Fix and harden client/server configuration #48
Assignees
sjg (Stan Grams)
Clear assignees
sjg (Stan Grams)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: sjg/trx-rs#48
Reference in New Issue
Block a user
Ten fixes to how client and server configuration is defined, loaded, validated
and documented. Each is a separate commit and can be read on its own.
The bugs
The setup wizard produced configs no binary could load.
trx-configurator --type serverwrote[general]/[rig]at the document root while the loaderdemanded a
[trx-server]section header:The loader now accepts both shapes, the wizard emits the sectioned one, and
round-trip tests push every document it can generate through the real loader.
Misspelled keys were dropped in silence. Every config struct is
#[serde(default)], soprot = 9999under[listen]started the server on4530 without a word. Ignored keys are now collected and reported with a
suggestion;
--strict-configmakes them fatal.[[rigs]]entries were barely validated.validate()checked only the flatlegacy fields, and
validate_sdr()returned early unless the flat access typewas
"sdr"— so a multi-rig SDR station got no Nyquist,stream_opus,duplicate-decoder or
tx_enabledchecking at all.Nothing checked per-rig map keys or port collisions.
rigctl.rig_portsandfriends are keyed by remote short name; a typo spawned a listener routing to a
rig that did not exist.
[listen].portand a rig's[audio].portcould both be4530.
The additions
--check-configon both binaries: reports every problem at once, exits 0/1.[decoders]per rig: nine decoders used to start unconditionally per rigwhether or not anyone looked at the results.
enableddefaults to all ofthem, so upgrading changes nothing;
output_dirreplaces the hard-codedcache paths for SSTV/WEFAX/LRPT.
${VAR}expansion (an unset variable is anerror, not a silently blank passphrase) and a
*_filesibling for everycredential, plus a warning when a config holding secrets is group-readable.
do, keyed off which paths the file actually set so defaults never warn.
Structural change
ServerConfig,ClientConfig, the loader and the validators move into a newtrx-configcrate shared by the server, client and wizard. The wizard used tocarry a second implementation — hand-maintained lists of known keys plus
re-implemented range checks — which passed configs the binaries reject; it now
defers entirely to the real code.
trx-rs.toml.exampleis generated from thestructs with a test that fails when the checked-in copy drifts.
Documentation
The manual was wrong about the basics: it listed five config search paths, none
of which the loader has ever consulted, called
--print-configoutput "fullycommented" when it carries no comments, and documented a
TRX_PLUGIN_DIRSvariable no code reads. Corrected, along with the client tables that still
described
[frontends.rigctl].portas the bind port years afterrig_portsreplaced it.
Verification
863 tests pass, clippy is clean across the workspace, and the release build
succeeds. Behaviour changes were checked against the running binaries: the
typo warning, both file shapes, port-collision detection, decoder gating
(9 decoders by default, 2 with
enabled = ["cw", "ft8"]), env expansion,*_filesecrets, the permission warning, and every deprecation message.🤖 Generated with Claude Code
https://claude.ai/code/session_01SyX26FCpMQxiBoC7r5K1A7
trx-configurator wrote standalone configs with [general]/[rig] at the root while the loader required a [trx-server] section header, so every config the wizard generated with --type server or --type client was rejected by the binary it was generated for: $ trx-server --config trx-server.toml Error: ParseError("trx-server.toml", "missing [trx-server] section") Teach the loader to fall back to the document root when no section header is present, so hand-written standalone files keep working, and have the wizard emit the same sectioned shape --print-config does. A file carrying only the *other* component's section still reports the missing section rather than silently loading defaults. Round-trip tests now load every document the wizard can generate through the real loader and validator. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SyX26FCpMQxiBoC7r5K1A7 Signed-off-by: Stan Grams <sjg@haxx.space>Every config struct is #[serde(default)], so a misspelled key was dropped in silence and the setting kept its default. Writing `prot = 9999` under [listen] started the server on 4530 without a word. Collect the ignored key paths with serde_ignored and pair each with the closest known key at the same level: WARN unknown config key 'listen.prot' (did you mean 'listen.port'?) Warnings by default, so a config written for a newer version still runs on an older binary; --strict-config makes them fatal for CI. Logging now starts before validation so these warnings are actually visible. trx-configurator --check drops its hand-maintained key lists and re-implemented range checks in favour of the real loader and validators, so it no longer passes configs the binaries reject. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SyX26FCpMQxiBoC7r5K1A7 Signed-off-by: Stan Grams <sjg@haxx.space>Validating a config meant starting the daemon and reading the first error it died on, fixing that, and repeating. Add --check-config, which loads the config through the real loader, reports every problem at once and exits 0/1: $ trx-server --check-config --config trx-rs.toml trx-rs.toml warning: unknown config key 'listen.prot' (did you mean 'listen.port'?) error: [general].log_level 'verbose' is invalid (expected one of: ...) error: [rig.access].baud must be > 0 for serial access error: [audio].frame_duration_ms must be one of: 3, 5, 10, 20, 40, 60 error: [listen] and rig "default" [audio] would both bind 127.0.0.1:4530 Validation grows validate_all()/validate_resolved_all() alongside the existing first-error entry points; validate() is now the first element of validate_all(). Sockets are built by one helper shared by startup and the check, so the two cannot disagree about what --listen overrides. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SyX26FCpMQxiBoC7r5K1A7 Signed-off-by: Stan Grams <sjg@haxx.space>Every rig started nine decoders — APRS, HF APRS, CW, FT8, FT4, WSPR, LRPT, WEFAX, SSTV — whether or not anyone ever looked at the results. Two rigs on a Pi meant eighteen decoder tasks chewing CPU for modes the operator does not run. Only the SDR virtual channels had a decoder list; the analog path had no say at all. Add [decoders] per rig: [decoders] enabled = ["cw", "ft8", "wspr"] output_dir = "/var/lib/trx-rs" using the same decoder names as [sdr.channels].decoders, so there is one vocabulary. enabled defaults to every decoder, so upgrading changes nothing. An unknown name is a config error rather than a silently ignored entry. output_dir also replaces the hard-coded cache paths for the decoders that write images, so SSTV, WEFAX and LRPT output can live somewhere the operator chooses. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SyX26FCpMQxiBoC7r5K1A7 Signed-off-by: Stan Grams <sjg@haxx.space>Tokens and passphrases had exactly one representation: plain text in trx-rs.toml. That is awkward for config-management tools, for a config kept in a private repo, and for anything shared between machines. Two alternatives: - ${VAR} anywhere in a config string, expanded from the environment at load. An unset variable is an error rather than an empty string — a silently blank passphrase is how authentication gets disabled by accident. - A *_file sibling for every credential: [listen.auth].tokens_file, [[remotes]].auth.token_file, [frontends.http.auth].rx_passphrase_file and .control_passphrase_file, [frontends.http_json.auth].tokens_file. Setting both forms is an error rather than a guess about which wins. Plus a nudge: a config file that holds credentials inline and is readable by group or others gets a warning naming the chmod that fixes it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SyX26FCpMQxiBoC7r5K1A7 Signed-off-by: Stan Grams <sjg@haxx.space>trx-rs.toml.example was maintained by hand and had fallen well behind: no [[rigs]], no [[remotes]], no [timeouts], no bandplan or decode-history settings, and a [frontends.http].default_rig_id that had been renamed. Generate it from the config structs instead, so a new field shows up the moment it exists, and add a test that fails when the checked-in copy drifts: cargo run -p trx-config --example generate_example Section comments come from a small table; a section without an entry is still emitted, so forgetting a comment can never drop a setting from the example. The manual was wrong about the basics. It listed five config search paths, none of which the loader has ever looked at (the real order is ./trx-rs.toml → XDG → /etc), called --print-config output "fully commented" when it carries no comments at all, and documented a TRX_PLUGIN_DIRS variable no code reads. It also still described [frontends.rigctl].port as the bind port years after rig_ports replaced it. Fixed, and the new configuration features are written up alongside. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SyX26FCpMQxiBoC7r5K1A7 Signed-off-by: Stan Grams <sjg@haxx.space>