Packages

One crate per package. What you do not enable is never compiled.

Everything optional is a feature flag on the rustlavel meta-crate. Add what you need and nothing else reaches your binary:

cargo add rustlavel --features db,view,auth

Or take a single package on its own, the way you would composer require one Illuminate component:

cargo add rustlavel-db

The full list

Not packages: the middleware in the box

Several things an API needs are not feature flags, because they live in rustlavel-http and are always compiled. Nothing is on until you add it:

App::new()?
    .middleware(TrustProxies::from_config(app.config()))
    .middleware(RequestId::new())
    .middleware(Cors::from_config(app.config()))
    .middleware(Compress::new())
    .middleware(ETag::new())
    .middleware(Timeout::seconds(10))
    .middleware(BodyLimit::kilobytes(64))
    .plugin(Health::new())

TrustProxies is the one to reach for first behind a load balancer. Without it req.ip() is the balancer’s address — true, but not useful. It is opt-in on purpose: reading X-Forwarded-For from anyone who sends it does not tell you where a request came from, it lets the sender choose, and the rate limiter keys on exactly that value.

Two packages that are split on purpose

rustlavel-oauth holds the wire vocabulary — scopes, the RFC 6749 error codes, PKCE, the token response — and the client half, the one you use to sign users in through Google or GitHub. rustlavel-oauth-provider depends on it for those types, so both ends of the protocol agree on the format by construction rather than by review.

rustlavel-auth carries its own simpler Scopes type for API tokens. That duplication is deliberate: personal access tokens must not drag an OAuth dependency into the authentication crate.

The starter kit

rustlavel new app --with auth-kit is scaffolding rather than a feature flag. It turns on the packages it needs — auth, db, view, validation, rbac, webauthn, cache, mail — and writes the controllers, views, routes and migrations into the project, where they belong to you. The guide covers what you get.

Databases

PostgreSQL, MySQL and SQL Server, each wire protocol written here, each with TLS. Oracle is deliberately excluded — its network protocol has never been published, so a driver means either wrapping the proprietary OCI library or a multi-year reverse-engineering effort, and neither fits a framework whose premise is that the protocols are written here.