config

Module: config

Contents

Structs

• CaConfig - Certificate authority directory settings.
• ConnectRelayConfig - Timeout controls for CONNECT tunnel and MITM relay sessions.
• CredentialConfig - Credential injection entry for a single external target.
• HttpsMitmConfig - HTTPS MITM controls for the HTTP proxy interceptor.
• InterceptorConfig - Interceptor settings.
• LocalExecConfig - Configuration for the local-exec governance UDS endpoint.
• LogConfig - Log settings sourced from the TOML file.
• PolicyConfig - Policy source settings.
• SidecarConfig - Top-level sidecar configuration deserialized from TOML.

Enums

• CredentialMode - Credential injection mode selector.
• InterceptorMode - Interception mode selector.
• SidecarMode - Enforcement mode for the sidecar.

---

firma_sidecar::config::CaConfig

Struct

Certificate authority directory settings.

Fields:

• dir: std::path::PathBuf - Directory containing CA key material.

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> CaConfig
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>

firma_sidecar::config::ConnectRelayConfig

Struct

Timeout controls for CONNECT tunnel and MITM relay sessions.

Fields:

• setup_timeout_secs: u64 - Timeout for CONNECT upgrade and upstream connect/TLS setup.
• session_max_secs: u64 - Hard cap for the full tunnel/MITM session lifetime.

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> ConnectRelayConfig
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self

firma_sidecar::config::CredentialConfig

Struct

Credential injection entry for a single external target.

Each entry selects a mode (basic or vault) and provides the fields that mode requires. At proxy time, matching outbound requests have the specified header injected.

Fields:

• mode: CredentialMode - Injection mode. Default: basic.
• target_host: String - Host that this credential applies to.
• header: String - HTTP header name to inject (e.g. Authorization).
• prefix: Option<String> - Optional prefix prepended to the resolved value
• value_from_env: Option<String> - Environment variable whose value is injected (basic mode).
• secret_path: Option<std::path::PathBuf> - Filesystem path to the secret file rendered by Vault Agent

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> CredentialConfig
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_sidecar::config::CredentialMode

Enum

Credential injection mode selector.

Variants:

• Basic - Static credential read from an environment variable at startup.
• Vault - Secret file rendered by Vault Agent, read from disk per-call.

Traits: Copy, Eq

Trait Implementations:

• PartialEq
  • fn eq(self: &Self, other: &CredentialMode) -> bool
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> CredentialMode
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> CredentialMode

firma_sidecar::config::HttpsMitmConfig

Struct

HTTPS MITM controls for the HTTP proxy interceptor.

When disabled, HTTPS CONNECT requests are handled as blind tunnels. When enabled, hosts matched by intercept_hosts are decrypted and re-encrypted by the sidecar.

Fields:

• enabled: bool - Enables TLS MITM interception for selected hosts.
• ca_cert_path: Option<std::path::PathBuf> - Optional explicit CA certificate path. Defaults under ca.dir.
• ca_key_path: Option<std::path::PathBuf> - Optional explicit CA private key path. Defaults under ca.dir.
• intercept_hosts: Vec<String> - Host patterns that should be intercepted (supports * wildcard).
• bypass_hosts: Vec<String> - Host patterns that should bypass interception and use CONNECT tunnel.
• cert_ttl_secs: u64 - Dynamic leaf certificate TTL in seconds.
• cert_cache_capacity: usize - Maximum number of cached leaf certificates.
• strict_hosts: Vec<String> - Host patterns that must be intercepted; failures are hard deny.

Methods:

• fn is_active(self: &Self) -> bool - Returns true when MITM interception is effectively in force.

Trait Implementations:

• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> HttpsMitmConfig

firma_sidecar::config::InterceptorConfig

Struct

Interceptor settings.

Selects the interception mode and supplies mode-specific parameters:

Mode	Required fields
http_proxy	listen_addr
grpc	listen_addr
unix_socket	socket_path

drain_timeout_secs is shared across all modes.

Fields:

• mode: InterceptorMode - Interception mode. Default: http_proxy.
• listen_addr: std::net::SocketAddr - Socket address used by http_proxy and grpc modes.
• socket_path: Option<std::path::PathBuf> - Path to the Unix domain socket file, used by unix_socket
• drain_timeout_secs: u64 - Seconds to wait for in-flight requests to drain on shutdown.
• max_request_body_bytes: usize - Maximum request body size accepted by proxy interceptors.
• connect_relay: ConnectRelayConfig - CONNECT/MITM relay timeout controls.
• https_mitm: HttpsMitmConfig - HTTPS MITM settings used by the HTTP proxy interceptor.
• total_body_budget_bytes: usize - Global ceiling for the total bytes of request bodies buffered

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> InterceptorConfig
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self

firma_sidecar::config::InterceptorMode

Enum

Interception mode selector.

Determines which transport the sidecar uses to capture outbound agent traffic.

Variants:

• HttpProxy - Pingora-based HTTP forward proxy. The agent sets
• Grpc - Tonic gRPC hook server. The agent calls the Intercept RPC
• UnixSocket - Unix domain socket. Avoids TCP port binding in containers.

Traits: Eq, Copy

Trait Implementations:

• Default
  • fn default() -> Self
• Display
  • fn fmt(self: &Self, f: & mut fmt::Formatter) -> fmt::Result
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• PartialEq
  • fn eq(self: &Self, other: &InterceptorMode) -> bool
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> InterceptorMode

firma_sidecar::config::LocalExecConfig

Struct

Configuration for the local-exec governance UDS endpoint.

When present in SidecarConfig, the sidecar binds an additional Unix domain socket that firma-run clients contact for pre-execution governance decisions. This is the server-side counterpart to the sidecar_local_exec section in the firma-run profile config.

Fields:

• socket_path: std::path::PathBuf - Absolute path to the Unix domain socket file.
• default_action: crate::local_exec::handler::DefaultAction - Policy applied to every fresh local-exec request.
• token_ttl_secs: u64 - Approval token time-to-live in seconds (default: 300).
• retry_after_ms: u64 - Suggested retry interval returned to firma-run in pending_hitl

Methods:

• fn validate(self: &Self) -> Result<(), String> - Validate the local-exec configuration.

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Clone
  • fn clone(self: &Self) -> LocalExecConfig
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>

firma_sidecar::config::LogConfig

Struct

Log settings sourced from the TOML file.

The log level set here acts as the base; CLI args (--log-level) override it.

Fields:

• level: String - Log level: trace, debug, info, warn, or error.

Trait Implementations:

• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> LogConfig

firma_sidecar::config::PolicyConfig

Struct

Policy source settings.

Fields:

• dir: std::path::PathBuf - Directory containing .cedar policy files.

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> PolicyConfig
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self

firma_sidecar::config::SidecarConfig

Struct

Top-level sidecar configuration deserialized from TOML.

Contains both infrastructure settings (interceptor, policy, CA, logging, credentials) and enforcement-engine settings (mapping, capability validation, constraint enforcement) via [EnforcementConfig].

Fields:

• mode: SidecarMode - Enforcement mode: "enforce" (default) or "monitor".
• interceptor: InterceptorConfig - Interceptor settings (mode, listen address or socket path,
• policy: PolicyConfig - Policy directory and optional authority URL.
• ca: CaConfig - Certificate authority directory.
• log: LogConfig - Log settings (level only; file/filter come from CLI args).
• credentials: std::collections::HashMap<String, CredentialConfig> - Per-target credential injection entries, keyed by an arbitrary
• connector: ConnectorConfig - Outbound connector settings (default timeout + per-host
• authority: AuthorityConfig - Background Authority stream client tuning.
• enforcement: EnforcementConfig - Enforcement engine settings (mapping rules, capability
• revocation: RevocationConfig - Revocation cache settings (bloom filter + LRU sizing).
• capability_seed: CapabilitySeedConfig - Static capability provisioning for the demo path. Until the
• audit: AuditConfig - Audit event emitter settings.
• local_exec: Option<LocalExecConfig> - Local-exec governance endpoint configuration.
• tenancy: TenancyConfig - Tenancy settings (agent isolation mode).

Methods:

• fn load_from_path(path: &std::path::Path) -> Result<Self, String> - Load a sidecar configuration from a TOML file and validate it.
• fn validate(self: &Self) -> Result<(), String> - Validate the entire configuration tree.
• fn rebase_defaults(self: & mut Self, config_dir: &std::path::Path) - Re-base every relative resource path against config_dir;

Trait Implementations:

• Default
  • fn default() -> SidecarConfig
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> SidecarConfig

firma_sidecar::config::SidecarMode

Enum

Enforcement mode for the sidecar.

enforce (default): normal fail-closed operation — DENY blocks the call. monitor: observe-only — all calls are allowed through, but the pipeline still classifies and evaluates every request. Decisions that would have been DENY are logged as ALLOW with a monitor_mode: <reason> annotation so operators can audit traffic before tightening policy.

Never deploy monitor to production. Monitor mode is gated behind the FIRMA_ALLOW_MONITOR_MODE=1 environment variable: setting mode = "monitor" without that opt-in downgrades to enforce at startup with an error log, so a dev config left on monitor cannot accidentally bypass enforcement in production. When honored, the sidecar emits a startup warning.

Variants:

• Enforce - Normal fail-closed enforcement (default).
• Monitor - Observe-only: classify and log every call, but never block.

Traits: Eq

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• PartialEq
  • fn eq(self: &Self, other: &SidecarMode) -> bool
• Clone
  • fn clone(self: &Self) -> SidecarMode
• Default
  • fn default() -> SidecarMode