interceptor

Module: sidecar::interceptor

Contents

Structs

• ConnectRelayConfig - Timeout controls for CONNECT tunnel and MITM relay sessions.
• HttpsMitmConfig - HTTPS MITM controls for the HTTP proxy interceptor.
• InterceptorConfig - Interceptor settings.

Enums

• InterceptorMode - Interception mode selector.

Functions

• default_socket_path - Default Unix domain socket path, derived from XDG_RUNTIME_DIR/HOME.

---

firma_config_schema::sidecar::interceptor::ConnectRelayConfig

Struct

Timeout controls for CONNECT tunnel and MITM relay sessions.

Fields:

• setup_timeout: crate::utils::NonZeroDuration - Timeout for CONNECT upgrade and upstream connect/TLS setup.
• session_max: crate::utils::NonZeroDuration - Hard cap for the full tunnel/MITM session lifetime.

Trait Implementations:

• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> ConnectRelayConfig
• Default
  • fn default() -> Self
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>

firma_config_schema::sidecar::interceptor::HttpsMitmConfig

Struct

HTTPS MITM controls for the HTTP proxy interceptor.

CA material has one location: firma-ca.crt and firma-ca.key under sidecar.ca.dir. The paths are not configurable here, so a caller that controls sidecar.ca.dir — such as firma run, which pins it to the per-run entry — also controls where the private key lands.

Fields:

• enabled: bool - Enables TLS MITM interception for selected hosts.
• intercept_hosts: Vec<String> - Host patterns that should be intercepted (supports * wildcard).
• bypass_hosts: Vec<String> - Host patterns that should bypass interception and use CONNECT tunnel.
• cert_ttl: std::time::Duration - Dynamic leaf certificate TTL.
• cert_cache_capacity: usize - Maximum number of cached leaf certificates.
• strict_hosts: Vec<String> - Host patterns that must be intercepted; failures are hard deny.

Trait Implementations:

• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> HttpsMitmConfig
• Default
  • fn default() -> Self
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_config_schema::sidecar::interceptor::InterceptorConfig

Struct

Interceptor settings.

Fields:

• mode: InterceptorMode - Interception mode. Default: platform-dependent.
• listen_addr: std::net::SocketAddr - Socket address used by http_proxy and grpc modes.
• socket_path: Option<std::path::PathBuf> - Path to the Unix domain socket file, used by unix_socket mode.
• drain_timeout: crate::utils::NonZeroDuration - Time to wait for in-flight requests to drain on shutdown.
• max_request_body_size: bytesize::ByteSize - Maximum request body size accepted by proxy interceptors.
• max_decompressed_body_size: bytesize::ByteSize - Maximum size a single request or response body may expand to when
• connect_relay: ConnectRelayConfig - CONNECT/MITM relay timeout controls.
• https_mitm: HttpsMitmConfig - HTTPS MITM settings used by the HTTP proxy interceptor.
• total_body_budget: bytesize::ByteSize - Global ceiling for the total bytes of request bodies buffered

Trait Implementations:

• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> InterceptorConfig
• Default
  • fn default() -> Self
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_config_schema::sidecar::interceptor::InterceptorMode

Enum

Interception mode selector.

Determines which transport the sidecar uses to capture outbound agent traffic.

Variants:

• HttpProxy - HTTP forward proxy (tokio/hyper listener). The agent sets
• Grpc - Tonic gRPC hook server. The agent calls the Intercept RPC directly.
• UnixSocket - Unix domain socket. Avoids TCP port binding in containers.

Traits: Eq, Copy

Trait Implementations:

• PartialEq
  • fn eq(self: &Self, other: &InterceptorMode) -> bool
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Display
  • fn fmt(self: &Self, f: & mut fmt::Formatter) -> fmt::Result
• Clone
  • fn clone(self: &Self) -> InterceptorMode
• Default
  • fn default() -> Self
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>

firma_config_schema::sidecar::interceptor::default_socket_path

Function

Default Unix domain socket path, derived from XDG_RUNTIME_DIR/HOME.

fn default_socket_path() -> std::path::PathBuf