systeminit · johnrwatson · May 9, 2025 · May 12, 2025 · May 15, 2025
diff --git a/Cargo.toml b/Cargo.toml
@@ -4,6 +4,7 @@ debug = true
 [workspace]
 resolver = "2"
 members = [
+    "bin/bedrock",
     "bin/cyclone",
     "bin/edda",
     "bin/forklift",
@@ -21,6 +22,7 @@ members = [
     "lib/audit-database",
     "lib/audit-logs-stream",
     "lib/auth-api-client",
+    "lib/bedrock-server",
     "lib/billing-events",
     "lib/buck2-resources",
     "lib/bytes-lines-codec",

diff --git a/bin/bedrock/BUCK b/bin/bedrock/BUCK
@@ -0,0 +1,18 @@
+load(
+    "@prelude-si//:macros.bzl",
+    "rust_binary",
+)
+
+rust_binary(
+    name = "bedrock",
+    deps = [
+        "//lib/bedrock-server:bedrock-server",
+        "//lib/si-service:si-service",
+        "//third-party/rust:clap",
+    ],
+    srcs = glob(["src/**/*.rs"]),
+    env = {"CARGO_BIN_NAME": "bedrock"},
+    resources = {
+        "ca.dev.pem": "//dev:minica.pem",
+    }
+)
diff --git a/bin/bedrock/Cargo.toml b/bin/bedrock/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "bedrock"
+version.workspace = true
+authors.workspace = true
+license.workspace = true
+repository.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+publish.workspace = true
+
+[dependencies]
+clap = { workspace = true }
+bedrock-server = { path = "../../lib/bedrock-server" }
+si-service = { path = "../../lib/si-service" }
diff --git a/bin/bedrock/src/args.rs b/bin/bedrock/src/args.rs
@@ -0,0 +1,118 @@
+use std::path::PathBuf;
+
+use clap::{
+    ArgAction,
+    Parser,
+};
+use bedrock_server::{
+    Config,
+    ConfigError,
+    ConfigFile,
+    StandardConfigFile,
+};
+use si_service::prelude::*;
+
+const NAME: &str = "bedrock";
+
+pub(crate) fn parse() -> Args {
+    Args::parse()
+}
+
+#[derive(Parser, Debug)]
+#[command(name = NAME, max_term_width = 100)]
+pub(crate) struct Args {
+    /// Sets the verbosity mode.
+    ///
+    /// Multiple -v options increase verbosity. The maximum is 6.
+    #[arg(short = 'v', long = "verbose", action = ArgAction::Count)]
+    pub(crate) verbose: u8,
+
+    /// Disables ANSI coloring in log output, even if standard output refers to a terminal/TTY.
+    ///
+    /// For more details, visit: <http://no-color.org/>.
+    #[arg(
+        long = "no-color",
+        default_value = "false",
+        env = "SI_NO_COLOR",
+        hide_env_values = true,
+        conflicts_with = "force_color"
+    )]
+    pub(crate) no_color: bool,
+
+    /// Forces ANSI coloring, even if standard output refers to a terminal/TTY.
+    ///
+    /// For more details, visit: <http://no-color.org/>.
+    #[arg(
+        long = "force-color",
+        default_value = "false",
+        env = "SI_FORCE_COLOR",
+        hide_env_values = true,
+        conflicts_with = "no_color"
+    )]
+    pub(crate) force_color: bool,
+
+    /// Prints telemetry logging as JSON lines.
+    ///
+    /// For more details, visit: <https://jsonlines.org/>.
+    #[arg(
+        long = "log-json",
+        default_value = "false",
+        env = "SI_LOG_JSON",
+        hide_env_values = true
+    )]
+    pub(crate) log_json: bool,
+
+    /// The address and port to bind the HTTP server to [example: 0.0.0.0:80]
+    #[arg(long, env)]
+    pub(crate) socket_addr: Option<String>,
+
+    // Section for NATS configuration
+    /// NATS connection URL [example: demo.nats.io]
+    #[arg(long)]
+    pub(crate) nats_url: Option<String>,
+
+    /// NATS credentials string
+    #[arg(long, allow_hyphen_values = true)]
+    pub(crate) nats_creds: Option<SensitiveString>,
+
+    /// NATS credentials file
+    #[arg(long)]
+    pub(crate) nats_creds_path: Option<PathBuf>,
+
+
+}
+
+impl TryFrom<Args> for Config {
+    type Error = ConfigError;
+
+    fn try_from(args: Args) -> Result<Self, Self::Error> {
+        ConfigFile::layered_load(NAME, |config_map| {
+            // For the application itself
+            if let Some(socket_addr) = args.socket_addr {
+                config_map.set("socket_addr", socket_addr);
+            }
+            // For NATS
+            if let Some(url) = args.nats_url {
+                config_map.set("nats.url", url.clone());
+            }
+            if let Some(creds) = args.nats_creds {
+                config_map.set("nats.creds", creds.to_string());
+            }
+            if let Some(creds_path) = args.nats_creds_path {
+                config_map.set("nats.creds_file", creds_path.display().to_string());
+            }
+        })?
+        .try_into()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn verify_command() {
+        use clap::CommandFactory;
+        Args::command().debug_assert()
+    }
+}
diff --git a/bin/bedrock/src/main.rs b/bin/bedrock/src/main.rs
@@ -0,0 +1,104 @@
+use std::time::Duration;
+
+use color_eyre::Result;
+use bedrock_server::{
+    Config,
+    Server,
+};
+use si_service::{
+    color_eyre,
+    prelude::*,
+    rt,
+    startup,
+    telemetry_application::{
+        self,
+        TelemetryShutdownGuard,
+    },
+};
+
+mod args;
+
+const BIN_NAME: &str = env!("CARGO_BIN_NAME");
+const LIB_NAME: &str = concat!(env!("CARGO_BIN_NAME"), "_server");
+
+const GRACEFUL_SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(60 * 10);
+
+fn main() -> Result<()> {
+    rt::block_on(BIN_NAME, async_main())
+}
+
+async fn async_main() -> Result<()> {
+    let main_tracker = TaskTracker::new();
+    let main_token = CancellationToken::new();
+    let telemetry_tracker = TaskTracker::new();
+    let telemetry_token = CancellationToken::new();
+
+    color_eyre::install()?;
+    let args = args::parse();
+    let (mut telemetry, telemetry_shutdown) = {
+        let config = TelemetryConfig::builder()
+            .force_color(args.force_color.then_some(true))
+            .no_color(args.no_color.then_some(true))
+            .console_log_format(
+                args.log_json
+                    .then_some(ConsoleLogFormat::Json)
+                    .unwrap_or_default(),
+            )
+            .service_name(BIN_NAME)
+            .service_namespace("si")
+            .log_env_var_prefix("SI")
+            .app_modules(vec![BIN_NAME, LIB_NAME])
+            .interesting_modules(vec![])
+            .build()?;
+
+        telemetry_application::init(config, &telemetry_tracker, telemetry_token.clone())?
+    };
+
+    startup::startup(BIN_NAME).await?;
+
+    if args.verbose > 0 {
+        telemetry
+       
10000
     .set_verbosity_and_wait(args.verbose.into())
+            .await?;
+    }
+    debug!(arguments =?args, "parsed cli arguments");
+
+    let config = Config::try_from(args)?;
+    debug!(?config, "computed configuration");
+    run_server(
+        config,
+        main_tracker,
+        main_token,
+        telemetry_tracker,
+        telemetry_token,
+        telemetry_shutdown,
+    )
+    .await
+}
+
+#[inline]
+#[allow(clippy::too_many_arguments)]
+async fn run_server(
+    config: Config,
+    main_tracker: TaskTracker,
+    main_token: CancellationToken,
+    telemetry_tracker: TaskTracker,
+    telemetry_token: CancellationToken,
+    telemetry_shutdown: TelemetryShutdownGuard,
+) -> Result<()> {
+    let server = Server::http(config, main_token.clone()).await?;
+
+    main_tracker.spawn(async move {
+        info!("ready to receive requests");
+        server.run().await
+    });
+
+    shutdown::graceful()
+        .group(main_tracker, main_token)
+        .group(telemetry_tracker, telemetry_token)
+        .telemetry_guard(telemetry_shutdown.into_future())
+        .timeout(GRACEFUL_SHUTDOWN_TIMEOUT)
+        .wait()
+        .await
+        .map_err(Into::into)
+}
diff --git a/component/postgres/postgresql-additions.conf b/component/postgres/postgresql-additions.conf
@@ -3,7 +3,7 @@ wal_buffers = 64MB
 effective_cache_size = 32GB
 work_mem = 64MB
 
-max_connections = 600
+max_connections = 5000
 
 shared_preload_libraries = 'pg_stat_statements,auto_explain'
 

diff --git a/component/toolbox/Dockerfile b/component/toolbox/Dockerfile
@@ -18,17 +18,36 @@ RUN curl -sL https://github.com/nats-io/natscli/releases/download/v0.2.1/nats-0.
     mkdir -p /nats-bin && \
     mv /tmp/nats-0.2.1-linux-amd64/nats /nats-bin/
 
+FROM alpine:latest AS zed-builder
+
+ENV ZED_VERSION=0.30.2
+RUN apk add --no-cache curl tar
+
+# Determine architecture and download correct zed binary
+RUN ARCH=$(uname -m) && \
+    case "$ARCH" in \
+        x86_64) ARCH_ID=amd64 ;; \
+        aarch64) ARCH_ID=arm64 ;; \
+        *) echo "Unsupported architecture: $ARCH" && exit 1 ;; \
+    esac && \
+    echo "Detected arch: $ARCH -> $ARCH_ID" && \
+    ZED_URL="https://github.com/authzed/zed/releases/download/v${ZED_VERSION}/zed_${ZED_VERSION}_linux_${ARCH_ID}_musl.tar.gz" && \
+    curl -sL "$ZED_URL" -o /tmp/zed.tar.gz && \
+    tar -xzf /tmp/zed.tar.gz -C /usr/local/bin zed && \
+    chmod +x /usr/local/bin/zed && \
+    zed version
+
 FROM alpine
 
 RUN set -eux; \
-    apk add --no-cache jq aws-cli bash \
-    rm -rf /var/cache/apk/*
+    apk add --no-cache jq aws-cli bash
 
 COPY ./scripts/ /usr/local/bin/si/
 RUN chmod +x /usr/local/bin/si/*
 
 COPY --from=ssm-builder /go/src/github.com/session-manager-plugin/bin/linux_amd64_plugin/session-manager-plugin /usr/local/bin/
 COPY --from=nats-builder /nats-bin/nats /usr/local/bin/nats
+COPY --from=zed-builder /usr/local/bin/zed /usr/local/bin/zed
 
 ENV PATH="/usr/local/bin/si:${PATH}"