obgw

Documentation

Overview

Command obgw is a reference order-entry gateway: a real TCP server speaking the binary protocol in internal/wire, in front of one matching engine.

It exists to demonstrate the seam, not to be deployed. What it shows is that the library's pieces — the Runner's fire-and-forget enqueue, the gateway's admission control, the event stream, and per-account outbound streams that survive a disconnect — compose into a working venue edge. What it deliberately omits is what a real deployment must decide for itself: multi-symbol routing and an HA topology (docs/REPLICATION.md and examples/replication are the reference for the latter).

Authentication defaults to deny. With no accounts configured, every login is rejected — an empty configuration must not produce an open venue.

Credentials and transport

-tls-cert and -tls-key wrap every listener. Without them the venue speaks plaintext and sends passwords in the clear, which it says on startup — a thing to do on a loopback interface during development and nowhere else.

Credentials come from -accounts-file in preference to -accounts, because anything on a command line is in the host's process list for every user on the box. The file's permissions are checked and a world-readable one draws a warning. Neither path ever logs a secret: a malformed entry is reported by line number, never by content.

An entry is either "user:password" or "user:sha256:<64 hex>", the latter produced by -hash-secret. Whichever form arrives, the process's credential table holds digests: a plaintext entry is hashed at load and the venue says how many it had to. What that does not fix is the file itself — a plaintext entry is still plaintext on disk — and the transient copies parsing leaves behind, which are garbage to the collector, not zeroed. An inline -accounts string is worse: the flag package keeps it reachable for the life of the process, digest table or not.

Where credentials LIVE is still yours. Config.Auth takes an orderentry.Authenticator; the wiring here is HashedAccounts, whose documentation states what a fast hash does and does not buy, and there is still no rotation, revocation or expiry behind it.

obgw -addr :9000 -symbol BTC-USD -accounts-file /etc/obgw/accounts -admin 127.0.0.1:9100

The admin listener is a separate port on purpose: it is for whoever runs the venue, and it should be reachable from a monitoring network that participants cannot reach at all.

Durability window

Commands are journalled before they are applied, so the log is never missing something the book did. That is ordered against APPLY, not against the acknowledgement a client receives: by default the log is group-committed every 20ms, so a process that dies inside that window can lose an order it already acknowledged. -sync-every-command closes the window by fsyncing each command before applying it, which is correct and roughly 210× more expensive because the fsync lands on the matching goroutine. Pick one deliberately; the default is throughput, and it is stated rather than hidden.