{"item":{"uri":"at://did:plc:bcgltzqazw5tb6k2g3ttenbj/dev.knotless.pull/3mza7mqh2ofzo","kind":"pull","title":"grain-serve is set by flags, as knotless-serve is","state":"closed","author":{"did":"did:plc:bcgltzqazw5tb6k2g3ttenbj","handle":"chadtmiller.com","avatar":"https://cdn.bsky.app/img/avatar/plain/did:plc:bcgltzqazw5tb6k2g3ttenbj/bafkreig5bcb7dl7aphw6eg4e7kjkvpdshfexdvk7jldg53ypre6ecdhesu@jpeg"},"createdAt":"2026-11-01T06:46:59.516Z","comments":3},"body":"## What changes\n\n**grain-serve is set by flags, as knotless-serve is.** Where it listens,\nits index, its public URL, the Jetstream it follows, backfill, the CDN's\naddress, the Bluesky appview, the sign-up PDS, how long old cookies carry,\nand the non-secret parts of push and Clef are each a `--flag` with a value\n(`grain_serve::FLAGS`, `grain_serve::USAGE`), and a flag given empty is as\nif not given, so a compose file can pass `--jetstream \"${GRAIN_JETSTREAM:-}\"`\nand turn a part off by leaving the variable unset. A flag it does not take,\nor one with no value, exits 2 with the usage, as knotless-serve does.\n\n| was | is |\n| ------------------------------------- | ------------------------------------------- |\n| `GRAIN_LISTEN` | `--listen` |\n| `GRAIN_INDEX` | `--index` |\n| `GRAIN_PUBLIC_URL` | `--public-url` |\n| `GRAIN_JETSTREAM` (`1` for default) | `--jetstream ` |\n| `GRAIN_BACKFILL=1` + `_DIRECTORIES` | `--backfill [,...]` |\n| `GRAIN_BACKFILL_MIRROR`/`_SKIP`/`_CONCURRENCY` | `--backfill-mirror`/`-skip`/`-concurrency` |\n| `GRAIN_CDN_URL` | `--cdn` |\n| `GRAIN_BSKY_APPVIEW` (`1` for default)| `--bsky-appview ` |\n| `GRAIN_SIGN_UP_PDS` | `--sign-up-pds` |\n| `GRAIN_CARRY_COOKIES_UNTIL` | `--carry-cookies-until` |\n| `GRAIN_APNS_KEY_ID`/`_TEAM_ID`/`_TOPIC` | `--apns-key-id`/`-team-id`/`-topic` |\n| `GRAIN_APNS_SANDBOX=1` | `--apns-url https://api.sandbox.push.apple.com` |\n| `GRAIN_FCM_PROJECT_ID` | `--fcm-project-id` |\n| `GRAIN_CLEF_MODEL`/`_URL` | `--clef-model`/`--clef-url` |\n| `GRAIN_ADMINS` | `GRAIN_ADMIN_DIDS` (still the environment) |\n\n**The environment keeps what knotless keeps there**: secrets, key files and\nidentity lists. `GRAIN_CDN_KEY` and `GRAIN_CDN_SALT`, `GRAIN_APNS_KEY_FILE`\nand `GRAIN_FCM_KEY_FILE`, `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_AI_TOKEN`\n(the account goes with the token it is for), `GRAIN_ADMIN_DIDS`, renamed\nfrom `GRAIN_ADMINS` as `KNOTLESS_ADMIN_DIDS` is named, `RUST_LOG`, and\n`grain::env`'s directories and resolvers (`GRAIN_CONFIG_DIR`,\n`GRAIN_CACHE_DIR`, ...), which the CLI reads too.\n\nThe `1` shorthands for Jetstream and the Bluesky appview are gone, as\nknotless-serve has none: a compose file gives the URL as its default\n(`${GRAIN_JETSTREAM-wss://...}`), and `jetstream::DEFAULT` and\n`read::search::BSKY_APPVIEW` stay as the values to give.\n\n## Why\n\nThe audit against knotless: knotless-serve takes its settings as flags\n(`parse_args`, `crates/knotless-serve/src/lib.rs`) and reads the\nenvironment only for secrets, directories and identity lists, and its\ncompose passes `${VAR:-}` into flags. grain-serve read every setting from\n`GRAIN_*`. Its compose (the image pull) comes after this, so it can pass\nflags from the start.\n\nMirrors `parse_args`, `Options` and its usage string in\n`crates/knotless-serve/src/lib.rs`, `main.rs`'s exit 2 on a usage error,\nand `KNOTLESS_ADMIN_DIDS` in `crates/knotless/src/env.rs`. Kept\ngrain-specific: the struct is still `Settings`, not `Options`, and its\nfields are as they were, since every pull in flight that builds one\n(`Settings { index, ..Default::default() }`) keeps compiling; and the\nflags are parsed from a table, `FLAGS`, into one lookup that each part's\nconfig reads (`backfill::Config::given`, `push::Config::given`,\n`clef::Config::given`), rather than one match arm a flag, so the push\nand Clef configs read their flags and their key files from one place.\n`--backfill-mirror \"\"` and `--backfill-skip \"\"` are none, not the\ndefault, as the empty variables were.\n\n## How it was checked\n\nThe settings tests (`lib.rs`, `tests/backfill.rs`, `tests/jetstream.rs`,\n`push/tests.rs`, `clef.rs`) parse flags now, every flag given empty is\nevery part off, the old variable is not read for a setting, and a flag it\ndoes not take is refused with the usage; `tests/main.rs` runs the binary\nwith flags, and checks it exits 2 with its usage. Clippy run here on\ngrain-serve; the rest left to the checks.\n\n## Shortcomings\n\n- Another pull in flight adds a `GRAIN_WEB` fallback; whichever lands\n second makes it `--web `, as knotless-serve's is.\n- Nothing deploys grain-serve yet, so no compose or env file names the\n old variables; the image and compose pull passes these flags.\n\n## Review\n\nStart at `Settings::parse` in `crates/grain-serve/src/lib.rs`.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)","html":"

What changes

grain-serve is set by flags, as knotless-serve is. Where it listens,\nits index, its public URL, the Jetstream it follows, backfill, the CDN's\naddress, the Bluesky appview, the sign-up PDS, how long old cookies carry,\nand the non-secret parts of push and Clef are each a --flag with a value\n(grain_serve::FLAGS, grain_serve::USAGE), and a flag given empty is as\nif not given, so a compose file can pass --jetstream \"${GRAIN_JETSTREAM:-}\"\nand turn a part off by leaving the variable unset. A flag it does not take,\nor one with no value, exits 2 with the usage, as knotless-serve does.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

was	is
`GRAIN_LISTEN`	`--listen`
`GRAIN_INDEX`	`--index`
`GRAIN_PUBLIC_URL`	`--public-url`
`GRAIN_JETSTREAM` (`1` for default)	`--jetstream <wss://host>`
`GRAIN_BACKFILL=1` + `_DIRECTORIES`	`--backfill <https://directory>[,...]`
`GRAIN_BACKFILL_MIRROR`/`_SKIP`/`_CONCURRENCY`	`--backfill-mirror`/`-skip`/`-concurrency`
`GRAIN_CDN_URL`	`--cdn`
`GRAIN_BSKY_APPVIEW` (`1` for default)	`--bsky-appview <https://appview>`
`GRAIN_SIGN_UP_PDS`	`--sign-up-pds`
`GRAIN_CARRY_COOKIES_UNTIL`	`--carry-cookies-until`
`GRAIN_APNS_KEY_ID`/`_TEAM_ID`/`_TOPIC`	`--apns-key-id`/`-team-id`/`-topic`
`GRAIN_APNS_SANDBOX=1`	`--apns-url https://api.sandbox.push.apple.com`
`GRAIN_FCM_PROJECT_ID`	`--fcm-project-id`
`GRAIN_CLEF_MODEL`/`_URL`	`--clef-model`/`--clef-url`
`GRAIN_ADMINS`	`GRAIN_ADMIN_DIDS` (still the environment)

The environment keeps what knotless keeps there: secrets, key files and\nidentity lists. GRAIN_CDN_KEY and GRAIN_CDN_SALT, GRAIN_APNS_KEY_FILE\nand GRAIN_FCM_KEY_FILE, CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_AI_TOKEN\n(the account goes with the token it is for), GRAIN_ADMIN_DIDS, renamed\nfrom GRAIN_ADMINS as KNOTLESS_ADMIN_DIDS is named, RUST_LOG, and\ngrain::env's directories and resolvers (GRAIN_CONFIG_DIR,\nGRAIN_CACHE_DIR, ...), which the CLI reads too.

The 1 shorthands for Jetstream and the Bluesky appview are gone, as\nknotless-serve has none: a compose file gives the URL as its default\n(${GRAIN_JETSTREAM-wss://...}), and jetstream::DEFAULT and\nread::search::BSKY_APPVIEW stay as the values to give.

Why

The audit against knotless: knotless-serve takes its settings as flags\n(parse_args, crates/knotless-serve/src/lib.rs) and reads the\nenvironment only for secrets, directories and identity lists, and its\ncompose passes ${VAR:-} into flags. grain-serve read every setting from\nGRAIN_*. Its compose (the image pull) comes after this, so it can pass\nflags from the start.

Mirrors parse_args, Options and its usage string in\ncrates/knotless-serve/src/lib.rs, main.rs's exit 2 on a usage error,\nand KNOTLESS_ADMIN_DIDS in crates/knotless/src/env.rs. Kept\ngrain-specific: the struct is still Settings, not Options, and its\nfields are as they were, since every pull in flight that builds one\n(Settings { index, ..Default::default() }) keeps compiling; and the\nflags are parsed from a table, FLAGS, into one lookup that each part's\nconfig reads (backfill::Config::given, push::Config::given,\nclef::Config::given), rather than one match arm a flag, so the push\nand Clef configs read their flags and their key files from one place.\n--backfill-mirror \"\" and --backfill-skip \"\" are none, not the\ndefault, as the empty variables were.

How it was checked

The settings tests (lib.rs, tests/backfill.rs, tests/jetstream.rs,\npush/tests.rs, clef.rs) parse flags now, every flag given empty is\nevery part off, the old variable is not read for a setting, and a flag it\ndoes not take is refused with the usage; tests/main.rs runs the binary\nwith flags, and checks it exits 2 with its usage. Clippy run here on\ngrain-serve; the rest left to the checks.

Shortcomings

Another pull in flight adds a GRAIN_WEB fallback; whichever lands\nsecond makes it --web <http://pages>, as knotless-serve's is.
Nothing deploys grain-serve yet, so no compose or env file names the\nold variables; the image and compose pull passes these flags.

Review

Start at Settings::parse in crates/grain-serve/src/lib.rs.

🤖 Generated with Claude Code

\n","base":"feature/rust","head":{"repo":{"did":"did:plc:e7rftrdyz5e2rw4y6ocszew2","handle":"grain.social","name":"grain"},"branch":"infra/flags"},"comments":[{"uri":"at://did:plc:kqi2glvzerg4dt66k64co2sl/dev.knotless.comment/3mza7nxwe4s2b","author":{"did":"did:plc:kqi2glvzerg4dt66k64co2sl","handle":"review.knotless.dev","bot":true},"createdAt":"2026-11-01T06:47:40.912Z","body":"This moves grain-serve's settings from `GRAIN_*` variables to a table of `--flag`s. Secrets, key files and the admin list stay in the environment, and `GRAIN_ADMINS` becomes `GRAIN_ADMIN_DIDS`. I read `Settings::parse`, `FLAGS`, `USAGE` and `Settings` in `crates/grain-serve/src/lib.rs`, and they look right. An empty flag counts as unset, an unknown flag returns the usage, and a flag with no value returns an error. The environment names that remain match the `environment:` line in the usage. The rest of the diff, including the per-part `given` readers, the tests and `main.rs`, is about 64k characters. My tools couldn't page through it, so I didn't read it.\n\nAll four checks (`check`, `rust`, `test`, `harness`) were still queued when I looked. Please make sure they pass, in particular the `harness` coverage gate, before this lands.\n\nTwo minor points, neither blocking:\n- A value that is itself a flag name is accepted as a value. For example, `--jetstream --listen` sets the Jetstream to `--listen`. knotless-serve may behave the same way.\n- The \"takes a value\" error doesn't include the usage, unlike the unknown-flag error. If `main.rs` doesn't add it, you could append `USAGE` there.","html":"

This moves grain-serve's settings from GRAIN_* variables to a table of --flags. Secrets, key files and the admin list stay in the environment, and GRAIN_ADMINS becomes GRAIN_ADMIN_DIDS. I read Settings::parse, FLAGS, USAGE and Settings in crates/grain-serve/src/lib.rs, and they look right. An empty flag counts as unset, an unknown flag returns the usage, and a flag with no value returns an error. The environment names that remain match the environment: line in the usage. The rest of the diff, including the per-part given readers, the tests and main.rs, is about 64k characters. My tools couldn't page through it, so I didn't read it.

All four checks (check, rust, test, harness) were still queued when I looked. Please make sure they pass, in particular the harness coverage gate, before this lands.

Two minor points, neither blocking:

A value that is itself a flag name is accepted as a value. For example, --jetstream --listen sets the Jetstream to --listen. knotless-serve may behave the same way.
The \"takes a value\" error doesn't include the usage, unlike the unknown-flag error. If main.rs doesn't add it, you could append USAGE there.

\n","verdict":"approve","commit":"7d2bbba23d8ecfe3bef33bb21b9ff548917f9839"},{"uri":"at://did:plc:bcgltzqazw5tb6k2g3ttenbj/dev.knotless.comment/3mzaa4j22wzui","author":{"did":"did:plc:bcgltzqazw5tb6k2g3ttenbj","handle":"chadtmiller.com","avatar":"https://cdn.bsky.app/img/avatar/plain/did:plc:bcgltzqazw5tb6k2g3ttenbj/bafkreig5bcb7dl7aphw6eg4e7kjkvpdshfexdvk7jldg53ypre6ecdhesu@jpeg"},"createdAt":"2026-11-01T06:55:48.622Z","body":"Both minor points are left as knotless-serve has them: its parse_args takes the next argument as the value whatever it is, and says only \" takes a value\" without the usage. Changing either would move grain away from the shape this copies.","html":"

Both minor points are left as knotless-serve has them: its parse_args takes the next argument as the value whatever it is, and says only \"<flag> takes a value\" without the usage. Changing either would move grain away from the shape this copies.

\n"},{"uri":"at://did:plc:bcgltzqazw5tb6k2g3ttenbj/dev.knotless.comment/3mzafjhm7en2b","author":{"did":"did:plc:bcgltzqazw5tb6k2g3ttenbj","handle":"chadtmiller.com","avatar":"https://cdn.bsky.app/img/avatar/plain/did:plc:bcgltzqazw5tb6k2g3ttenbj/bafkreig5bcb7dl7aphw6eg4e7kjkvpdshfexdvk7jldg53ypre6ecdhesu@jpeg"},"createdAt":"2026-11-01T08:32:32.036Z","body":"Landed on feature/rust at fc5f686 through the batch pull at://did:plc:bcgltzqazw5tb6k2g3ttenbj/dev.knotless.pull/3mzadedttgi2b, checked there as a whole. This pull's head is in feature/rust's history.","html":"

Landed on feature/rust at fc5f686 through the batch pull Seven reviewed pulls land on feature/rust together, checked once, checked there as a whole. This pull's head is in feature/rust's history.

\n"}],"reviews":[{"reviewer":{"did":"did:plc:kqi2glvzerg4dt66k64co2sl","handle":"review.knotless.dev","bot":true},"verdict":"approve","uri":"at://did:plc:kqi2glvzerg4dt66k64co2sl/dev.knotless.comment/3mza7nxwe4s2b","commit":"7d2bbba23d8ecfe3bef33bb21b9ff548917f9839","outdated":false,"maintainer":false}],"closes":[],"checks":[],"minutes":[{"runner":{"did":"did:plc:4bocpkn5zkwe4wuu4plrj5kt","handle":"runner.knotless.dev","bot":true},"minutes":2505,"freeing":[{"at":"2026-11-25T00:00:00Z","minutes":2},{"at":"2026-11-27T00:00:00Z","minutes":24},{"at":"2026-11-28T00:00:00Z","minutes":10},{"at":"2026-11-29T00:00:00Z","minutes":7},{"at":"2026-11-30T00:00:00Z","minutes":310},{"at":"2026-12-01T00:00:00Z","minutes":1355},{"at":"2026-12-02T00:00:00Z","minutes":509},{"at":"2026-12-06T00:00:00Z","minutes":43},{"at":"2026-12-07T00:00:00Z","minutes":185},{"at":"2026-12-08T00:00:00Z","minutes":16},{"at":"2026-12-09T00:00:00Z","minutes":38}],"updatedAt":"2026-11-10T01:31:15.298Z"},{"runner":{"did":"did:plc:ejh2v3z5ieqhqgz3ybk6r35x","handle":"ci.knotless.dev","bot":true},"minutes":28,"freeing":[{"at":"2026-11-29T00:00:00Z","minutes":2},{"at":"2026-11-30T00:00:00Z","minutes":7},{"at":"2026-12-01T00:00:00Z","minutes":1},{"at":"2026-12-06T00:00:00Z","minutes":6},{"at":"2026-12-07T00:00:00Z","minutes":8}],"updatedAt":"2026-11-08T00:05:20.251Z"}],"changes":{"repo":{"did":"did:plc:e7rftrdyz5e2rw4y6ocszew2","handle":"grain.social","name":"grain"},"commits":[],"files":[],"head":"7d2bbba23d8ecfe3bef33bb21b9ff548917f9839"},"card":"/grain.social/grain/pull/did:plc:bcgltzqazw5tb6k2g3ttenbj/3mza7mqh2ofzo/card.png?v=83085927ef64bf7b"}

grain.social/grain Switch repository Loading…

grain-serve is set by flags, as knotless-serve is

grain.social/grain

Switch repository

Loading…