Enum SignerConfig 

pub enum SignerConfig {
    Local {
        private_key: String,
    },
    Vault {
        address: String,
        key: String,
        token_env: String,
        alg: TokenAlg,
    },
    AwsKms {
        key_id: String,
        region: Option<String>,
    },
    GcpKms {
        key_version: String,
        access_token_env: String,
    },
    AzureKv {
        vault_url: String,
        key: String,
        key_version: String,
        access_token_env: String,
    },
    Pkcs11 {
        module: String,
        token_label: String,
        key_label: String,
        pin_env: String,
        alg: TokenAlg,
    },
}

Which signer backend issues control-plane tokens, and its parameters. Selected by the operator (config [auth.signer]); the default is SignerConfig::Local.

Variants

Local

An in-process key ("<alg>:<hex>") — the default / dev backend.

Fields

private_key: String

The private key spec, "<alg>:<hex>" (from boatramp auth init).

Vault

A HashiCorp Vault Transit key. Token from token_env.

Fields

address: String

Vault base address, e.g. https://vault.example:8200.

key: String

The Transit key name.

token_env: String

Env var holding the Vault token.

alg: TokenAlg

The key’s algorithm (ES256 or Ed25519).

AwsKms

An AWS KMS asymmetric signing key (ES256 only). Credentials from the standard AWS provider chain (env / profile / IMDS).

Fields

key_id: String

The KMS key id or ARN.

region: Option<String>

Optional region override (else the provider chain’s region).

GcpKms

A GCP Cloud KMS asymmetric signing key version (ES256 only). Access token from access_token_env (a sidecar / workload-identity refreshes it).

Fields

key_version: String

The full key-version resource name (projects/…/cryptoKeyVersions/N).

access_token_env: String

Env var holding a GCP OAuth2 access token.

AzureKv

An Azure Key Vault signing key (ES256 only). Access token from access_token_env (managed identity / a sidecar refreshes it).

Fields

vault_url: String

The vault base URL, e.g. https://kv.vault.azure.net.

key: String

The key name.

key_version: String

The key version (a specific version id).

access_token_env: String

Env var holding an Azure AD access token for the Key Vault resource.

Pkcs11

A PKCS#11 HSM key. PIN from pin_env.

Fields

module: String

Path to the PKCS#11 module (.so).

token_label: String

The token label to open a session on.

key_label: String

The signing key’s CKA_LABEL.

pin_env: String

Env var holding the user PIN.

alg: TokenAlg

The key’s algorithm (ES256 or Ed25519).

Trait Implementations

impl Clone for SignerConfig

fn clone(&self) -> SignerConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SignerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.