sidecar

Module: sidecar

Contents

Modules

• audit - Schema for [sidecar.audit].
• authority - Schema for [sidecar.authority] and its [sidecar.authority.credentials].
• capability_seed - Schema for [sidecar.capability_seed].
• connector - Schema for [sidecar.connector].
• enforcement - Schema for the enforcement-engine sections of [sidecar].
• infra - Schema for the sidecar’s top-level infrastructure sections:
• interceptor - Schema for [sidecar.interceptor] and its sub-tables.
• local_exec - Schema for [sidecar.local_exec].
• revocation - Schema for [sidecar.revocation].

Structs

• SidecarConfig - Top-level sidecar configuration, deserialized from the [sidecar] section

---

firma_config_schema::sidecar::SidecarConfig

Struct

Top-level sidecar configuration, deserialized from the [sidecar] section of firma.toml.

Contains both infrastructure settings (interceptor, policy, CA, credentials) and enforcement-engine settings (constraint enforcement).

Fields:

• interceptor: InterceptorConfig - Interceptor settings (mode, listen address or socket path, drain
• policy: PolicyConfig - Policy directory.
• ca: CaConfig - Certificate authority directory.
• credentials: std::collections::HashMap<String, CredentialConfig> - Per-target credential injection entries, keyed by an arbitrary label
• connector: ConnectorConfig - Outbound connector settings (default timeout + per-host overrides with
• authority: AuthorityConfig - Background Authority stream client tuning.
• constraint_enforcement: ConstraintEnforcementConfig - Constraint enforcement settings.
• revocation: RevocationConfig - Revocation cache settings (bloom filter + LRU sizing).
• capability_seed: CapabilitySeedConfig - Static capability provisioning seed files.
• audit: AuditConfig - Audit event emitter settings.
• local_exec: Option<LocalExecConfig> - Local-exec governance endpoint configuration. When absent, the
• http_secret_providers: Vec<crate::secret_provider::http::HttpSecretProviderConfig> - HTTP secret-provider registry for MITM interception.
• secret_gateway: crate::gateway::GatewayConfig - Secret-gateway client tuning.

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> Self
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private229::Result<<__S as >::Ok, <__S as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private229::Result<Self, <__D as >::Error>
• Default
  • fn default() -> Self

Module: audit

Schema for [sidecar.audit].

Representation only. firma-sidecar validates the sink-specific required fields and the signing-key source.

Module: authority

Schema for [sidecar.authority] and its [sidecar.authority.credentials].

Schema value types own intrinsic invariants. firma-sidecar validates cross-field constraints, parses the url into an endpoint, and resolves the pre-shared-key source.

Module: capability_seed

Schema for [sidecar.capability_seed].

Representation only. Lists pre-issued capability seed files the sidecar loads at startup. firma-sidecar validates that every path is non-empty and requires its configured parent and resolved target to stay beneath the selected runtime state’s capabilities/ directory.

Module: connector

Schema for [sidecar.connector].

Describes the default dispatch timeout applied to unconfigured hosts and the per-host overrides. Schema value types own intrinsic invariants, including non-zero rate limits; firma-sidecar validates host names and duplicate hosts.

Module: enforcement

Schema for the enforcement-engine sections of [sidecar].

These sections are flattened at the top level of the sidecar config ([sidecar.constraint_enforcement]). The session-state capacity is a non-zero type, so a zero fails while the config is deserialized.

Module: infra

Schema for the sidecar’s top-level infrastructure sections: [sidecar.policy], [sidecar.ca], and [sidecar.credentials.*].

Representation only. firma-sidecar validates these values and parses them into its own configuration types (for example, the credential header parses into an http::HeaderName).

Module: interceptor

Schema for [sidecar.interceptor] and its sub-tables.

Schema value types own intrinsic invariants. firma-sidecar validates cross-field constraints and parses these values into its own interceptor configuration types.

Module: local_exec

Schema for [sidecar.local_exec].

When present, the sidecar binds a UDS endpoint that firma-run clients contact for pre-execution governance decisions. Schema value types own intrinsic invariants; firma-sidecar validates the absolute socket path and constraints imposed by the millisecond wire representation.

Module: revocation

Schema for [sidecar.revocation].

Schema value types own the non-zero capacities; firma-sidecar validates that the false-positive rate falls in (0, 1) and builds its revocation store configuration from these values.