acme_proxy/config/types/
audit.rs

1//! `[audit]` — the CA's traceability settings.
2
3use serde::Deserialize;
4
5/// Governs the traceability columns and the `audit_log` table.
6///
7/// Process-wide, so deliberately absent from `PROFILE_SECTIONS`: the retention
8/// sweep is one pass over one table, and an audit trail that recorded different
9/// things at different endpoints of the same CA would be the wrong shape for
10/// the question it exists to answer.
11///
12/// There is no `enabled` key. Recording who asked the CA to sign something is
13/// not a feature of this server, it is what a CA does; the only thing an
14/// operator can turn off here is the reverse lookup, because that one costs a
15/// network round trip and has estates where it can never succeed.
16#[derive(Debug, Clone, Deserialize)]
17#[serde(default)]
18pub struct AuditConfig {
19    /// Resolve a PTR record for the client's address and freeze it into the row.
20    ///
21    /// On by default. Turn it off on an estate with no usable reverse zone: the
22    /// lookups would all fail, every `*_ptr` would be `NULL` anyway, and the
23    /// only thing left would be the round trip.
24    pub reverse_dns: bool,
25    /// Budget for one PTR lookup.
26    ///
27    /// Small on purpose: this runs inside a request that has already done its
28    /// real work, and a slow nameserver must cost a `NULL` in one column rather
29    /// than latency on issuance. Matches `filter.reverse_dns.timeout_ms`, whose
30    /// lookup is against the same nameserver.
31    pub reverse_dns_timeout_ms: u64,
32    /// Delete `audit_log` rows older than this many days.
33    ///
34    /// `0` (the default) keeps everything for ever, which is the right default
35    /// for a trail whose value is that it is complete. Set it where a retention
36    /// policy says otherwise; `acme-proxy audit cleanup --older-than` is the
37    /// same sweep run by hand.
38    pub retention_days: u64,
39}
40
41impl Default for AuditConfig {
42    fn default() -> Self {
43        Self {
44            reverse_dns: true,
45            reverse_dns_timeout_ms: 2_000,
46            retention_days: 0,
47        }
48    }
49}
acme_proxy/config/types/audit.rs

acme_proxy/config/types/
audit.rs
