api: allow listening to Unix sockets

1 files changed, 16 insertions, 10 deletions

diff --git a/src/config/mod.rs b/src/config/mod.rs
index 527dced..a1011ee 100644
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -90,10 +90,10 @@ pub(crate) const FORCE: &[&str] = &["swarmId", "badDocumentFile", "replaceDocume
 pub(crate) const OPTIONS: &[OptionSpec] = &[
     option(
         "bind-addr",
-        Kind::Text,
-        "HOSTNAME:PORT",
+        Kind::List,
+        "ADDRESS:PORT|unix:PATH,[...]",
         Some("127.0.0.1:3000"),
-        "Address of the HTTP API.",
+        "Where the HTTP API listens: TCP addresses, and Unix sockets (unix:PATH, made readable and writable by the node's user and group only), as many as given.",
     ),
     option(
         "htpasswd",
@@ -113,8 +113,8 @@ pub(crate) const OPTIONS: &[OptionSpec] = &[
         "trusted-proxies",
         Kind::List,
         "ADDRESS,[ADDRESS...]",
-        Some("127.0.0.1,::1"),
-        "Addresses (an IP address, or a range as ADDRESS/BITS) of the reverse proxies whose user-header is believed.",
+        Some("127.0.0.1,::1,unix"),
+        "Where the reverse proxies whose user-header is believed connect from: IP addresses (or ranges, as ADDRESS/BITS), and unix for the API's Unix sockets (bind-addr). On a host with other users, leave out the addresses and have the proxy use a Unix socket: others can connect over loopback too.",
     ),
     option(
         "protocol-writers",
@@ -501,8 +501,11 @@ pub(crate) fn spec(name: &str) -> Option<&'static OptionSpec> {
 #[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(rename_all = "kebab-case", deny_unknown_fields)]
 pub(crate) struct Settings {
-    #[serde(default = "default_bind_addr")]
-    pub(crate) bind_addr: SocketAddr,
+    #[serde(
+        default = "default_bind_addr",
+        deserialize_with = "crate::api::listen::one_or_more"
+    )]
+    pub(crate) bind_addr: Vec<crate::api::listen::Bind>,
     /// Required (`check`), but with `user_header` or `relay_only`.
     pub(crate) htpasswd: Option<String>,
     pub(crate) user_header: Option<String>,
@@ -643,11 +646,14 @@ pub(crate) struct Settings {
     pub(crate) debug_epoch: Option<u64>,
 }
 
-fn default_bind_addr() -> SocketAddr {
-    SocketAddr::from(([127, 0, 0, 1], 3000))
+fn default_bind_addr() -> Vec<crate::api::listen::Bind> {
+    vec![crate::api::listen::Bind::Tcp(SocketAddr::from((
+        [127, 0, 0, 1],
+        3000,
+    )))]
 }
 fn default_trusted_proxies() -> Vec<String> {
-    vec!["127.0.0.1".to_owned(), "::1".to_owned()]
+    vec!["127.0.0.1".to_owned(), "::1".to_owned(), "unix".to_owned()]
 }
 fn default_document_append() -> Duration {
     Duration::from_secs(5)