feat: present public Raindex market API

Author: findolor

.github/workflows/deploy-raindex-api.yaml

@@ -0,0 +1,88 @@
+name: Deploy Raindex API
+on:
+  workflow_dispatch:
+    inputs:
+      scope:
+        description: Deployment scope
+        required: true
+        default: service
+        type: choice
+        options:
+          - service
+          - all
+          - system
+concurrency:
+  group: deploy-raindex-api-production
+  cancel-in-progress: false
+permissions:
+  contents: read
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: Production
+    env:
+      RAINDEX_API_HOSTNAME: ${{ vars.RAINDEX_API_HOSTNAME }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+      - uses: nixbuild/nix-quick-install-action@v30
+        with:
+          nix_conf: |
+            accept-flake-config = true
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+      - uses: cachix/cachix-action@v15
+        continue-on-error: true
+        with:
+          name: rainlanguage
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          useDaemon: false
+      - uses: nix-community/cache-nix-action@v7
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-
+          gc-max-store-size-linux: 8G
+      - name: Validate deployment definitions
+        run: |
+          nix flake check --no-build --impure
+          nix build .#raindex-api --no-link
+          nix shell .#opentofu -c tofu -chdir=infra init -backend=false
+          nix shell .#opentofu -c tofu -chdir=infra validate
+      - name: Configure authenticated SSH
+        env:
+          SSH_KEY: ${{ secrets.RAINDEX_API_SSH_KEY }}
+        run: |
+          test -n "$SSH_KEY"
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+
+          host_ip=$(nix run .#resolveIp -- -i ~/.ssh/id_ed25519)
+          host_key=$(nix eval --raw --file keys.nix keys.host)
+          test "$host_key" != "ssh-ed25519 REPLACE_AFTER_BOOTSTRAP"
+          printf '%s %s\n' "$host_ip" "$host_key" > ~/.ssh/known_hosts
+      - name: Deploy
+        env:
+          SCOPE: ${{ inputs.scope }}
+        run: |
+          case "$SCOPE" in
+            service) nix run .#deployService -- -i ~/.ssh/id_ed25519 rest-api ;;
+            system) nix run .#deployNixos -- -i ~/.ssh/id_ed25519 ;;
+            all) nix run .#deployAll -- -i ~/.ssh/id_ed25519 ;;
+            *) echo "Unsupported deployment scope: $SCOPE" >&2; exit 1 ;;
+          esac
+      - name: Verify deployment
+        run: |
+          api_hostname="${RAINDEX_API_HOSTNAME:-api.raindex.finance}"
+          health_url="https://$api_hostname/health/detailed"
+          for _ in $(seq 1 60); do
+            if curl --fail --silent --show-error --max-time 5 "$health_url"; then
+              exit 0
+            fi
+            sleep 5
+          done
+
+          host_ip=$(nix run .#resolveIp -- -i ~/.ssh/id_ed25519)
+          ssh -i ~/.ssh/id_ed25519 "root@$host_ip" \
+            'systemctl status rest-api.service --no-pager || true; journalctl -u rest-api.service -n 200 --no-pager || true'
+          exit 1

.github/workflows/raindex-api.yaml

@@ -0,0 +1,63 @@
+name: Raindex API
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "Cargo.lock"
+      - "Cargo.toml"
+      - "crates/**"
+      - "*.nix"
+      - "flake.lock"
+      - "infra/**"
+      - ".github/workflows/raindex-api.yaml"
+      - ".github/workflows/deploy-raindex-api.yaml"
+  pull_request:
+    paths:
+      - "Cargo.lock"
+      - "Cargo.toml"
+      - "crates/**"
+      - "*.nix"
+      - "flake.lock"
+      - "infra/**"
+      - ".github/workflows/raindex-api.yaml"
+      - ".github/workflows/deploy-raindex-api.yaml"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+permissions:
+  contents: read
+jobs:
+  production-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+      - uses: nixbuild/nix-quick-install-action@v30
+        with:
+          nix_conf: |
+            accept-flake-config = true
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+      - uses: cachix/cachix-action@v15
+        continue-on-error: true
+        with:
+          name: rainlanguage
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          useDaemon: false
+      - uses: nix-community/cache-nix-action@v7
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock', 'Cargo.lock') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-
+          gc-max-store-size-linux: 8G
+      - name: Validate reproducible service and host definitions
+        run: |
+          nix flake check --no-build --impure
+          nix build .#raindex-api --no-link
+      - name: Validate infrastructure and workflows
+        run: |
+          nix shell .#opentofu -c tofu -chdir=infra init -backend=false
+          nix shell .#opentofu -c tofu -chdir=infra validate
+          nix shell .#actionlint -c actionlint \
+            .github/workflows/raindex-api.yaml \
+            .github/workflows/deploy-raindex-api.yaml

.gitignore

@@ -14,6 +14,7 @@ packages/raindex/cjs.d.ts
 packages/raindex/esm.js
 packages/raindex/esm.d.ts
 .direnv/
+.raindex/
 
 # Audit proposed fixes
 .fixes/

Cargo.lock

@@ -25,9 +25,16 @@ path = [
   "package-lock.json",
   "Cargo.lock",
   "Cargo.toml",
+  "deploy.nix",
+  "disko.nix",
   ".devcontainer.json",
   ".env.example",
+  "infra/**/",
+  "keys.nix",
+  "os.nix",
   "packages/**/",
+  "rust.nix",
+  "services.nix",
   "ai_commands/**/",
   "subgraph/**/",
   "crates/**/",

REUSE.toml

@@ -13,17 +13,24 @@ path = "src/main.rs"
 
 [dependencies]
 raindex_common = { workspace = true }
+async-trait = "0.1"
+moka = { version = "0.12", features = ["future"] }
 rocket = { version = "0.5.1", features = ["json"] }
 rocket_cors = "0.6"
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
+tracing = { workspace = true }
+tracing-appender = "0.2"
+tracing-subscriber = { workspace = true, features = ["env-filter", "json"] }
 utoipa = { version = "5", features = ["rocket_extras"] }
-utoipa-swagger-ui = { version = "9", features = ["rocket"] }
+utoipa-swagger-ui = { version = "9", features = ["rocket", "vendored"] }
+uuid = { version = "1", features = ["v4"] }
 
 [target.'cfg(not(target_family = "wasm"))'.dependencies]
 tokio = { workspace = true, features = ["full"] }
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["full", "macros"] }
 alloy = { workspace = true }
+tempfile = "3"