config

Module: config

Contents

Structs

• AuthorityConfig - Authority configuration loaded from TOML file and/or environment variables.
• AuthorityConfigBuilder - Assembles a validated [AuthorityConfig].
• AuthorityTlsConfig - TLS configuration for the Authority gRPC server.

Enums

• AuthorityConfigError - Error validating an [AuthorityConfig].
• ConfigError

---

firma_authority::config::AuthorityConfig

Struct

Authority configuration loaded from TOML file and/or environment variables.

The field shape and default values live in [firma_config_schema::authority::AuthorityConfig]; this type adds the Authority’s behavior: path re-basing against the config directory and FIRMA_AUTHORITY_-prefixed environment overrides, which take precedence over TOML values (e.g., FIRMA_AUTHORITY_LISTEN_ADDR).

Fields are private: the only way to obtain an AuthorityConfig is [AuthorityConfigBuilder::build], which validates runtime and cross-field invariants. An invalid AuthorityConfig therefore cannot be constructed; read access is through the accessors below.

This type is deliberately not Serialize: the wire representation is [schema::AuthorityConfig], obtained via [AuthorityConfig::to_schema].

Methods:

• fn from_resolved_section(resolved: &firma_config_loader::ResolvedConfig) -> Result<Option<Self>, ConfigError> - Load Authority configuration from the [authority] section of a
• fn to_schema(self: &Self) -> Result<schema::AuthorityConfig, ConfigError> - Map back to the behavior-free [schema::AuthorityConfig] wire shape.
• fn listen_addr(self: &Self) -> &str - gRPC listen address.
• fn policy_dir(self: &Self) -> &Path - Directory of .cedar policies streamed to sidecars for enforcement.
• fn schema_path(self: &Self) -> Option<&Path> - Optional override path to the Cedar schema file.
• fn revocation_file(self: &Self) -> &Path - Path to the revocation file.
• fn max_ttl_seconds(self: &Self) -> NonZeroU32 - Strictly positive maximum token TTL in whole seconds.
• fn key_file(self: &Self) -> &Path - Path to the Ed25519 signing key file.
• fn bundle_ttl_seconds(self: &Self) -> NonZeroU32 - Strictly positive policy bundle TTL advertised to sidecars in whole seconds.
• fn tls(self: &Self) -> &AuthorityTlsConfig - TLS configuration.

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> AuthorityConfig
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_authority::config::AuthorityConfigBuilder

Struct

Assembles a validated [AuthorityConfig].

The builder retains the schema representation while applying path rebasing and FIRMA_AUTHORITY_-prefixed environment overrides. build then converts durations to the Authority’s whole-second runtime shape and validates cross-field invariants. A built AuthorityConfig is therefore always valid: nothing after build mutates or re-validates it.

Typical order is rebase, then env overrides (kept verbatim), then build:

let config = AuthorityConfigBuilder::from_toml_str(&body)?
    .rebase_defaults(config_dir)
    .apply_env_overrides()?
    .build()?;

Methods:

• fn new(schema: schema::AuthorityConfig) -> Self - Start from a schema representation (typically deserialized from TOML).
• fn from_toml_str(contents: &str) -> Result<Self, toml::de::Error> - Start from an [authority] TOML fragment.
• fn rebase_defaults(self: Self, config_dir: &std::path::Path) -> Self - Re-base the config’s relative resource paths against config_dir.
• fn listen_addr<impl Into<String>>(self: Self, addr: impl Trait) -> Self - Override the listen address on the in-progress config.
• fn without_tls(self: Self) -> Self - Clear all TLS settings on the in-progress config.
• fn build(self: Self) -> Result<AuthorityConfig, AuthorityConfigError> - Validate the fully-resolved config and return it.

Trait Implementations:

• Default
  • fn default() -> Self - Start from the schema defaults (a valid, TLS-free configuration).

firma_authority::config::AuthorityConfigError

Enum

Error validating an [AuthorityConfig].

Variants:

• DurationOutOfRange{ field: &'static str } - A human-readable duration exceeds the downstream whole-second integer range.
• DurationNotWholeSeconds{ field: &'static str } - A human-readable duration contains a fractional second.
• TlsPairMismatch - tls_cert_path and tls_key_path were not both set or both unset.
• MtlsPairMismatch - mtls_client_ca_cert_path and authorized_clients_path were not paired.
• MtlsRequiresServerTls - mTLS was configured without the base server TLS cert/key.

Traits: Eq, Error

Trait Implementations:

• Display
  • fn fmt(self: &Self, __formatter: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• PartialEq
  • fn eq(self: &Self, other: &AuthorityConfigError) -> bool
• Clone
  • fn clone(self: &Self) -> AuthorityConfigError
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_authority::config::AuthorityTlsConfig

Struct

TLS configuration for the Authority gRPC server.

Both values are required together to enable TLS. The corresponding wire keys (tls_cert_path, tls_key_path, …) live on [schema::AuthorityConfig]; these fields are the validated in-memory representation.

Methods:

• fn mtls_client_ca_cert_path(self: &Self) -> Option<&Path> - Path to the PEM CA certificate used to verify Sidecar mTLS client certs.
• fn mtls_client_ca_key_path(self: &Self) -> Option<&Path> - Path to the PEM CA private key used to sign new Sidecar client certs.

Trait Implementations:

• Default
  • fn default() -> AuthorityTlsConfig
• Clone
  • fn clone(self: &Self) -> AuthorityTlsConfig
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_authority::config::ConfigError

Enum

Variants:

• IoError{ path: std::path::PathBuf, reason: String }
• ParseError{ path: std::path::PathBuf, reason: String }
• InvalidEnvironmentVariable{ name: &'static str, field: &'static str, reason: String }
• DurationNotPositive{ field: &'static str }

Traits: Error

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Display
  • fn fmt(self: &Self, __formatter: & mut ::core::fmt::Formatter) -> ::core::fmt::Result