-Request-Id propagation (generated if absent, echoed on response)

Modules

Module	Purpose
`auth`	JWT validation and login handler
`config`	`GatewayConfig` loaded from environment
`error`	Unified error types and HTTP error responses
`grpc`	Tonic clients and gRPC stream bridges
`rate_limit`	Per-IP token-bucket rate limiter (3 tiers)
`routes`	Axum router construction and all HTTP handlers
`state`	`AppState` (gRPC channels, WS broadcast, config)
`ws`	WebSocket upgrade, topic subscriptions, keepalive

Running

export JWT_SECRET="your-secret-at-least-32-characters-long"
cargo run -p web-gateway