Struct OverlayServeConfig 

pub struct OverlayServeConfig {

    pub identity: Option<String>,
    pub trust_root: Option<String>,
    pub encryption_required: Option<bool>,
    pub max_dial_ttl_secs: Option<u64>,
    pub relay_listen: Option<SocketAddr>,
    pub client_auth: Option<String>,
    pub allowed_clients: Vec<String>,
    pub routes: Vec<OverlayRoute>,
    pub accept_exposed: Option<bool>,
    pub pair_short_code_digits: Option<usize>,
    pub pairing_park: Option<String>,
    pub egress_listen: Option<SocketAddr>,
    pub services: Vec<OverlayService>,
}

[overlay] — the forward-flow serve roles this node runs (the server side of boatramp forward). A node may be a relay/ingress (accepts external client dials and forwards them, blind, into the cluster), an egress/terminator (fronts local backend services), or both. A relay’s routes double as the self-serve discovery directory: the control plane resolves boatramp forward svc/<name> against them and mints the dial capability, so the CLI needs no hand-typed topology (the explicit flags / overlay grant --ticket remain for control-plane-less forwards).

Fields

identity: Option<String>

This node’s overlay identity — an ed25519:<hex> seed inline, or a path to a file holding one. Auto-generated at <data-dir>/overlay/identity.key when unset. This is the identity a relay’s clients and an egress’s relay pin.

trust_root: Option<String>

The dial-capability trust root (ed25519:/es256: tagged hex) every dial is verified against. Defaults to serve.auth_root_public_key (the cluster’s control-plane root).

encryption_required: Option<bool>

Whether dials must be end-to-end encrypted (fail-closed). Default true.

max_dial_ttl_secs: Option<u64>

Server cap on a minted dial capability’s lifetime (seconds). A POST /api/overlay/dial request’s ttl_secs is clamped to this (overlay-dial caps are offline-verified — no revocation — so an unbounded TTL is a standing risk). Unset ⇒ 24h.

relay_listen: Option<SocketAddr>

Bind a relay/ingress here (UDP/QUIC). Unset ⇒ this node runs no relay.

client_auth: Option<String>

The relay’s transport-layer client-auth posture (Security Blocker #1): "capability-only" accepts any client key at TLS and rests authorization on the capability gate + the egress’s E2EE-proven re-authz (self-serve, no pre-enrollment); "mutual-pin" keeps the allowed_clients RPK pin as a strictly-more-restrictive pre-filter. REQUIRED for a relay unless allowed_clients is non-empty (which defaults to mutual-pin); a relay with neither is a hard error — an empty allowlist is never silently treated as accept-any.

allowed_clients: Vec<String>

The client overlay identities (ed25519:/es256: tagged hex) the relay mutual-authenticates — the enrolled operators/clients allowed to dial under client_auth = "mutual-pin". (A capability is still required and is the authority; this is the relay’s transport-layer pre-filter. Ignored under "capability-only".)

routes: Vec<OverlayRoute>

Relay routing: a requested service → its egress. Used when relay_listen is set.

accept_exposed: Option<bool>

Reverse ingress (boatramp expose): accept exposer REGISTRATIONS on this relay, so a LOCAL service published into the cluster (the exposer dials OUT and parks a connection) is reachable by a cluster-side boatramp forward svc/<name>. Opt-in — a relay accepts exposers only when this is true; None/false keeps the forward-only relay. Requires relay_listen. The registration is holder-bound to an overlay-publish capability the relay verifies against trust_root; first-live-claim-wins on the name.

pair_short_code_digits: Option<usize>

Digit count for the human-typeable pairing SHORT CODE a relay can mint alongside a bropair1… code (overlay follow-up #2 inc3, boatramp overlay pair-code --short): default 8 (K = 10^8 ≈ 2^26.6), floor 7, ceiling 10 (clamped). Independent of accept_exposed — read only when a relay actually mints/redeems a short code.

pairing_park: Option<String>

Per-relay operator choice for the pairing PARK service (owner decision: “the relay manager should choose, per relay, whether PARK is offered as an OPEN or AUTHENTICATED service”): "open" (the DEFAULT) keeps today’s behavior — an unauthenticated park, bounded only by the existing park budget + per-IP cap, with the human-compared SAS as the trust anchor; "authenticated" additionally requires the parking accepter to present a holder-bound overlay-pairing-park capability and prove possession, exactly like accept_exposed’s exposer-registration path (register_exposer). REDEEM stays unauthenticated in BOTH modes — the unpaired dialer is, by design, not membership-gated; the SAS backstops it. Read only when a relay actually runs the pairing rendezvous (the same accept_exposed ingress-router branch pair_short_code_digits shares).

egress_listen: Option<SocketAddr>

Bind an egress/terminator here (UDP/QUIC). Unset ⇒ this node runs no egress.

services: Vec<OverlayService>

Egress service map: a service name → the local backend it fronts. Used when egress_listen is set; a service not listed here is refused (the egress authorizes only what it fronts).

Trait Implementations

impl Clone for OverlayServeConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OverlayServeConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OverlayServeConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for OverlayServeConfig

where OverlayServeConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for OverlayServeConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.