config

Module: config

Contents

Structs

• CaConfig - Certificate authority directory settings.
• ConnectRelayConfig - Timeout controls for CONNECT tunnel and MITM relay sessions.
• CredentialConfig - Credential injection entry for a single external target.
• HttpsMitmConfig - HTTPS MITM controls for the HTTP proxy interceptor.
• InterceptorConfig - Interceptor settings.
• LocalExecConfig - Configuration for the local-exec governance UDS endpoint.
• LogConfig - Log settings sourced from the TOML file.
• PolicyConfig - Policy source settings.
• SidecarConfig - Top-level sidecar configuration deserialized from TOML.

Enums

• CredentialMode - Credential injection mode selector.
• CredentialTransform - Optional transformation applied to resolved credential material before
• InterceptorMode - Interception mode selector.
• SidecarMode - Enforcement mode for the sidecar.

---

firma_sidecar::config::CaConfig

Struct

Certificate authority directory settings.

Trait Implementations:

• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> CaConfig

firma_sidecar::config::ConnectRelayConfig

Struct

Timeout controls for CONNECT tunnel and MITM relay sessions.

Trait Implementations:

• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> ConnectRelayConfig

firma_sidecar::config::CredentialConfig

Struct

Credential injection entry for a single external target.

Each entry selects a mode (basic or vault) and provides the fields that mode requires. At proxy time, matching outbound requests have the specified header injected.

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> CredentialConfig
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_sidecar::config::CredentialMode

Enum

Credential injection mode selector.

Variants:

• Basic - Static credential read from an environment variable at startup.
• Vault - Secret file rendered by Vault Agent, read from disk per-call.

Traits: Copy, Eq

Trait Implementations:

• PartialEq
  • fn eq(self: &Self, other: &CredentialMode) -> bool
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> CredentialMode
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> CredentialMode

firma_sidecar::config::CredentialTransform

Enum

Optional transformation applied to resolved credential material before injection.

Variants:

• GithubPatBasic - Render a GitHub PAT as the Basic auth value accepted by Git smart HTTP:

Traits: Eq, Copy

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• PartialEq
  • fn eq(self: &Self, other: &CredentialTransform) -> bool
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> CredentialTransform

firma_sidecar::config::HttpsMitmConfig

Struct

HTTPS MITM controls for the HTTP proxy interceptor.

When disabled, HTTPS CONNECT requests are handled as blind tunnels. When enabled, hosts matched by intercept_hosts are decrypted and re-encrypted by the sidecar.

Methods:

• fn is_active(self: &Self) -> bool - Returns true when MITM interception is effectively in force.
• fn with_enabled(self: Self, enabled: bool) -> Self - Sets whether TLS MITM interception is enabled.
• fn with_intercept_hosts(self: Self, hosts: Vec<String>) -> Self - Replaces the host patterns that should be intercepted.
• fn with_bypass_hosts(self: Self, hosts: Vec<String>) -> Self - Replaces the host patterns that bypass interception.
• fn with_strict_hosts(self: Self, hosts: Vec<String>) -> Self - Replaces the host patterns whose interception failures are hard denials.

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> HttpsMitmConfig
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self

firma_sidecar::config::InterceptorConfig

Struct

Interceptor settings.

Selects the interception mode and supplies mode-specific parameters:

Mode	Required fields
http_proxy	listen_addr
grpc	listen_addr
unix_socket	socket_path (defaults to the lifecycle runtime layout)

drain_timeout_secs is shared across all modes.

Fields:

• mode: InterceptorMode - Interception mode. Default: http_proxy.
• listen_addr: std::net::SocketAddr - Socket address used by http_proxy and grpc modes.
• socket_path: Option<std::path::PathBuf> - Path to the Unix domain socket file, used by unix_socket
• https_mitm: HttpsMitmConfig - HTTPS MITM settings used by the HTTP proxy interceptor.

Methods:

• fn max_decompressed_body_bytes(self: &Self) -> usize

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> InterceptorConfig
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self

firma_sidecar::config::InterceptorMode

Enum

Interception mode selector.

Determines which transport the sidecar uses to capture outbound agent traffic.

Variants:

• HttpProxy - Pingora-based HTTP forward proxy. The agent sets
• Grpc - Tonic gRPC hook server. The agent calls the Intercept RPC
• UnixSocket - Unix domain socket. Avoids TCP port binding in containers.

Traits: Copy, Eq

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• PartialEq
  • fn eq(self: &Self, other: &InterceptorMode) -> bool
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> InterceptorMode
• Default
  • fn default() -> Self
• Display
  • fn fmt(self: &Self, f: & mut fmt::Formatter) -> fmt::Result

firma_sidecar::config::LocalExecConfig

Struct

Configuration for the local-exec governance UDS endpoint.

When present in SidecarConfig, the sidecar binds an additional Unix domain socket that firma-run clients contact for pre-execution governance decisions. This is the server-side counterpart to the sidecar_local_exec section in the firma-run profile config.

Trait Implementations:

• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Clone
  • fn clone(self: &Self) -> LocalExecConfig

firma_sidecar::config::LogConfig

Struct

Log settings sourced from the TOML file.

The log level set here acts as the base; CLI args (--log-level) override it.

Trait Implementations:

• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> LogConfig

firma_sidecar::config::PolicyConfig

Struct

Policy source settings.

Fields:

• dir: std::path::PathBuf - Directory containing .cedar policy files.

Trait Implementations:

• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> PolicyConfig

firma_sidecar::config::SidecarConfig

Struct

Top-level sidecar configuration deserialized from TOML.

Contains both infrastructure settings (interceptor, policy, CA, logging, credentials) and enforcement-engine settings (mapping, capability validation, constraint enforcement) via [EnforcementConfig].

Fields:

• mode: SidecarMode - Enforcement mode: "enforce" (default) or "monitor".
• interceptor: InterceptorConfig - Interceptor settings (mode, listen address or socket path,
• policy: PolicyConfig - Policy directory and optional authority URL.
• connector: ConnectorConfig - Outbound connector settings (default timeout + per-host
• authority: AuthorityConfig - Background Authority stream client tuning.
• capability_seed: CapabilitySeedConfig - Static capability provisioning for the demo path. Until the
• audit: AuditConfig - Audit event emitter settings.
• http_secret_providers: Vec<firma_secret_provider::spec::http::HttpIntegrationSpec<firma_core::SecretMatcher>> - HTTP secret-provider registry for MITM interception — a distinct
• secret_gateway: firma_secret_provider::gateway::client::config::GatewayClientConfig - Tunable timeouts and limits for the secret-gateway client used to

Methods:

• fn load_from_path(path: &std::path::Path) -> Result<Self, String> - Load a sidecar configuration from a TOML file and validate it.
• fn validate(self: &Self) -> Result<(), String> - Validate the entire configuration tree.
• fn rebase_defaults(self: & mut Self, config_dir: &std::path::Path) - Re-base every relative resource path against config_dir;

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> SidecarConfig
• Default
  • fn default() -> SidecarConfig
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>

firma_sidecar::config::SidecarMode

Enum

Enforcement mode for the sidecar.

enforce (default): normal fail-closed operation — DENY blocks the call. monitor: observe-only — all calls are allowed through, but the pipeline still classifies and evaluates every request. Decisions that would have been DENY are logged as ALLOW with a monitor_mode: <reason> annotation so operators can audit traffic before tightening policy.

Never deploy monitor to production. Monitor mode is gated behind the FIRMA_ALLOW_MONITOR_MODE=1 environment variable: setting mode = "monitor" without that opt-in downgrades to enforce at startup with an error log, so a dev config left on monitor cannot accidentally bypass enforcement in production. When honored, the sidecar emits a startup warning.

Variants:

• Enforce - Normal fail-closed enforcement (default).
• Monitor - Observe-only: classify and log every call, but never block.

Traits: Eq

Trait Implementations:

• Default
  • fn default() -> SidecarMode
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• PartialEq
  • fn eq(self: &Self, other: &SidecarMode) -> bool
• Clone
  • fn clone(self: &Self) -> SidecarMode