nexarch/archive/cmd/moduleadapter-api/main.go

// moduleadapter-api ist der Aufrufpunkt fuer RET-09: startet den bereits
// fertigen archive/internal/moduleadapter.RegisterHandler (RET-05) als
// eigenstaendigen HTTP-Dienst. REINES WIRING — keine Aenderung an
// moduleadapter.go/handler.go, keine neue Logik. RET-13 haengt die
// schreibgeschuetzte Sperrabfrage /legal-hold an denselben Dienst.
package main

import (
	"context"
	"log"
	"net/http"
	"os"

	"github.com/jackc/pgx/v5/pgxpool"

	"gitea.perlbach24.de/scripte/nexarch/archive/internal/legalholdapi"
	"gitea.perlbach24.de/scripte/nexarch/archive/internal/moduleadapter"
	"gitea.perlbach24.de/scripte/nexarch/archive/internal/tenantregistryclient"
	"gitea.perlbach24.de/scripte/nexarch/common/httpharden"
)

func main() {
	dsn := os.Getenv("NEXARCH_MODULEADAPTER_TENANT_DSN")
	if dsn == "" {
		log.Fatal("NEXARCH_MODULEADAPTER_TENANT_DSN muss gesetzt sein")
	}
	addr := os.Getenv("NEXARCH_MODULEADAPTER_API_LISTEN_ADDR")
	if addr == "" {
		addr = "127.0.0.1:8095"
	}
	tenantRegistryURL := os.Getenv("NEXARCH_TENANT_REGISTRY_URL")
	if tenantRegistryURL == "" {
		log.Fatal("NEXARCH_TENANT_REGISTRY_URL muss gesetzt sein")
	}
	tenantRegistryToken := os.Getenv("NEXARCH_TENANT_REGISTRY_SERVICE_TOKEN")

	ctx := context.Background()
	pool, err := pgxpool.New(ctx, dsn)
	if err != nil {
		log.Fatalf("datenbankverbindung: %v", err)
	}
	defer pool.Close()

	verifier := tenantregistryclient.New(tenantRegistryURL, tenantRegistryToken)

	serviceToken := os.Getenv("NEXARCH_MODULEADAPTER_SERVICE_TOKEN")
	allowUnauthenticated := os.Getenv("NEXARCH_MODULEADAPTER_ALLOW_UNAUTHENTICATED") == "true"
	switch {
	case serviceToken != "":
	case allowUnauthenticated:
		log.Print("moduleadapter-api: WARNUNG: NEXARCH_MODULEADAPTER_ALLOW_UNAUTHENTICATED=true, /register und /legal-hold laufen ohne Dienstauthentifizierung")
	default:
		log.Print("moduleadapter-api: NEXARCH_MODULEADAPTER_SERVICE_TOKEN nicht gesetzt, /register und /legal-hold antworten 503")
	}
	callbackPolicy, err := moduleadapter.CallbackPolicyFromEnv(os.Getenv)
	if err != nil {
		log.Fatalf("callback-policy: %v", err)
	}

	mux := http.NewServeMux()
	mux.HandleFunc("/register", moduleadapter.RegisterHandler(pool, verifier, moduleadapter.RegisterConfig{
		ServiceToken:         serviceToken,
		AllowUnauthenticated: allowUnauthenticated,
		Callback:             callbackPolicy,
	}))
	instanceTenant := os.Getenv("NEXARCH_MODULEADAPTER_TENANT_SLUG")
	if instanceTenant == "" {
		log.Print("moduleadapter-api: NEXARCH_MODULEADAPTER_TENANT_SLUG nicht gesetzt, /legal-hold antwortet 503")
	}
	mux.HandleFunc("/legal-hold", legalholdapi.Handler(pool, verifier, legalholdapi.Config{
		InstanceTenant:       instanceTenant,
		ServiceToken:         serviceToken,
		AllowUnauthenticated: allowUnauthenticated,
	}))
	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })

	log.Printf("moduleadapter-api: listening on %s", addr)
	if err := httpharden.ListenAndServe(addr, mux); err != nil {
		log.Fatalf("http server: %v", err)
	}
}