Module server

Server entry point: agentguard-server.

Callers that need to embed the server in their own binary should use run directly. The binary in bin/agentguard-server.rs parses CLI args and constructs a ServerConfig from them.

The previous make_run and config_from_env helpers were dead code — they were not called by any caller in the workspace. Removed in v0.2.0 as a deliberate API cleanup. External users who relied on them should inline the equivalent at the call site:

use agentguard_server::{run, ServerConfig};
use agentguard_server::listener::Listener;
let cfg = ServerConfig {
    listener: Listener::Tcp("127.0.0.1:8443".parse().unwrap()),
    store_root: ".agentguard".into(),
    audit_log: Some(".audit/decisions.jsonl".into()),
    chain_secret: None,
};
agentguard_server::run(cfg).await?;

Traits

ReloadSink

Minimal sink the watcher needs from app state. Implemented by AppState so tests can pass a fake.

Functions

build_router

Build a ready-to-serve Router from the config. Exposed for tests and embedders that want to run the AuthZEN app inside their own hyper server.

run

Run the server. Returns when the listener stops (e.g. on SIGTERM/SIGINT). In-flight requests are allowed to complete before the process exits.

shutdown_signal_with_sighup

Block until SIGINT or SIGTERM is received. SIGHUP is handled inline: each received SIGHUP triggers an immediate policy snapshot reload so operators can force a refresh without touching the filesystem. The loop is iterative (no recursion) so multiple SIGHUPs don’t grow the stack.

spawn_api_key_watcher

Poll the API-key file contents and reload complete snapshots after projected-secret updates or atomic CLI writes. Kubernetes updates Secret volumes by swapping symlinks, which is not consistently reported by directory watchers across filesystems. Invalid snapshots retain the current key set; a later distinct file snapshot is retried.

spawn_policy_watcher

Best-effort compatibility wrapper for callers that want watcher setup failures logged asynchronously instead of returned.

try_spawn_policy_watcher

Start the policy hot-reload watcher, returning an error if its filesystem watch cannot be initialized. The task polls every 500 ms and reloads on relevant policy/schema changes.