Struct Config 

pub struct Config {

    pub server: ServerConfig,
    pub tls: TlsConfig,
    pub database: DbConfig,
    pub cas: Vec<CaConfig>,
    pub est: EstConfig,
    pub hsm: Option<HsmConfig>,
    pub otp: OtpConfig,
    pub admin: Option<AdminConfig>,
    pub audit: AuditConfig,
    pub auth_lockout: LockoutConfig,
    pub coap: Option<CoapConfig>,
    pub cms_est: Option<CmsEstConfig>,
    pub cmp: Option<CmpConfig>,
    pub dogtag: Option<DogtagConfig>,
    pub star: Option<StarConfig>,
    pub ha: Option<HaConfig>,
    pub ocsp: OcspConfig,
    pub crl_refresh_interval_secs: u64,
}

Root configuration for the Kipuka EST server.

Loaded from a TOML file via Config::from_file.

Fields

server: ServerConfig

Server listener configuration.

tls: TlsConfig

TLS configuration for the EST listener.

database: DbConfig

Database connection configuration.

cas: Vec<CaConfig>

Certificate Authority configurations.

Supports [ca] (single-CA backward compat) or [[ca]] (multi-CA).

est: EstConfig

EST protocol configuration.

hsm: Option<HsmConfig>

HSM / PKCS#11 configuration. Absent → software-only key storage.

otp: OtpConfig

OTP enrollment authentication.

admin: Option<AdminConfig>

Admin API configuration. Absent → admin endpoints disabled.

audit: AuditConfig

Audit trail configuration.

auth_lockout: LockoutConfig

Authentication failure-lockout configuration (FIA_AFL.1).

coap: Option<CoapConfig>

CoAP transport configuration (RFC 9483). Absent → CoAP disabled.

cms_est: Option<CmsEstConfig>

CMS-wrapped EST configuration (RFC 8295). Absent → CMS-EST disabled.

cmp: Option<CmpConfig>

CMP v3 configuration (RFC 9810). Absent → CMP disabled.

dogtag: Option<DogtagConfig>

Dogtag PKI backend configuration (CA + KRA).

When present, enrollment and CMC requests are forwarded to a Dogtag PKI CA via its REST API instead of using direct signing. Absent → direct signing only (no Dogtag integration).

star: Option<StarConfig>

STAR certificate configuration (RFC 8739). Absent → STAR disabled.

ha: Option<HaConfig>

ocsp: OcspConfig

OCSP configuration for certificate revocation checking (RFC 6960). Absent → OCSP checking disabled (RHELBU-3536 R21).

crl_refresh_interval_secs: u64

Interval in seconds between CRL regeneration cycles.

Default: 3600 (1 hour).

Implementations

impl Config

pub fn from_file(path: &str) -> Result<Self, String>

Load and validate configuration from a TOML file.

Returns the parsed config or a human-readable error string suitable for startup diagnostics.

pub fn validate(&self) -> Result<(), String>

Validate semantic constraints that cannot be expressed in serde alone.

Called automatically by Self::from_file.

pub fn default_ca(&self) -> &CaConfig

Returns the default CA config: the one with is_default = true, or the only CA when there is exactly one [[ca]] entry.

Panics

Panics if cas is empty or no CA is marked default in a multi-CA config. Self::validate prevents both situations.

Trait Implementations

impl Clone for Config

fn clone(&self) -> Config

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Config

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Config

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.