authority

Module: sidecar::authority

Contents

Structs

• AuthorityConfig - Tuning for background Authority stream clients.
• SidecarCredentials - Sidecar credentials presented to Authority RPCs: a pre-shared key, or the

---

firma_config_schema::sidecar::authority::AuthorityConfig

Struct

Tuning for background Authority stream clients.

Fields:

• agent_id: Option<String> - Authority-registered TypeID for the agent represented by this Sidecar.
• url: Option<String> - Authority gRPC URL (e.g. https://127.0.0.1:9443). When set, the
• connect_addr: Option<std::net::SocketAddr> - Optional physical TCP destination for the Authority connection.
• connect_timeout: firma_config_utils::NonZeroDuration - Connection timeout.
• reconnect_min_backoff: firma_config_utils::NonZeroDuration - Minimum reconnect backoff.
• reconnect_max_backoff: firma_config_utils::NonZeroDuration - Maximum reconnect backoff.
• revocation_readiness_grace: std::time::Duration - How long a connection may deliver no revocation set before the Sidecar
• revocation_fail_closed_on_disconnect: bool - Flip revocation readiness back to false on disconnect.
• public_key_path: Option<std::path::PathBuf> - Path to the Authority’s PASETO v4 Ed25519 public key.
• ca_cert_paths: Vec<std::path::PathBuf> - Paths to PEM-encoded CA certificates used to verify the Authority’s
• disable_platform_roots: bool - Never verify the Authority against the platform’s trusted roots. That
• allow_insecure_remote_authority: bool - Allow an insecure plain http:// authority URL to a non-loopback host.
• tls_client_cert_path: Option<std::path::PathBuf> - Path to the PEM-encoded mTLS client certificate presented to the
• tls_client_key_path: Option<std::path::PathBuf> - Path to the PEM-encoded mTLS client private key. Must be set together
• credentials: Option<SidecarCredentials> - Credentials presented on each outbound Authority RPC.

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private229::Result<<__S as >::Ok, <__S as >::Error>
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private229::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> Self
• Default
  • fn default() -> Self

firma_config_schema::sidecar::authority::SidecarCredentials

Struct

Sidecar credentials presented to Authority RPCs: a pre-shared key, or the runtime credential of one run.

Fields:

• workspace_id: String - Workspace the Sidecar belongs to.
• sidecar_id: String - Authority-assigned Sidecar identity.
• pre_shared_key_env: Option<String> - Environment variable containing the pre-shared key.
• pre_shared_key_path: Option<std::path::PathBuf> - File containing the pre-shared key.
• run_id: Option<String> - The run this Sidecar serves, when it authenticates with that
• runtime_credential_env: Option<String> - Environment variable the Sidecar reads its runtime credential from at

Traits: Eq

Trait Implementations:

• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private229::Result<<__S as >::Ok, <__S as >::Error>
• PartialEq
  • fn eq(self: &Self, other: &Self) -> bool
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private229::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> Self
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result