Struct AuditConfig 

pub struct AuditConfig {

    pub enabled: bool,
    pub log_path: String,
    pub signed: bool,
    pub integrity_key: Option<SecretRef>,
    pub rotation_policy: RotationPolicy,
    pub max_file_size: u64,
    pub retention_count: u32,
    pub log_to_db: bool,
    pub overflow_policy: OverflowPolicy,
    pub max_rows: Option<u64>,
    pub alarm_threshold: u32,
    pub alarm_action: String,
    pub auditable_events: Vec<String>,
    pub rotation_check_interval_secs: Option<u64>,
}

[audit] section — audit trail configuration.

[audit]
enabled = true
log_path = "/var/log/kipuka/audit.log"
signed = true
rotation_policy = "daily"
overflow_policy = "halt"
max_rows = 1000000

Fields

enabled: bool

Enable audit logging. Default: true.

log_path: String

Path to the audit log file.

When using database-backed audit (log_to_db = true), this path is used for the file-based backup copy.

signed: bool

Enable keyed (HMAC) integrity protection of the audit hash chain.

Every audit row stores record_hash = H(prev_hash || record_bytes), forming a tamper-evident chain (NIAP CA PP FAU_STG.1). When signed is false (the default), H is plain SHA-256 — this detects in-place edits, deletions, and reordering as long as the chain head is anchored out-of-band. When signed is true, H is HMAC-SHA256 keyed by integrity_key, which additionally prevents an attacker who can write to the database from forging a valid chain.

integrity_key: Option<SecretRef>

Secret reference for the HMAC integrity key (required when signed = true).

Resolved at startup via the standard SecretRef backends (env:, file:, keyring:, systemd-creds:). Never store the raw key inline in the config file.

rotation_policy: RotationPolicy

Log rotation policy.

max_file_size: u64

Maximum rotation file size in bytes (when rotation_policy = "size"). Default: 100 MiB.

retention_count: u32

Number of rotated log files to retain. Default: 10.

log_to_db: bool

Store audit events in the database in addition to the log file.

overflow_policy: OverflowPolicy

Overflow policy when audit storage is full (FAU_STG.4).

max_rows: Option<u64>

Maximum number of audit rows in the database.

When this limit is reached, the overflow_policy determines whether old rows are dropped or EST operations are halted. None means no limit (rely on disk space monitoring).

alarm_threshold: u32

Number of consecutive security violations before the alarm action fires (FAU_ARP.1).

Default: 10.

alarm_action: String

Action taken when the alarm threshold is reached.

• "syslog" — emit a syslog alert.
• "halt" — halt EST operations.

Default: "syslog".

auditable_events: Vec<String>

NIAP CA PP FAU_GEN.1: list of auditable event types.

When non-empty, only these event types are recorded. When empty (default), all events are audited.

rotation_check_interval_secs: Option<u64>

Override the interval (in seconds) between rotation checks.

When None (the default), the interval is derived from the rotation_policy: 3600s for size, 86400s for daily/weekly.

Implementations

impl AuditConfig

pub fn validate(&self) -> Result<(), String>

Validate audit configuration constraints.

Trait Implementations

impl Clone for AuditConfig

fn clone(&self) -> AuditConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuditConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuditConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AuditConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.