9. Serving the web (this site)

The whole stack of this site: routes with :param captures, a middleware chain, handler classes, @table persistence, and server-rendered HTML — one binary behind a proxy. This is the site's own main, abbreviated:

fn main(args: multi Text) -> Int {
  seed_if_empty();
  let app = App { middleware: [], routes: [] };
  app.use_mw(Mw { m: Logging {} });
  app.get("/",            Home {});
  app.get("/ch/:slug",    ShowChapter {});
  app.post("/admin/ch/:slug", AdminEdit { token: token });
  return app.serve("127.0.0.1", port);
}

The admin route checks its bearer token in the handler — mechanism lives in the framework (bearer_token, constant-time ct_eq), POLICY stays in the app. Try editing this chapter: curl -X POST -H "authorization: Bearer ..." -d "title=...&body=..." /admin/ch/serving.