Struct Layout 

pub struct Layout {
    pub state: PathBuf,
    pub repos: PathBuf,
    pub auth: PathBuf,
    pub keys: PathBuf,
    pub log: PathBuf,
    pub tls_marker: PathBuf,
    pub accounts: PathBuf,
    pub acl: PathBuf,
    pub public_url: PathBuf,
    pub port: u16,
}

Where a node’s state lives, by the convention choir init writes.

Fields rather than a lookup, so a caller cannot ask for a path this does not define. The layout is deliberately not configurable file-by-file: a node whose four paths can each point somewhere else is a node whose backup, restore and status commands each need to be told all four, and every one of them is a place to get it wrong.

Fields

state: PathBuf

The state directory itself, ~/.choir unless told otherwise.

repos: PathBuf

Bare repositories; the daemon’s positional root.

auth: PathBuf

user:token, the credential the API checks.

keys: PathBuf

Public keys the node accepts ops from. Without it the platform API stays off and every /api/* read answers 503.

log: PathBuf

Where the daemon’s own log is appended when supervised.

tls_marker: PathBuf

Two lines — certificate path, then key path — when this node terminates TLS itself. Its existence is the switch, the same marker discipline the review and scope gates already use: an empty file and an absent one mean opposite things, and a separate enable-flag beside the file it guards is a pair that can disagree.

accounts: PathBuf

The D36 accounts file. Present means invites can be minted; absent means /api/accounts/invite answers 503.

acl: PathBuf

The D29 per-repository grants. Its existence is the switch, and the daemon refuses an accounts file without one — an issued grant with no table to grade it against is a grant to everything.

public_url: PathBuf

The one URL people outside this machine use, when there is one.

port: u16

The port to bind.

Implementations

impl Layout

pub fn new(state: &Path, port: u16) -> Layout

The standard layout under state.

pub fn tls(&self) -> Option<(PathBuf, PathBuf)>

The certificate and key this node terminates TLS with, if it does.

Read at start time rather than baked into the supervision file, which is what makes renewal a restart rather than a re-render: a certbot deploy hook replaces the two files and restarts the unit, and the unit still says choir node serve.

Anything but two non-empty lines is None. A half-written marker must not become a public bind with no certificate — that is invariant 9 by another route.

pub fn public(&self) -> Option<String>

The public URL, when one was written.

pub fn bind(&self) -> &'static str

The address the daemon should bind.

0.0.0.0 exactly when there is a certificate to present, never otherwise. The daemon refuses the unsafe combination on its own (invariant 9); this side never asks for it, so the refusal is a backstop rather than the mechanism.

pub fn missing(&self) -> Vec<&Path>

What must already exist for a node to start, and does not.

Checked before the daemon is launched so the answer names choir init rather than arriving as whatever the daemon says about a path it could not read. The repository root is not in this list: the daemon creates it, and an empty node is a valid one.