The Sprint NOC API —
Production Deploy

# Database — PostgreSQL on stz-srv-01
DATABASE_URL=postgres://noc_user:CHANGE_ME@localhost:5432/sprint_noc

# JWT — generate with: openssl rand -hex 64
JWT_SECRET=replace_with_64_hex_chars

# Zabbix internal webhook secret (Zabbix → /internal/alerts)
INTERNAL_TOKEN=replace_with_strong_secret

# Server
BIND_ADDR=0.0.0.0:8080
RUST_LOG=sprint_noc_api=info,tower_http=info

use serde::Deserialize;

#[derive(Debug, Deserialize, Clone)]
pub struct Config {
    pub database_url:    String,
    pub jwt_secret:      String,
    pub internal_token:  String,
    #[serde(default = "default_bind")]
    pub bind_addr:       String,
}

fn default_bind() -> String { "0.0.0.0:8080".to_string() }

impl Config {
    pub fn from_env() -> Result<Self, envy::Error> {
        envy::from_env::<Config>()
    }
}

use std::sync::Arc;
use sqlx::postgres::PgPoolOptions;
use tokio::net::TcpListener;
use tokio::sync::broadcast;
use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};

mod auth;
mod config;
mod db;
mod error;
mod models;
mod routes;
mod state;
mod zabbix;

use state::AppState;
use crate::routes::ws::AlertEvent;

#[tokio::main]
async fn main() -> anyhow::Result<()> {
    // ── 1. Config ──────────────────────────────────────────────
    dotenvy::dotenv().ok();  // load .env if present (dev only)
    let cfg = config::Config::from_env()
        .expect("Missing required environment variables");

    // ── 2. Tracing ─────────────────────────────────────────────
    tracing_subscriber::registry()
        .with(tracing_subscriber::fmt::layer())
        .with(tracing_subscriber::EnvFilter::from_default_env())
        .init();

    tracing::info!("Sprint NOC API starting — Kilimanjaro node");

    // ── 3. Database ────────────────────────────────────────────
    let pool = PgPoolOptions::new()
        .max_connections(20)
        .connect(&cfg.database_url).await
        .expect("Failed to connect to PostgreSQL");

    // ── 4. Migrations ──────────────────────────────────────────
    sqlx::migrate!("./migrations")
        .run(&pool).await
        .expect("Failed to run database migrations");

    tracing::info!("Database migrations applied");

    // ── 5. Shared state ────────────────────────────────────────
    let (alert_tx, _) = broadcast::channel::<AlertEvent>(256);
    let state = Arc::new(AppState {
        db:        pool,
        alert_tx:  alert_tx.clone(),
        config:    cfg.clone(),
    });

    // ── 6. Router ──────────────────────────────────────────────
    let app = routes::build_router(state);

    // ── 7. Listen ──────────────────────────────────────────────
    let listener = TcpListener::bind(&cfg.bind_addr).await?;
    tracing::info!("Listening on {}", cfg.bind_addr);

    axum::serve(listener, app).await?;
    Ok(())
}

use axum::{extract::State, http::StatusCode, response::Json};
use serde::Serialize;
use std::sync::Arc;
use crate::state::AppState;

#[derive(Serialize)]
pub struct HealthResponse {
    status:   String,
    database: String,
    version:  String,
}

pub async fn health_handler(
    State(state): State<Arc<AppState>>,
) -> (StatusCode, Json<HealthResponse>) {
    // Probe the DB pool with a trivial query
    let db_ok = sqlx::query("SELECT 1")
        .execute(&state.db)
        .await
        .is_ok();

    let (status, db_str) = if db_ok {
        (StatusCode::OK, "ok".to_string())
    } else {
        (StatusCode::SERVICE_UNAVAILABLE, "unavailable".to_string())
    };

    (status, Json(HealthResponse {
        status:   if db_ok { "ok" } else { "degraded" }.to_string(),
        database: db_str,
        version:  env!("CARGO_PKG_VERSION").to_string(),
    }))
}

use serde::{Deserialize, Serialize};

/// Shape of the JSON Zabbix sends — configure in Media type → Message
#[derive(Debug, Deserialize)]
pub struct ZabbixPayload {
    pub trigger_name:    String,   // e.g. "Host unreachable"
    pub host_name:       String,   // e.g. "stz-sw-kilimanjaro-01"
    pub severity:        String,   // "High", "Disaster", etc.
    pub status:          String,   // "PROBLEM" | "RESOLVED"
    pub event_id:        String,
    pub site:            String,   // custom macro {$SPRINT_SITE}
}

/// Map Zabbix severity → our internal severity
pub fn map_severity(zabbix: &str) -> &'static str {
    match zabbix {
        "Disaster" | "High"   => "critical",
        "Average"             => "warning",
        "Warning" | "Info"   => "info",
        _                     => "info",
    }
}

use axum::{
    extract::State,
    http::{HeaderMap, StatusCode},
    response::Json,
};
use std::sync::Arc;
use crate::{state::AppState, zabbix::webhook::{ZabbixPayload, map_severity}};
use crate::routes::ws::AlertEvent;
use crate::models::alert::CreateAlert;

pub async fn zabbix_webhook(
    headers: HeaderMap,
    State(state): State<Arc<AppState>>,
    Json(payload): Json<ZabbixPayload>,
) -> StatusCode {
    // ── Authenticate Zabbix ────────────────────────────────
    let token = headers
        .get("Authorization")
        .and_then(|v| v.to_str().ok())
        .and_then(|v| v.strip_prefix("Bearer "))
        .unwrap_or("");

    if token != state.config.internal_token {
        return StatusCode::UNAUTHORIZED;
    }

    // ── Determine event type ───────────────────────────────
    let event_type = if payload.status == "RESOLVED" {
        "alert.resolved"
    } else {
        "alert.created"
    };

    let severity = map_severity(&payload.severity).to_string();

    // ── Persist to database ────────────────────────────────
    let alert = crate::db::alerts::create_alert(
        &state.db,
        CreateAlert {
            site:     payload.site.clone(),
            severity: severity.clone(),
            message:  payload.trigger_name.clone(),
        },
    ).await;

    let alert_id = match alert {
        Ok(a)  => a.id.to_string(),
        Err(_) => "unknown".to_string(),
    };

    // ── Broadcast to NOC screens ───────────────────────────
    let _ = state.alert_tx.send(AlertEvent {
        id:       alert_id,
        site:     payload.site,
        severity,
        message:  payload.trigger_name,
        event:    event_type.to_string(),
    });

    StatusCode::OK
}

use axum::{
    routing::{get, post, patch},
    Router,
};
use std::sync::Arc;
use tower_http::{
    cors::{CorsLayer, Any},
    compression::CompressionLayer,
    trace::TraceLayer,
};
use crate::state::AppState;

pub mod alerts;
pub mod auth;
pub mod health;
pub mod internal;
pub mod ws;

pub fn build_router(state: Arc<AppState>) -> Router {
    let api = Router::new()
        .route("/alerts",     get(alerts::list_alerts).post(alerts::create_alert))
        .route("/alerts/:id/resolve", patch(alerts::resolve_alert))
        .route("/auth/login", post(auth::login));

    Router::new()
        // Public health check — no auth
        .route("/health",              get(health::health_handler))
        // Internal webhook — token auth only
        .route("/internal/alerts",    post(internal::zabbix_webhook))
        // WebSocket — authenticated via AuthUser extractor inside handler
        .route("/ws/alerts",           get(ws::ws_handler))
        // REST API — JWT auth enforced per-handler via extractors
        .nest("/api/v1", api)
        // Middleware stack applied to everything
        .layer(TraceLayer::new_for_http())
        .layer(CompressionLayer::new())
        .layer(CorsLayer::new().allow_origin(Any))
        .with_state(state)
}

# ── Stage 1: Builder ───────────────────────────────────────────
FROM rust:1.78-slim-bookworm AS builder

# System deps for sqlx (needs OpenSSL headers for postgres TLS)
RUN apt-get update && apt-get install -y \
    pkg-config libssl-dev \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Cache dependencies before copying source
# Copy manifests first — Docker layer cache reuses this unless Cargo.toml changes
COPY Cargo.toml Cargo.lock ./
RUN mkdir src && echo 'fn main(){}' > src/main.rs
RUN cargo build --release
RUN rm -f target/release/deps/sprint_noc_api*

# Now copy real source and build
COPY src/ src/
COPY migrations/ migrations/
RUN cargo build --release

# ── Stage 2: Runtime ───────────────────────────────────────────
FROM debian:bookworm-slim AS runtime

# Runtime deps only: ca-certificates for TLS to PostgreSQL
RUN apt-get update && apt-get install -y \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Non-root user — never run services as root
RUN useradd -ms /bin/bash sprint
USER sprint
WORKDIR /app

# Copy the compiled binary and migrations from builder
COPY --from=builder /app/target/release/sprint-noc-api ./sprint-noc-api
COPY --from=builder /app/migrations ./migrations

EXPOSE 8080
CMD ["./sprint-noc-api"]

version: '3.9'

services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB:       sprint_noc
      POSTGRES_USER:     noc_user
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - pg_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U noc_user"]
      interval: 5s
      retries: 5

  api:
    build: .
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    ports:
      - "8080:8080"
    environment:
      DATABASE_URL:   postgres://noc_user:${DB_PASSWORD}@db:5432/sprint_noc
      JWT_SECRET:     ${JWT_SECRET}
      INTERNAL_TOKEN: ${INTERNAL_TOKEN}
      RUST_LOG:       sprint_noc_api=info,tower_http=info
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:8080/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 3

volumes:
  pg_data:

[Unit]
Description=Sprint NOC API — SprintTZ Kilimanjaro
After=network.target postgresql.service
Requires=postgresql.service

[Service]
Type=simple
User=sprint
Group=sprint
WorkingDirectory=/opt/sprint-noc-api
ExecStart=/opt/sprint-noc-api/sprint-noc-api

# Load secrets from a file not tracked in git
EnvironmentFile=/etc/sprint-noc-api/env

# Restart policy
Restart=on-failure
RestartSec=5s

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/sprint-noc-api/logs

# Resource limits
LimitNOFILE=65536

# Logging — view with: journalctl -u sprint-noc-api -f
StandardOutput=journal
StandardError=journal
SyslogIdentifier=sprint-noc-api

[Install]
WantedBy=multi-user.target

[package]
name    = "sprint-noc-api"
version = "0.1.0"
edition = "2021"

[dependencies]
# Web framework
axum            = { version = "0.7", features = ["ws"] }
tower           = "0.4"
tower-http      = { version = "0.5", features = ["cors", "compression-gzip", "trace"] }

# Async runtime
tokio           = { version = "1", features = ["full"] }

# Database
sqlx            = { version = "0.7", features = ["postgres", "runtime-tokio-rustls", "uuid", "chrono", "macros"] }

# Auth
jsonwebtoken    = "9"
bcrypt          = "0.15"

# Serialisation
serde           = { version = "1", features = ["derive"] }
serde_json      = "1"

# Config
envy            = "0.4"
dotenvy         = "0.15"   # .env loading in dev

# Error handling
anyhow          = "1"
thiserror       = "1"

# IDs and timestamps
uuid            = { version = "1", features = ["v4", "serde"] }
chrono          = { version = "0.4", features = ["serde"] }

# Logging
tracing         = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }

[profile.release]
opt-level = "z"       # size optimisation — smaller binary for scp
lto = "thin"
codegen-units = 1
strip = "symbols"