Struct OverlayServeConfig 

pub struct OverlayServeConfig {
    pub identity: Option<String>,
    pub trust_root: Option<String>,
    pub encryption_required: Option<bool>,
    pub max_dial_ttl_secs: Option<u64>,
    pub relay_listen: Option<SocketAddr>,
    pub client_auth: Option<String>,
    pub allowed_clients: Vec<String>,
    pub routes: Vec<OverlayRoute>,
    pub egress_listen: Option<SocketAddr>,
    pub services: Vec<OverlayService>,
}

[overlay] — the forward-flow serve roles this node runs (the server side of boatramp forward). A node may be a relay/ingress (accepts external client dials and forwards them, blind, into the cluster), an egress/terminator (fronts local backend services), or both. A relay’s routes double as the self-serve discovery directory: the control plane resolves boatramp forward svc/<name> against them and mints the dial capability, so the CLI needs no hand-typed topology (the explicit flags / overlay grant --ticket remain for control-plane-less forwards).

Fields

identity: Option<String>

This node’s overlay identity — an ed25519:<hex> seed inline, or a path to a file holding one. Auto-generated at <data-dir>/overlay/identity.key when unset. This is the identity a relay’s clients and an egress’s relay pin.

trust_root: Option<String>

The dial-capability trust root (ed25519:/es256: tagged hex) every dial is verified against. Defaults to serve.auth_root_public_key (the cluster’s control-plane root).

encryption_required: Option<bool>

Whether dials must be end-to-end encrypted (fail-closed). Default true.

max_dial_ttl_secs: Option<u64>

Server cap on a minted dial capability’s lifetime (seconds). A POST /api/overlay/dial request’s ttl_secs is clamped to this (overlay-dial caps are offline-verified — no revocation — so an unbounded TTL is a standing risk). Unset ⇒ 24h.

relay_listen: Option<SocketAddr>

Bind a relay/ingress here (UDP/QUIC). Unset ⇒ this node runs no relay.

client_auth: Option<String>

The relay’s transport-layer client-auth posture (Security Blocker #1): "capability-only" accepts any client key at TLS and rests authorization on the capability gate + the egress’s E2EE-proven re-authz (self-serve, no pre-enrollment); "mutual-pin" keeps the allowed_clients RPK pin as a strictly-more-restrictive pre-filter. REQUIRED for a relay unless allowed_clients is non-empty (which defaults to mutual-pin); a relay with neither is a hard error — an empty allowlist is never silently treated as accept-any.

allowed_clients: Vec<String>

The client overlay identities (ed25519:/es256: tagged hex) the relay mutual-authenticates — the enrolled operators/clients allowed to dial under client_auth = "mutual-pin". (A capability is still required and is the authority; this is the relay’s transport-layer pre-filter. Ignored under "capability-only".)

routes: Vec<OverlayRoute>

Relay routing: a requested service → its egress. Used when relay_listen is set.

egress_listen: Option<SocketAddr>

Bind an egress/terminator here (UDP/QUIC). Unset ⇒ this node runs no egress.

services: Vec<OverlayService>

Egress service map: a service name → the local backend it fronts. Used when egress_listen is set; a service not listed here is refused (the egress authorizes only what it fronts).

Trait Implementations

impl Clone for OverlayServeConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OverlayServeConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OverlayServeConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for OverlayServeConfig

where OverlayServeConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for OverlayServeConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.