config

Module: config

Contents

Structs

• CaConfig - Certificate authority directory settings.
• ConnectRelayConfig - Timeout controls for CONNECT tunnel and MITM relay sessions.
• CredentialConfig - Credential injection entry for a single external target.
• HttpsMitmConfig - HTTPS MITM controls for the HTTP proxy interceptor.
• InterceptorConfig - Interception mode selector.
• LocalExecConfig - Configuration for the local-exec governance UDS endpoint.
• PolicyConfig - Policy source settings.
• SidecarConfig - Top-level sidecar configuration deserialized from TOML.

Enums

• CaConfigError - Error validating a [CaConfig].
• CredentialConfigError - Error validating a [CredentialConfig].
• DnsHostnameError - Error validating a DNS hostname.
• HostPatternError - Error validating a host-pattern list.
• HttpsMitmConfigError - Error validating an [HttpsMitmConfig].
• InterceptorConfigError - Error validating an [InterceptorConfig].
• LocalExecConfigError - Error validating a [LocalExecConfig].
• PolicyConfigError - Error validating a [PolicyConfig].
• SidecarConfigError - Error building or loading a validated [SidecarConfig].

---

firma_sidecar::config::CaConfig

Struct

Certificate authority directory settings.

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• TryFrom
  • fn try_from(s: schema_infra::CaConfig) -> Result<Self, <Self as >::Error>
• Clone
  • fn clone(self: &Self) -> CaConfig
• Default
  • fn default() -> Self

firma_sidecar::config::CaConfigError

Enum

Error validating a [CaConfig].

Variants:

• EmptyDir - sidecar.ca.dir was empty.

Traits: Error, Eq

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Display
  • fn fmt(self: &Self, __formatter: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Clone
  • fn clone(self: &Self) -> CaConfigError
• PartialEq
  • fn eq(self: &Self, other: &CaConfigError) -> bool

firma_sidecar::config::ConnectRelayConfig

Struct

Timeout controls for CONNECT tunnel and MITM relay sessions.

Trait Implementations:

• Default
  • fn default() -> Self
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Clone
  • fn clone(self: &Self) -> ConnectRelayConfig
• From
  • fn from(s: schema_ic::ConnectRelayConfig) -> Self

firma_sidecar::config::CredentialConfig

Struct

Credential injection entry for a single external target.

Each entry selects a mode (basic or vault) and provides the fields that mode requires. At proxy time, matching outbound requests have the specified header injected.

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> CredentialConfig
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• TryFrom
  • fn try_from(s: schema_infra::CredentialConfig) -> Result<Self, <Self as >::Error>

firma_sidecar::config::CredentialConfigError

Enum

Error validating a [CredentialConfig].

Variants:

• EmptyTargetHost - target_host was empty.
• InvalidHeader{ header: String } - header was not a valid HTTP header name.
• PrefixWithTransform - prefix was combined with transform.
• ValueFromEnvRequired - basic mode was selected without value_from_env.
• SecretPathRequired - vault mode was selected without secret_path.

Traits: Error, Eq

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> CredentialConfigError
• PartialEq
  • fn eq(self: &Self, other: &CredentialConfigError) -> bool
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Display
  • fn fmt(self: &Self, __formatter: & mut ::core::fmt::Formatter) -> ::core::fmt::Result

firma_sidecar::config::DnsHostnameError

Enum

Error validating a DNS hostname.

Variants:

• Empty - The hostname was empty.
• TooLong - The hostname exceeded 253 characters.
• EmptyLabel - The hostname contained an empty label.
• LabelTooLong{ label: String } - A label exceeded 63 characters.
• LabelHyphen{ label: String } - A label started or ended with -.
• LabelInvalidChars{ label: String } - A label contained non-DNS characters.

Traits: Eq, Error

Trait Implementations:

• Display
  • fn fmt(self: &Self, __formatter: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Clone
  • fn clone(self: &Self) -> DnsHostnameError
• PartialEq
  • fn eq(self: &Self, other: &DnsHostnameError) -> bool
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_sidecar::config::HostPatternError

Enum

Error validating a host-pattern list.

Variants:

• Empty{ field: &'static str, index: usize } - A pattern entry was empty.
• WildcardMissingSuffix{ field: &'static str, index: usize } - A *. wildcard had no suffix.
• WildcardMultiple{ field: &'static str, index: usize } - A wildcard pattern had more than a single leading *..
• WildcardIpLiteral{ field: &'static str, index: usize } - A wildcard suffix was an IP literal.
• WildcardTooFewLabels{ field: &'static str, index: usize } - A wildcard suffix had fewer than two DNS labels.
• WildcardNotLeading{ field: &'static str, index: usize } - A non-leading * appeared in a pattern.
• Dns{ field: &'static str, index: usize, source: DnsHostnameError } - A pattern was not a valid DNS hostname.

Traits: Eq

Trait Implementations:

• Display
  • fn fmt(self: &Self, __formatter: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Clone
  • fn clone(self: &Self) -> HostPatternError
• PartialEq
  • fn eq(self: &Self, other: &HostPatternError) -> bool
• Error
  • fn source(self: &Self) -> ::core::option::Option<&dyn ::thiserror::__private18::Error>

firma_sidecar::config::HttpsMitmConfig

Struct

HTTPS MITM controls for the HTTP proxy interceptor.

When disabled, HTTPS CONNECT requests are handled as blind tunnels. When enabled, hosts matched by intercept_hosts are decrypted and re-encrypted by the sidecar.

Methods:

• fn is_active(self: &Self) -> bool - Returns true when MITM interception is effectively in force.
• fn with_enabled(self: Self, enabled: bool) -> Self - Sets whether TLS MITM interception is enabled.
• fn with_intercept_hosts(self: Self, hosts: Vec<String>) -> Self - Replaces the host patterns that should be intercepted.
• fn with_bypass_hosts(self: Self, hosts: Vec<String>) -> Self - Replaces the host patterns that bypass interception.
• fn with_strict_hosts(self: Self, hosts: Vec<String>) -> Self - Replaces the host patterns whose interception failures are hard denials.

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> HttpsMitmConfig
• Default
  • fn default() -> Self
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• TryFrom
  • fn try_from(s: schema_ic::HttpsMitmConfig) -> Result<Self, <Self as >::Error>

firma_sidecar::config::HttpsMitmConfigError

Enum

Error validating an [HttpsMitmConfig].

Variants:

• HostPattern(HostPatternError) - A configured host pattern was invalid.
• ZeroCertTtl - cert_ttl was zero while interception was active.
• ZeroCertCacheCapacity - cert_cache_capacity was zero while interception was active.

Traits: Eq

Trait Implementations:

• Display
  • fn fmt(self: &Self, __formatter: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• From
  • fn from(source: HostPatternError) -> Self
• Clone
  • fn clone(self: &Self) -> HttpsMitmConfigError
• PartialEq
  • fn eq(self: &Self, other: &HttpsMitmConfigError) -> bool
• Error
  • fn source(self: &Self) -> ::core::option::Option<&dyn ::thiserror::__private18::Error>

firma_sidecar::config::InterceptorConfig

Struct

Interception mode selector.

Interceptor settings.

Selects the interception mode and supplies mode-specific parameters:

Mode	Required fields
http_proxy	listen_addr
grpc	listen_addr
unix_socket	socket_path (defaults to the lifecycle runtime layout)

drain_timeout is shared across all modes.

Fields:

• mode: firma_config_schema::sidecar::interceptor::InterceptorMode - Interception mode. Default: http_proxy.
• listen_addr: std::net::SocketAddr - Socket address used by http_proxy and grpc modes.
• socket_path: Option<std::path::PathBuf> - Path to the Unix domain socket file, used by unix_socket
• https_mitm: HttpsMitmConfig - HTTPS MITM settings used by the HTTP proxy interceptor.

Methods:

• fn max_decompressed_body_bytes(self: &Self) -> usize

Trait Implementations:

• Default
  • fn default() -> Self
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• TryFrom
  • fn try_from(s: schema_ic::InterceptorConfig) -> Result<Self, <Self as >::Error>
• Clone
  • fn clone(self: &Self) -> InterceptorConfig

firma_sidecar::config::InterceptorConfigError

Enum

Error validating an [InterceptorConfig].

Variants:

• ZeroMaxRequestBody - max_request_body_size was zero.
• MaxRequestBodyTooLarge - max_request_body_size was too large for this platform’s usize.
• ZeroMaxDecompressedBody - max_decompressed_body_size was zero.
• MaxDecompressedBodyTooLarge - max_decompressed_body_size was too large for this platform’s usize.
• ZeroTotalBodyBudget - total_body_budget was zero.
• TotalBodyBudgetTooLarge - total_body_budget was too large for this platform’s usize.
• TotalBodyBudgetBelowRequest - The total body budget was below the per-request maximum.
• HttpsMitm(HttpsMitmConfigError) - The HTTPS MITM settings were invalid.
• SocketPathEmpty - unix_socket mode was selected but socket_path was empty.

Traits: Eq

Trait Implementations:

• Display
  • fn fmt(self: &Self, __formatter: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• From
  • fn from(source: HttpsMitmConfigError) -> Self
• Clone
  • fn clone(self: &Self) -> InterceptorConfigError
• PartialEq
  • fn eq(self: &Self, other: &InterceptorConfigError) -> bool
• Error
  • fn source(self: &Self) -> ::core::option::Option<&dyn ::thiserror::__private18::Error>

firma_sidecar::config::LocalExecConfig

Struct

Configuration for the local-exec governance UDS endpoint.

When present in SidecarConfig, the sidecar binds an additional Unix domain socket that firma-run clients contact for pre-execution governance decisions. This is the server-side counterpart to the sidecar_local_exec section in the firma-run profile config.

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• TryFrom
  • fn try_from(s: schema_le::LocalExecConfig) -> Result<Self, <Self as >::Error>
• Clone
  • fn clone(self: &Self) -> LocalExecConfig

firma_sidecar::config::LocalExecConfigError

Enum

Error validating a [LocalExecConfig].

Variants:

• SocketPathNotAbsolute(std::path::PathBuf) - socket_path was not absolute.
• ZeroTokenTtl - token_ttl was zero.
• RetryAfterBelowOneMillisecond - retry_after was positive but shorter than the millisecond wire unit.
• RetryAfterTooLarge - retry_after cannot be represented by the millisecond wire field.

Traits: Error, Eq

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> LocalExecConfigError
• PartialEq
  • fn eq(self: &Self, other: &LocalExecConfigError) -> bool
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Display
  • fn fmt(self: &Self, __formatter: & mut ::core::fmt::Formatter) -> ::core::fmt::Result

firma_sidecar::config::PolicyConfig

Struct

Policy source settings.

Fields:

• dir: std::path::PathBuf - Directory containing .cedar policy files.

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• TryFrom
  • fn try_from(s: schema_infra::PolicyConfig) -> Result<Self, <Self as >::Error>
• Clone
  • fn clone(self: &Self) -> PolicyConfig
• Default
  • fn default() -> Self

firma_sidecar::config::PolicyConfigError

Enum

Error validating a [PolicyConfig].

Variants:

• EmptyDir - sidecar.policy.dir was empty.

Traits: Eq, Error

Trait Implementations:

• Display
  • fn fmt(self: &Self, __formatter: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Clone
  • fn clone(self: &Self) -> PolicyConfigError
• PartialEq
  • fn eq(self: &Self, other: &PolicyConfigError) -> bool
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_sidecar::config::SidecarConfig

Struct

Top-level sidecar configuration deserialized from TOML.

Contains both infrastructure settings (interceptor, policy, CA, credentials) and enforcement-engine settings (mapping, capability validation, constraint enforcement) via [EnforcementConfig].

Fields:

• mode: firma_config_schema::sidecar::infra::SidecarMode - Enforcement mode: "enforce" (default) or "monitor". Never use
• interceptor: InterceptorConfig - Interceptor settings (mode, listen address or socket path, drain timeout).
• policy: PolicyConfig - Policy directory.
• connector: ConnectorConfig - Outbound connector settings (default timeout + per-host overrides).
• authority: AuthorityConfig - Background Authority stream client tuning.
• capability_seed: CapabilitySeedConfig - Static capability provisioning seed files.
• audit: AuditConfig - Audit event emitter settings.
• http_secret_providers: Vec<firma_secret_provider::spec::http::HttpIntegrationSpec<firma_core::SecretMatcher>> - HTTP secret-provider registry for MITM interception.
• secret_gateway: firma_config_schema::gateway::GatewayConfig - Tunable timeouts and limits for the secret-gateway client.

Methods:

• fn load_from_path(path: &std::path::Path) -> Result<Self, SidecarConfigError> - Load and validate a sidecar configuration from a TOML file.
• fn rebase_defaults(self: & mut Self, config_dir: &std::path::Path) - Re-base every relative resource path against config_dir;

Trait Implementations:

• TryFrom
  • fn try_from(s: firma_config_schema::sidecar::SidecarConfig) -> Result<Self, <Self as >::Error>
• Default
  • fn default() -> SidecarConfig
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Clone
  • fn clone(self: &Self) -> SidecarConfig

firma_sidecar::config::SidecarConfigError

Enum

Error building or loading a validated [SidecarConfig].

Variants:

• Read{ path: std::path::PathBuf, source: std::io::Error } - The config file could not be read.
• Parse{ path: std::path::PathBuf, source: toml::de::Error } - The config file could not be parsed as TOML.
• Interceptor(InterceptorConfigError) - The [sidecar.interceptor] section was invalid.
• Policy(PolicyConfigError) - The [sidecar.policy] section was invalid.
• Ca(CaConfigError) - The [sidecar.ca] section was invalid.
• Credential{ label: String, source: CredentialConfigError } - A [sidecar.credentials.*] entry was invalid.
• Connector(ConnectorConfigError) - The [sidecar.connector] section was invalid.
• Authority(AuthorityConfigError) - The [sidecar.authority] section was invalid.
• Enforcement(EnforcementConfigError) - An enforcement section was invalid.
• Revocation(RevocationConfigError) - The [sidecar.revocation] section was invalid.
• CapabilitySeed(CapabilitySeedConfigError) - The [sidecar.capability_seed] section was invalid.
• Audit(AuditConfigError) - The [sidecar.audit] section was invalid.
• LocalExec(LocalExecConfigError) - The [sidecar.local_exec] section was invalid.
• HttpSecretProvider(firma_secret_provider::spec::http::HttpSecretProviderConfigError) - An [[sidecar.http_secret_providers]] entry was invalid.
• AuthorityEndpoint(AuthorityEndpointError) - The Authority endpoint (url / connect_addr) was invalid.
• AuthorityEndpointMissingHost - A validated Authority endpoint unexpectedly had no host.
• MissingPublicKeyForSeeds - sidecar.capability_seed.paths was non-empty without an Authority public key.
• MissingCaCertForHttps - An https:// Authority URL was configured without a CA certificate.
• InsecureNonLoopbackAuthority - An insecure http:// Authority URL targeted a non-loopback host.

Trait Implementations:

• From
  • fn from(source: CaConfigError) -> Self
• From
  • fn from(source: EnforcementConfigError) -> Self
• From
  • fn from(source: AuthorityConfigError) -> Self
• From
  • fn from(source: ConnectorConfigError) -> Self
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• From
  • fn from(source: AuthorityEndpointError) -> Self
• From
  • fn from(source: InterceptorConfigError) -> Self
• From
  • fn from(source: AuditConfigError) -> Self
• From
  • fn from(source: LocalExecConfigError) -> Self
• Error
  • fn source(self: &Self) -> ::core::option::Option<&dyn ::thiserror::__private18::Error>
• From
  • fn from(source: RevocationConfigError) -> Self
• From
  • fn from(source: PolicyConfigError) -> Self
• From
  • fn from(source: firma_secret_provider::spec::http::HttpSecretProviderConfigError) -> Self
• Display
  • fn fmt(self: &Self, __formatter: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• From
  • fn from(source: CapabilitySeedConfigError) -> Self