ALL='["cellar","sipp","feeds","parcels","jotts","og","shrink","backup","posts","library","bookmarks"]'

          for app in cellar sipp feeds parcels jotts og shrink backup posts library bookmarks; do

          ALL='["cellar","sipp","feeds","parcels","jotts","og","shrink","backup","posts","library","bookmarks"]'

          for app in cellar sipp feeds parcels jotts og shrink backup posts library bookmarks; do

name = "bookmarks"

version = "0.1.0"

dependencies = [

 "andromeda-auth",

 "andromeda-darkmatter-css",

 "andromeda-db",

 "askama 0.13.1",

 "axum",

 "chrono",

 "dotenvy",

 "mime_guess",

 "nanoid",

 "rand 0.8.5",

 "rusqlite",

 "rust-embed",

 "serde",

 "serde_json",

 "subtle",

 "tokio",

 "tracing",

 "tracing-subscriber",

]

[[package]]

    "apps/bookmarks",

HOST=127.0.0.1

PORT=3000

# SQLite file path (default: bookmarks.sqlite)

BOOKMARKS_DB_PATH=bookmarks.sqlite

# Admin login password (required for /admin)

BOOKMARKS_PASSWORD=changeme

# API key for POST /api/links (omit to disable write API)

BOOKMARKS_API_KEY=

# Set true behind HTTPS to mark session cookie Secure

COOKIE_SECURE=false

[package]

name = "bookmarks"

version = "0.1.0"

edition = "2024"

description = "Personal link saver"

license = "MIT"

repository = "https://github.com/stevedylandev/andromeda"

homepage = "https://github.com/stevedylandev/andromeda"

[dependencies]

axum = { workspace = true }

tokio = { workspace = true }

serde = { workspace = true }

serde_json = { workspace = true }

dotenvy = { workspace = true }

rusqlite = { workspace = true }

nanoid = { workspace = true }

rust-embed = { workspace = true }

mime_guess = "2"

subtle = { workspace = true }

rand = { workspace = true }

tracing = { workspace = true }

tracing-subscriber = { workspace = true, features = ["env-filter"] }

andromeda-auth = { workspace = true }

andromeda-db = { workspace = true, features = ["axum", "session"] }

andromeda-darkmatter-css = { workspace = true }

askama = "0.13"

chrono = "0.4"

FROM lukemathwalker/cargo-chef:latest-rust-1-slim-bookworm AS chef

WORKDIR /app

FROM chef AS planner

COPY . .

RUN cargo chef prepare --recipe-path recipe.json

FROM chef AS builder

RUN apt-get update && apt-get install -y pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*

COPY --from=planner /app/recipe.json recipe.json

RUN cargo chef cook --release --recipe-path recipe.json -p bookmarks

COPY . .

RUN cargo build --release -p bookmarks

FROM debian:bookworm-slim

COPY --from=builder /app/target/release/bookmarks /usr/local/bin/bookmarks

WORKDIR /data

EXPOSE 3000

ENV HOST=0.0.0.0

ENV PORT=3000

CMD ["bookmarks"]

# Bookmarks

Personal link saver organized by category.

## Quickstart

1. Make sure [Rust](https://www.rust-lang.org/tools/install) is installed

```bash

rustc --version

```

2. Clone and build

```bash

git clone https://github.com/stevedylandev/andromeda

cd andromeda

cargo build -p bookmarks

```

3. Run the dev server

```bash

cargo run -p bookmarks

# Server running on http://localhost:3000

```

### Environment Variables

| Variable | Description | Default |

|---|---|---|

| `BOOKMARKS_PASSWORD` | Password for the admin panel | — |

| `BOOKMARKS_API_KEY` | API key for `POST /api/links` (omit to disable write API) | — |

| `BOOKMARKS_DB_PATH` | SQLite database path | `bookmarks.sqlite` |

| `HOST` | Bind address | `127.0.0.1` |

| `PORT` | Bind port | `3000` |

| `COOKIE_SECURE` | Enable HTTPS-only cookies | `false` |

## Overview

Bookmarks is a single-user link saver. Add links via the admin panel or JSON API, organize them into categories, and view them on a public index page grouped by category. A few highlights:

- Single Rust binary with embedded assets

- Local SQLite storage

- Password-protected admin panel for managing categories and links

- JSON read API (open) and write API (key-guarded)

- Dark themed UI with Commit Mono font

## Usage

### Admin Panel

Set `BOOKMARKS_PASSWORD` and visit `/login`. From the admin panel you can:

- Create and remove categories

- Add links with title, URL, and category

- Remove links

### JSON API

Read endpoints are open. Write endpoints require `x-api-key: <BOOKMARKS_API_KEY>`.

| Method | Path | Auth | Purpose |

|---|---|---|---|

| `GET` | `/api/categories` | open | List categories |

| `GET` | `/api/links` | open | List links grouped by category. Query: `category` to filter by name |

| `POST` | `/api/links` | api key | Create link. Body: `{category, title, url}` |

Example:

```bash

curl -X POST http://localhost:3000/api/links \

  -H "x-api-key: $BOOKMARKS_API_KEY" \

  -H "content-type: application/json" \

  -d '{"category":"Reading","title":"Example","url":"https://example.com"}'

```

## Structure

```

bookmarks/

├── src/

│   ├── main.rs        # Axum server, admin routes, JSON API, static serving

│   ├── db.rs          # Schema and SQLite queries

│   └── auth.rs        # Session + API-key guards

├── templates/         # Askama HTML templates (index, login, admin)

├── static/            # Static assets embedded at compile time via rust-embed

├── Dockerfile

└── docker-compose.yml

```

## Deployment

Since Bookmarks compiles to a single binary, deployment is straightforward on any platform.

### Docker (recommended)

```bash

git clone https://github.com/stevedylandev/andromeda

cd andromeda/apps/bookmarks

cp .env.example .env

# Edit .env with your credentials

docker compose up -d

```

Mount a volume at `BOOKMARKS_DB_PATH` to persist the SQLite database.

### Binary

```bash

cargo build --release -p bookmarks

```

The resulting binary at `./target/release/bookmarks` is self-contained with all assets embedded. Copy it to your server with a configured `.env` file and run it directly.

## License

[MIT](../../LICENSE)

[general]

dirs = ["src/templates"]

services:

  app:

    build:

      context: ../..

      dockerfile: apps/bookmarks/Dockerfile

    ports:

      - "${PORT:-3000}:${PORT:-3000}"

    environment:

      - BOOKMARKS_PASSWORD=${BOOKMARKS_PASSWORD:-changeme}

      - BOOKMARKS_API_KEY=${BOOKMARKS_API_KEY:-}

      - BOOKMARKS_DB_PATH=/data/bookmarks.sqlite

      - COOKIE_SECURE=false

      - HOST=0.0.0.0

      - PORT=${PORT:-3000}

    volumes:

      - bookmarks-data:/data

    restart: unless-stopped

volumes:

  bookmarks-data:

use axum::{

    extract::{FromRef, FromRequestParts},

    http::request::Parts,

    response::{IntoResponse, Redirect, Response},

};

use chrono::{Duration, Utc};

use std::sync::Arc;

use crate::AppState;

use andromeda_db::session;

pub use andromeda_auth::{

    build_session_cookie, clear_session_cookie, extract_session_cookie, generate_session_token,

    verify_api_key, verify_password,

};

const SESSION_DAYS: i64 = 7;

pub fn create_session(db: &andromeda_db::Db, token: &str) -> Result<(), andromeda_db::DbError> {

    let expires = (Utc::now() + Duration::days(SESSION_DAYS))

        .format("%Y-%m-%d %H:%M:%S")

        .to_string();

    session::insert_session(db, token, &expires)

}

pub fn is_valid_session(db: &andromeda_db::Db, token: &str) -> bool {

    match session::get_session_expiry(db, token) {

        Ok(Some(expires_at)) => chrono::NaiveDateTime::parse_from_str(&expires_at, "%Y-%m-%d %H:%M:%S")

            .map(|exp| exp > Utc::now().naive_utc())

            .unwrap_or(false),

        _ => false,

    }

}

pub fn delete_session(db: &andromeda_db::Db, token: &str) {

    let _ = session::delete_session(db, token);

}

pub struct AuthSession;

impl<S> FromRequestParts<S> for AuthSession

where

    S: Send + Sync,

    Arc<AppState>: FromRef<S>,

{

    type Rejection = Response;

    async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Self::Rejection> {

        let state = Arc::<AppState>::from_ref(state);

        if let Some(token) = extract_session_cookie(&parts.headers) {

            if is_valid_session(&state.db, &token) {

                return Ok(AuthSession);

            }

        }

        Err(Redirect::to("/login").into_response())

    }

}

use andromeda_db::{Db, DbError};

use nanoid::nanoid;

use rusqlite::{OptionalExtension, params};

use serde::Serialize;

pub const SCHEMA: &str = r#"

CREATE TABLE IF NOT EXISTS categories (

    id         INTEGER PRIMARY KEY AUTOINCREMENT,

    short_id   TEXT NOT NULL UNIQUE,

    name       TEXT NOT NULL UNIQUE,

    created_at INTEGER NOT NULL

);

CREATE TABLE IF NOT EXISTS links (

    id          INTEGER PRIMARY KEY AUTOINCREMENT,

    short_id    TEXT NOT NULL UNIQUE,

    title       TEXT NOT NULL,

    url         TEXT NOT NULL,

    category_id INTEGER NOT NULL REFERENCES categories(id) ON DELETE CASCADE,

    created_at  INTEGER NOT NULL

);

CREATE INDEX IF NOT EXISTS idx_links_category ON links(category_id, created_at DESC);

"#;

#[derive(Debug, Clone, Serialize)]

pub struct Category {

    pub id: i64,

    pub short_id: String,

    pub name: String,

}

#[derive(Debug, Clone, Serialize)]

pub struct Link {

    pub id: i64,

    pub short_id: String,

    pub title: String,

    pub url: String,

    pub category_id: i64,

    pub created_at: i64,

}

pub fn list_categories(db: &Db) -> Result<Vec<Category>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let mut stmt = conn.prepare("SELECT id, short_id, name FROM categories ORDER BY name COLLATE NOCASE")?;

    let rows = stmt.query_map([], |row| {

        Ok(Category {

            id: row.get(0)?,

            short_id: row.get(1)?,

            name: row.get(2)?,

        })

    })?;

    Ok(rows.collect::<Result<Vec<_>, _>>()?)

}

pub fn create_category(db: &Db, name: &str) -> Result<Category, DbError> {

    let now = chrono::Utc::now().timestamp();

    let short_id = nanoid!(10);

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    conn.execute(

        "INSERT INTO categories (short_id, name, created_at) VALUES (?1, ?2, ?3)",

        params![short_id, name, now],

    )?;

    Ok(Category {

        id: conn.last_insert_rowid(),

        short_id,

        name: name.to_string(),

    })

}

pub fn delete_category_by_short_id(db: &Db, short_id: &str) -> Result<bool, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let n = conn.execute("DELETE FROM categories WHERE short_id = ?1", params![short_id])?;

    Ok(n > 0)

}

pub fn get_category_by_name(db: &Db, name: &str) -> Result<Option<Category>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let cat = conn

        .query_row(

            "SELECT id, short_id, name FROM categories WHERE name = ?1",

            params![name],

            |row| {

                Ok(Category {

                    id: row.get(0)?,

                    short_id: row.get(1)?,

                    name: row.get(2)?,

                })

            },

        )

        .optional()?;

    Ok(cat)

}

pub fn list_links(db: &Db) -> Result<Vec<Link>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let mut stmt = conn.prepare(

        "SELECT id, short_id, title, url, category_id, created_at FROM links ORDER BY created_at DESC",

    )?;

    let rows = stmt.query_map([], |row| {

        Ok(Link {

            id: row.get(0)?,

            short_id: row.get(1)?,

            title: row.get(2)?,

            url: row.get(3)?,

            category_id: row.get(4)?,

            created_at: row.get(5)?,

        })

    })?;

    Ok(rows.collect::<Result<Vec<_>, _>>()?)

}

pub fn create_link(db: &Db, title: &str, url: &str, category_id: i64) -> Result<Link, DbError> {

    let now = chrono::Utc::now().timestamp();

    let short_id = nanoid!(10);

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    conn.execute(

        "INSERT INTO links (short_id, title, url, category_id, created_at) VALUES (?1, ?2, ?3, ?4, ?5)",

        params![short_id, title, url, category_id, now],

    )?;

    Ok(Link {

        id: conn.last_insert_rowid(),

        short_id,

        title: title.to_string(),

        url: url.to_string(),

        category_id,

        created_at: now,

    })

}

pub fn delete_link_by_short_id(db: &Db, short_id: &str) -> Result<bool, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let n = conn.execute("DELETE FROM links WHERE short_id = ?1", params![short_id])?;

    Ok(n > 0)

}

mod auth;

mod db;

use std::sync::{Arc, Mutex};

use andromeda_db::{

    Db,

    session::{SESSION_SCHEMA, prune_expired_sessions},

};

use askama::Template;

use axum::{

    Form, Json, Router,

    extract::{Path, Query, Request, State},

    http::{HeaderMap, StatusCode, header},

    middleware::{self, Next},

    response::{Html, IntoResponse, Redirect, Response},

    routing::{get, post},

};

use rusqlite::Connection;

use rust_embed::Embed;

use serde::Deserialize;

#[derive(Embed)]

#[folder = "static/"]

struct Static;

async fn static_handler(Path(path): Path<String>) -> Response {

    match Static::get(&path) {

        Some(file) => {

            let mime = mime_guess::from_path(&path).first_or_octet_stream();

            ([(header::CONTENT_TYPE, mime.as_ref())], file.data.to_vec()).into_response()

        }

        None => StatusCode::NOT_FOUND.into_response(),

    }

}

use crate::db::{Category, Link};

pub struct AppState {

    pub db: Db,

    pub admin_password: Option<String>,

    pub api_key: Option<String>,

    pub cookie_secure: bool,

}

// ── Templates ────────────────────────────────────────────────────────────

struct CategoryGroup {

    name: String,

    links: Vec<Link>,

}

#[derive(Template)]

#[template(path = "index.html")]

struct IndexTemplate {

    groups: Vec<CategoryGroup>,

}

#[derive(Template)]

#[template(path = "login.html")]

struct LoginTemplate {

    error: Option<String>,

}

#[derive(Template)]

#[template(path = "admin.html")]

struct AdminTemplate {

    success: Option<String>,

    error: Option<String>,

    categories: Vec<Category>,

    links: Vec<AdminLinkRow>,

}

struct AdminLinkRow {

    short_id: String,

    title: String,

    url: String,

    category: String,

}

#[derive(Deserialize, Default)]

struct FlashQuery {

    error: Option<String>,

    success: Option<String>,

}

fn render<T: Template>(tpl: T) -> Response {

    match tpl.render() {

        Ok(html) => Html(html).into_response(),

        Err(e) => {

            tracing::error!("template render: {e}");

            (StatusCode::INTERNAL_SERVER_ERROR, "Template error").into_response()

        }

    }

}

// ── Public web ───────────────────────────────────────────────────────────

async fn index_handler(State(state): State<Arc<AppState>>) -> Response {

    let categories = db::list_categories(&state.db).unwrap_or_default();

    let all_links = db::list_links(&state.db).unwrap_or_default();

    let groups = categories

        .into_iter()

        .map(|c| {

            let links = all_links

                .iter()

                .filter(|l| l.category_id == c.id)

                .cloned()

                .collect();

            CategoryGroup { name: c.name, links }

        })

        .collect();

    render(IndexTemplate { groups })

}

// ── Login / logout ───────────────────────────────────────────────────────

#[derive(Deserialize)]

struct LoginForm {

    password: String,

}

async fn login_get(Query(q): Query<FlashQuery>) -> Response {

    render(LoginTemplate { error: q.error })

}

async fn login_post(State(state): State<Arc<AppState>>, Form(form): Form<LoginForm>) -> Response {

    let pw = match &state.admin_password {

        Some(p) => p,

        None => return Redirect::to("/login?error=No+password+configured").into_response(),

    };

    if !auth::verify_password(&form.password, pw) {

        return Redirect::to("/login?error=Invalid+password").into_response();

    }

    let token = auth::generate_session_token();

    if let Err(e) = auth::create_session(&state.db, &token) {

        tracing::error!("create session: {e}");

        return Redirect::to("/login?error=Session+error").into_response();

    }

    let _ = prune_expired_sessions(&state.db);

    let cookie = auth::build_session_cookie(&token, state.cookie_secure);

    let mut resp = Redirect::to("/admin").into_response();

    resp.headers_mut()

        .insert(header::SET_COOKIE, cookie.parse().unwrap());

    resp

}

async fn logout_handler(State(state): State<Arc<AppState>>, headers: HeaderMap) -> Response {

    if let Some(token) = auth::extract_session_cookie(&headers) {

        auth::delete_session(&state.db, &token);

    }

    let mut resp = Redirect::to("/login").into_response();

    resp.headers_mut()

        .insert(header::SET_COOKIE, auth::clear_session_cookie().parse().unwrap());

    resp

}

// ── Admin ────────────────────────────────────────────────────────────────

async fn admin_handler(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Query(q): Query<FlashQuery>,

) -> Response {

    let categories = db::list_categories(&state.db).unwrap_or_default();

    let raw_links = db::list_links(&state.db).unwrap_or_default();

    let links = raw_links

        .into_iter()

        .map(|l| {

            let cat = categories

                .iter()

                .find(|c| c.id == l.category_id)

                .map(|c| c.name.clone())

                .unwrap_or_default();

            AdminLinkRow {

                short_id: l.short_id,

                title: l.title,

                url: l.url,

                category: cat,

            }

        })

        .collect();

    render(AdminTemplate {

        success: q.success,

        error: q.error,

        categories,

        links,

    })

}

#[derive(Deserialize)]

struct AddCategoryForm {

    name: String,

}

async fn admin_add_category(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Form(form): Form<AddCategoryForm>,

) -> Response {

    let name = form.name.trim();

    if name.is_empty() {

        return Redirect::to("/admin?error=Name+required").into_response();

    }

    match db::create_category(&state.db, name) {

        Ok(_) => Redirect::to("/admin?success=Category+added").into_response(),

        Err(e) => {

            tracing::error!("create category: {e}");

            Redirect::to("/admin?error=Failed+to+add+category").into_response()

        }

    }

}

async fn admin_delete_category(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Path(short_id): Path<String>,

) -> Response {

    let _ = db::delete_category_by_short_id(&state.db, &short_id);

    Redirect::to("/admin?success=Category+removed").into_response()

}

#[derive(Deserialize)]

struct AddLinkForm {

    title: String,

    url: String,

    category: String,

}

async fn admin_add_link(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Form(form): Form<AddLinkForm>,

) -> Response {

    let title = form.title.trim();

    let url = form.url.trim();

    if title.is_empty() || url.is_empty() {

        return Redirect::to("/admin?error=Title+and+URL+required").into_response();

    }

    let cat = match db::get_category_by_name(&state.db, form.category.trim()) {

        Ok(Some(c)) => c,

        Ok(None) => return Redirect::to("/admin?error=Unknown+category").into_response(),

        Err(e) => {

            tracing::error!("get category: {e}");

            return Redirect::to("/admin?error=Server+error").into_response();

        }

    };

    match db::create_link(&state.db, title, url, cat.id) {

        Ok(_) => Redirect::to("/admin?success=Link+added").into_response(),

        Err(e) => {

            tracing::error!("create link: {e}");

            Redirect::to("/admin?error=Failed+to+add+link").into_response()

        }

    }

}

async fn admin_delete_link(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Path(short_id): Path<String>,

) -> Response {

    let _ = db::delete_link_by_short_id(&state.db, &short_id);

    Redirect::to("/admin?success=Link+removed").into_response()

}

// ── JSON API ─────────────────────────────────────────────────────────────

async fn api_list_categories(State(state): State<Arc<AppState>>) -> Response {

    match db::list_categories(&state.db) {

        Ok(cats) => Json(cats).into_response(),

        Err(e) => {

            tracing::error!("list categories: {e}");

            StatusCode::INTERNAL_SERVER_ERROR.into_response()

        }

    }

}

#[derive(Deserialize)]

struct ListLinksQuery {

    category: Option<String>,

}

async fn api_list_links(

    State(state): State<Arc<AppState>>,

    Query(q): Query<ListLinksQuery>,

) -> Response {

    let categories = match db::list_categories(&state.db) {

        Ok(c) => c,

        Err(e) => {

            tracing::error!("list categories: {e}");

            return StatusCode::INTERNAL_SERVER_ERROR.into_response();

        }

    };

    let links = match db::list_links(&state.db) {

        Ok(l) => l,

        Err(e) => {

            tracing::error!("list links: {e}");

            return StatusCode::INTERNAL_SERVER_ERROR.into_response();

        }

    };

    if let Some(name) = q.category.as_deref().map(str::trim).filter(|s| !s.is_empty()) {

        let Some(cat) = categories.iter().find(|c| c.name.eq_ignore_ascii_case(name)) else {

            return (

                StatusCode::NOT_FOUND,

                Json(serde_json::json!({ "error": "unknown category" })),

            )

                .into_response();

        };

        let filtered: Vec<&Link> = links.iter().filter(|l| l.category_id == cat.id).collect();

        return Json(filtered).into_response();

    }

    let mut grouped = serde_json::Map::new();

    for cat in &categories {

        let items: Vec<&Link> = links.iter().filter(|l| l.category_id == cat.id).collect();

        grouped.insert(cat.name.clone(), serde_json::to_value(items).unwrap());

    }

    Json(serde_json::Value::Object(grouped)).into_response()

}

#[derive(Deserialize)]

struct ApiCreateLink {

    category: String,

    title: String,

    url: String,

}

async fn api_create_link(

    State(state): State<Arc<AppState>>,

    Json(body): Json<ApiCreateLink>,

) -> Response {

    let title = body.title.trim();

    let url = body.url.trim();

    if title.is_empty() || url.is_empty() {

        return (

            StatusCode::BAD_REQUEST,

            Json(serde_json::json!({ "error": "title and url required" })),

        )

            .into_response();

    }

    let cat = match db::get_category_by_name(&state.db, body.category.trim()) {

        Ok(Some(c)) => c,

        Ok(None) => {

            return (

                StatusCode::NOT_FOUND,

                Json(serde_json::json!({ "error": "unknown category" })),

            )

                .into_response();

        }

        Err(e) => {

            tracing::error!("get category: {e}");

            return StatusCode::INTERNAL_SERVER_ERROR.into_response();

        }

    };

    match db::create_link(&state.db, title, url, cat.id) {

        Ok(link) => (StatusCode::CREATED, Json(link)).into_response(),

        Err(e) => {

            tracing::error!("create link: {e}");

            StatusCode::INTERNAL_SERVER_ERROR.into_response()

        }

    }

}

async fn require_api_key(

    State(state): State<Arc<AppState>>,

    headers: HeaderMap,

    request: Request,

    next: Next,

) -> Result<Response, (StatusCode, Json<serde_json::Value>)> {

    let server_key = state.api_key.as_deref().ok_or((

        StatusCode::FORBIDDEN,

        Json(serde_json::json!({ "error": "API key not configured" })),

    ))?;

    let provided = headers.get("x-api-key").and_then(|v| v.to_str().ok());

    if let Some(k) = provided {

        if auth::verify_api_key(k, server_key) {

            return Ok(next.run(request).await);

        }

    }

    Err((

        StatusCode::UNAUTHORIZED,

        Json(serde_json::json!({ "error": "Invalid or missing API key" })),

    ))

}

// ── main ─────────────────────────────────────────────────────────────────

#[tokio::main]

async fn main() {

    dotenvy::dotenv().ok();

    tracing_subscriber::fmt()

        .with_env_filter(

            tracing_subscriber::EnvFilter::try_from_default_env()

                .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info,bookmarks=info")),

        )

        .init();

    let db_path =

        std::env::var("BOOKMARKS_DB_PATH").unwrap_or_else(|_| "bookmarks.sqlite".to_string());

    let conn = Connection::open(&db_path).expect("open sqlite");

    conn.execute_batch("PRAGMA foreign_keys = ON;")

        .expect("enable foreign keys");

    conn.execute_batch(SESSION_SCHEMA).expect("session schema");

    conn.execute_batch(db::SCHEMA).expect("bookmarks schema");

    let db: Db = Arc::new(Mutex::new(conn));

    let cookie_secure = std::env::var("COOKIE_SECURE")

        .map(|v| v.eq_ignore_ascii_case("true"))

        .unwrap_or(false);

    let state = Arc::new(AppState {

        db,

        admin_password: std::env::var("BOOKMARKS_PASSWORD").ok().filter(|s| !s.is_empty()),

        api_key: std::env::var("BOOKMARKS_API_KEY").ok().filter(|s| !s.is_empty()),

        cookie_secure,

    });

    let api_authed = Router::new()

        .route("/api/links", post(api_create_link))

        .route_layer(middleware::from_fn_with_state(state.clone(), require_api_key));

    let api_open = Router::new()

        .route("/api/categories", get(api_list_categories))

        .route("/api/links", get(api_list_links));

    let app = Router::new()

        .route("/", get(index_handler))

        .route("/login", get(login_get).post(login_post))

        .route("/logout", get(logout_handler))

        .route("/admin", get(admin_handler))

        .route("/admin/categories", post(admin_add_category))

        .route("/admin/categories/{short_id}/delete", post(admin_delete_category))

        .route("/admin/links", post(admin_add_link))

        .route("/admin/links/{short_id}/delete", post(admin_delete_link))

        .route("/static/{*path}", get(static_handler))

        .merge(api_authed)

        .merge(api_open)

        .merge(andromeda_darkmatter_css::router::<Arc<AppState>>())

        .with_state(state);

    let host = std::env::var("HOST").unwrap_or_else(|_| "127.0.0.1".to_string());

    let port: u16 = std::env::var("PORT")

        .ok()

        .and_then(|v| v.parse().ok())

        .unwrap_or(3000);

    let addr = format!("{host}:{port}");

    let listener = tokio::net::TcpListener::bind(&addr)

        .await

        .unwrap_or_else(|_| panic!("Failed to bind to {addr}"));

    tracing::info!("Bookmarks server running on http://{host}:{port}");

    axum::serve(listener, app).await.unwrap();

}

<!doctype html>

<html lang="en">

  <head>

    <meta charset="UTF-8" />

    <meta name="viewport" content="width=device-width, initial-scale=1.0" />

    <meta name="theme-color" content="#121113" />

    <link rel="stylesheet" href="/assets/darkmatter.css" />

    <link rel="stylesheet" href="/static/styles.css" />

    <link rel="apple-touch-icon" sizes="180x180" href="/static/apple-touch-icon.png" />

    <link rel="icon" type="image/png" sizes="32x32" href="/static/favicon-32x32.png" />

    <link rel="icon" type="image/png" sizes="16x16" href="/static/favicon-16x16.png" />

    <link rel="manifest" href="/static/site.webmanifest" />

    <title>Bookmarks | Admin</title>

    <style>

      .section-label {

        font-size: 14px;

        font-weight: 400;

        opacity: 0.5;

        margin: 0 0 0.5rem;

      }

      section { width: 100%; margin-top: 1.5rem; }

    </style>

  </head>

  <body>

    <div class="header">

      <a href="/" class="logo">BOOKMARKS</a>

      <nav class="links">

        <a href="/logout">logout</a>

      </nav>

    </div>

    {% if let Some(msg) = success %}

    <p class="success">{{ msg }}</p>

    {% endif %}

    {% if let Some(err) = error %}

    <p class="error">{{ err }}</p>

    {% endif %}

    <section>

      <h3 class="section-label">Categories</h3>

      <form class="form" method="POST" action="/admin/categories">

        <div class="form-row">

          <div class="form-field">

            <input type="text" name="name" placeholder="new category" required />

          </div>

          <button type="submit">Add</button>

        </div>

      </form>

      {% if categories.is_empty() %}

      <p class="empty">No categories yet.</p>

      {% else %}

      <ul class="admin-list">

        {% for cat in categories %}

        <li class="admin-list-item">

          <div class="admin-list-info">

            <span class="admin-list-title">{{ cat.name }}</span>

          </div>

          <div class="admin-list-actions">

            <form method="POST" action="/admin/categories/{{ cat.short_id }}/delete" class="inline-form">

              <button type="submit" class="link-button danger">delete</button>

            </form>

          </div>

        </li>

        {% endfor %}

      </ul>

      {% endif %}

    </section>

    <section>

      <h3 class="section-label">Add Link</h3>

      {% if categories.is_empty() %}

      <p class="empty">Add a category first.</p>

      {% else %}

      <form class="form" method="POST" action="/admin/links">

        <div class="form-field">

          <label for="title">Title</label>

          <input type="text" id="title" name="title" required />

        </div>

        <div class="form-field">

          <label for="url">URL</label>

          <input type="url" id="url" name="url" required />

        </div>

        <div class="form-field">

          <label for="category">Category</label>

          <select id="category" name="category" required>

            {% for cat in categories %}

            <option value="{{ cat.name }}">{{ cat.name }}</option>

            {% endfor %}

          </select>

        </div>

        <div class="form-actions">

          <button type="submit">Add link</button>

        </div>

      </form>

      {% endif %}

    </section>

    <section>

      <h3 class="section-label">Links</h3>

      {% if links.is_empty() %}

      <p class="empty">No links yet.</p>

      {% else %}

      <ul class="admin-list">

        {% for link in links %}

        <li class="admin-list-item">

          <div class="admin-list-info">

            <a class="admin-list-title" href="{{ link.url }}" target="_blank" rel="noopener noreferrer">{{ link.title }}</a>

            <div class="admin-list-meta">

              <span class="tag">{{ link.category }}</span>

            </div>

          </div>

          <div class="admin-list-actions">

            <form method="POST" action="/admin/links/{{ link.short_id }}/delete" class="inline-form">

              <button type="submit" class="link-button danger">delete</button>

            </form>

          </div>

        </li>

        {% endfor %}

      </ul>

      {% endif %}

    </section>

  </body>

</html>

<!doctype html>

<html lang="en">

  <head>

    <meta charset="UTF-8" />

    <meta name="viewport" content="width=device-width, initial-scale=1.0" />

    <meta name="theme-color" content="#121113" />

    <link rel="stylesheet" href="/assets/darkmatter.css" />

    <link rel="stylesheet" href="/static/styles.css" />

    <link rel="apple-touch-icon" sizes="180x180" href="/static/apple-touch-icon.png" />

    <link rel="icon" type="image/png" sizes="32x32" href="/static/favicon-32x32.png" />

    <link rel="icon" type="image/png" sizes="16x16" href="/static/favicon-16x16.png" />

    <link rel="manifest" href="/static/site.webmanifest" />

    <title>Bookmarks</title>

    <style>

      .category-heading {

        font-size: 14px;

        font-weight: 400;

        opacity: 0.5;

        text-transform: uppercase;

        letter-spacing: 0.05em;

      }

    </style>

  </head>

  <body>

    <div class="header">

      <a href="/" class="logo">BOOKMARKS</a>

      <nav class="links">

        <a href="/admin">add</a>

      </nav>

    </div>

    {% if groups.is_empty() %}

    <p class="empty">No categories yet.</p>

    {% else %}

    {% for group in groups %}

    <section>

      <h2 class="category-heading">{{ group.name }}</h2>

      {% if group.links.is_empty() %}

      <p class="empty">No links.</p>

      {% else %}

      <ul class="item-list">

        {% for link in group.links %}

        <li class="item">

          <a class="item-title" href="{{ link.url }}" target="_blank" rel="noopener noreferrer">{{ link.title }}</a>

          <div class="item-meta">{{ link.url }}</div>

        </li>

        {% endfor %}

      </ul>

      {% endif %}

    </section>

    {% endfor %}

    {% endif %}

  </body>

</html>

<!doctype html>

<html lang="en">

  <head>

    <meta charset="UTF-8" />

    <meta name="viewport" content="width=device-width, initial-scale=1.0" />

    <meta name="theme-color" content="#121113" />

    <link rel="stylesheet" href="/assets/darkmatter.css" />

    <link rel="stylesheet" href="/static/styles.css" />

    <link rel="apple-touch-icon" sizes="180x180" href="/static/apple-touch-icon.png" />

    <link rel="icon" type="image/png" sizes="32x32" href="/static/favicon-32x32.png" />

    <link rel="icon" type="image/png" sizes="16x16" href="/static/favicon-16x16.png" />

    <link rel="manifest" href="/static/site.webmanifest" />

    <title>Bookmarks | Login</title>

  </head>

  <body>

    <div class="header">

      <a href="/" class="logo">BOOKMARKS</a>

    </div>

    {% if let Some(err) = error %}

    <p class="error">{{ err }}</p>

    {% endif %}

    <form class="form" method="POST" action="/login">

      <div class="form-field">

        <label for="password">Password</label>

        <input type="password" id="password" name="password" required autofocus />

      </div>

      <div class="form-actions">

        <button type="submit">Login</button>

      </div>

    </form>

  </body>

</html>

{"name":"","short_name":"","icons":[{"src":"/android-chrome-192x192.png","sizes":"192x192","type":"image/png"},{"src":"/android-chrome-512x512.png","sizes":"512x512","type":"image/png"}],"theme_color":"#ffffff","background_color":"#ffffff","display":"standalone"}

/* feeds — app-specific styles.

 * Shared reset / tokens / components come from /assets/darkmatter.css.

 */

/* The logo wraps an h1 in feeds markup. */

.logo h1 {

  font-size: 28px;

  font-weight: 700;

  text-transform: uppercase;

}

.about {

  display: flex;

  flex-direction: column;

  gap: 0.5rem;

  font-size: 14px;

  line-height: 1.25rem;

}

/* Feeds list */

.feeds-list {

  width: 100%;

  display: flex;

  flex-direction: column;

  gap: 1.5rem;

}

.feed-item {

  display: flex;

  flex-direction: column;

  gap: 0.5rem;

  padding: 1rem 0;

  border-bottom: 1px solid #333;

}

.feed-item:last-child {

  border-bottom: none;

}

.feed-meta {

  display: flex;

  justify-content: space-between;

  align-items: center;

  font-size: 12px;

  opacity: 0.5;

}

.feed-source {

  font-weight: 700;

}

.feed-title {

  font-size: 16px;

  font-weight: 400;

  line-height: 1.4;

}

.feed-title a {

  text-decoration: none;

}

.feed-author {

  font-size: 12px;

  opacity: 0.5;

  font-style: italic;

}

#feed-urls {

  font-size: 12px;

  opacity: 0.5;

}

.no-feeds,

#loading {

  text-align: center;

  opacity: 0.5;

  padding: 2rem;

}

#error {

  text-align: center;

  padding: 2rem;

}

/* Admin forms */

.admin-form {

  display: flex;

  flex-direction: column;

  gap: 0.75rem;

  width: 100%;

}

.admin-form h3 {

  font-size: 14px;

  font-weight: 400;

  opacity: 0.5;

}

.admin-notice,

.hint {

  font-size: 12px;

  opacity: 0.5;

  line-height: 1.4;

}

/* Discover panel */

.discover-row {

  display: flex;

  gap: 0.5rem;

  width: 100%;

}

.discover-row input {

  flex: 1;

}

.discover-status {

  font-size: 12px;

}

.discover-results {

  display: flex;

  flex-direction: column;

  gap: 0.25rem;

  width: 100%;

}

.discover-result-item {

  background: #121113;

  color: #ffffff;

  border: 1px solid #333;

  padding: 8px 10px;

  font-size: 12px;

  text-align: left;

  cursor: pointer;

  width: 100%;

  white-space: nowrap;

  overflow: hidden;

  text-overflow: ellipsis;

  opacity: 0.7;

  border-radius: 0;

  -webkit-appearance: none;

  appearance: none;

}

.discover-result-item:hover {

  border-color: #555;

  opacity: 1;

}

.discover-result-item.active {

  border-color: #ffffff;

  opacity: 1;

}

/* Admin subs */

.admin-subs {

  width: 100%;

  display: flex;

  flex-direction: column;

  gap: 1rem;

}

.admin-subs h3 {