Rust migration

.dockerignore

@@ -56,3 +56,8 @@ web-client/.env.local
 target
 gateway-rs/target
 release-evidence
+
+# Regenerated by local TypeScript/Next builds; excluding them keeps the image ID
+# stable between the system E2E and release builds of the same source.
+**/*.tsbuildinfo
+web-client/next-env.d.ts

.env.example

@@ -84,6 +84,15 @@ AUTH_REFRESH_EXPIRE_FREQ=days
 # after placing the service behind a TLS-terminating reverse proxy.
 HTTPS_ONLY=false
 
+# Keep proxy for existing reverse-proxy deployments. Native terminates TLS in the Rust gateway.
+# Native mode requires both PEM files and refuses to start if they are invalid.
+DOWNSTREAM_TLS_MODE=proxy
+# DOWNSTREAM_TLS_CERT_FILE=/run/secrets/doorman/tls.crt
+# DOWNSTREAM_TLS_KEY_FILE=/run/secrets/doorman/tls.key
+# TLS_PROFILES_FILE=/run/secrets/doorman/tls-profiles.yaml
+# Base64 of exactly 32 random bytes; required for admin-uploaded TLS material on every node.
+# TLS_SECRET_ENCRYPTION_KEY=
+
 # COOKIE_DOMAIN: Base domain for authentication cookies
 # - If set: Cookies sent WITH domain attribute for subdomain sharing (e.g., *.example.com)
 # - Also sent WITHOUT domain attribute for exact domain match (dual-cookie strategy)
@@ -127,7 +136,9 @@ DISCOVERY_ALLOWED_HOSTS=
 # Optional: Custom Content Security Policy (defaults to restrictive policy)
 # CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self' 'unsafe-inline'
 
-# HTTP Client Connection Pooling (httpx)
+# Upstream HTTP connection pooling
+# (HTTP_MAX_CONNECTIONS is a legacy Python total cap and is ignored by the Rust gateway;
+#  HTTP_MAX_KEEPALIVE bounds idle connections per upstream host)
 ENABLE_HTTPX_CLIENT_CACHE=true
 HTTP_MAX_CONNECTIONS=100
 HTTP_MAX_KEEPALIVE=50
@@ -137,8 +148,8 @@ HTTP_KEEPALIVE_EXPIRY=30.0
 # CRITICAL: Adjust these based on expected upstream response times
 HTTP_CONNECT_TIMEOUT=5.0   # Time to establish connection (5s recommended)
 HTTP_READ_TIMEOUT=30.0      # Time to read response body (30s default, increase for slow APIs)
-HTTP_WRITE_TIMEOUT=30.0     # Time to send request body (30s default)
-HTTP_TIMEOUT=30.0           # Connection pool timeout (time to acquire connection)
+HTTP_WRITE_TIMEOUT=30.0     # Legacy Python write timeout (ignored by the Rust gateway)
+HTTP_TIMEOUT=30.0           # Legacy Python pool-acquire timeout (ignored by the Rust gateway)
 # Note: Timeout errors return 504 Gateway Timeout to clients
 
 # Enable HTTP/2 (default: false)
@@ -157,7 +168,7 @@ LOCAL_HOST_IP_BYPASS=false
 
 # Advanced compatibility toggles (for CI/Python 3.13 environments)
 # Set to 'true' only if you experience middleware/ASGI issues during tests.
-# - DISABLE_PLATFORM_CHUNKED_WRAP: skip low-level chunked-body wrapping on /platform/*
+# - DISABLE_PLATFORM_CHUNKED_WRAP: legacy Python ASGI toggle; ignored by the Rust gateway
 # - DISABLE_PLATFORM_CORS_ASGI: bypass ASGI CORS shim for /platform/*
 # - DISABLE_BODY_SIZE_LIMIT: disable body-size limit middleware entirely
 DISABLE_PLATFORM_CHUNKED_WRAP=false
@@ -204,6 +215,8 @@ COMPRESSION_MINIMUM_SIZE=500
 COMPRESSION_LEVEL=1
 
 # Logging
+# Set false to disable stored request/audit logs and the Logs UI.
+LOGS_ENABLED=true
 # Format: json or plain
 LOG_FORMAT=plain
 # Optional: custom logs directory (defaults to logs)
@@ -227,5 +240,5 @@ PID_FILE=doorman.pid
 #   - Separate API domain: https://api.yourdomain.com
 NEXT_PUBLIC_GATEWAY_URL=http://localhost:3001
 
-# Uses gql.Client when this flag is true and an AIOHTTPTransport is importable
+# Legacy Python gql.Client toggle; the Rust gateway always proxies GraphQL over HTTP
 DOORMAN_ENABLE_GQL_CLIENT=True

.github/workflows/ci.yml

@@ -36,6 +36,8 @@ jobs:
           python3 scripts/check_parity_reference.py
       - name: Verify Python-to-Rust test coverage ledger
         run: python3 scripts/generate_test_coverage_ledger.py --check
+      - name: Verify Python-to-Rust source coverage ledger
+        run: python3 scripts/generate_source_coverage_ledger.py --check
       - name: Test release tooling
         run: python3 -m unittest discover -s scripts -p 'test_*.py'
       - name: Run Clippy

Makefile

@@ -6,18 +6,21 @@ ADMIN_PASSWORD ?= $(shell grep '^DOORMAN_ADMIN_PASSWORD=' .env 2>/dev/null | cut
 BASE_URL ?= http://localhost:$(PORT)
 GATEWAY_LOAD_BASE_URL ?= http://localhost:3001
 
-.PHONY: check test unit unitq rust-test rust-clippy rust-fmt-check web-audit web-build parity parity-reference parity-ledger parity-contracts parity-differential parity-performance release-check local-e2e test-e2e release-e2e e2e-plan system-e2e-smoke system-e2e system-e2e-soak system-e2e-plan system-e2e-check system-e2e-clean test-live-tcp smoke preflight live liveq gateway-load external-storage-test clean clean-deep
+.PHONY: check test unit unitq rust-test rust-clippy rust-fmt-check web-audit web-build parity parity-reference parity-ledger parity-source-ledger parity-contracts parity-differential parity-performance release-check local-e2e test-e2e release-e2e e2e-plan system-e2e-smoke system-e2e system-e2e-soak system-e2e-plan system-e2e-check system-e2e-clean test-live-tcp smoke preflight live liveq gateway-load external-storage-test clean clean-deep
 
 check: rust-fmt-check rust-clippy test
 
-parity: parity-reference parity-ledger parity-contracts
+parity: parity-reference parity-ledger parity-source-ledger parity-contracts
 
 parity-reference:
 	python3 scripts/check_parity_reference.py
 
 parity-ledger:
 	python3 scripts/generate_test_coverage_ledger.py --check
 
+parity-source-ledger:
+	python3 scripts/generate_source_coverage_ledger.py --check
+
 parity-contracts:
 	cargo test --manifest-path gateway-rs/Cargo.toml --locked --test parity_contracts --test openapi_parity --test auth_rate_parity
 
@@ -82,7 +85,7 @@ web-build:
 	npm --prefix web-client run build
 
 web-audit:
-	npm --prefix web-client audit --omit=dev --audit-level=high
+	npm --prefix web-client audit --omit=dev --audit-level=moderate
 
 smoke preflight live liveq:
 	BASE_URL=$(BASE_URL) \

docker-compose.yml

@@ -34,6 +34,7 @@ services:
       MEM_AUTO_SAVE_FREQ: ${MEM_AUTO_SAVE_FREQ:-300}
       PYTHONINTMAXSTRDIGITS: ${PYTHONINTMAXSTRDIGITS:-4300}
       MEM_ENCRYPTION_KEY: ${MEM_ENCRYPTION_KEY:-}
+      LOGS_ENABLED: ${LOGS_ENABLED:-true}
       LOGS_DIR: /app/logs
     volumes:
       - doorman-generated:/app/data