Struct ServerOptions 

pub struct ServerOptions {

    pub limits: ServerLimits,
    pub probe: Option<Arc<dyn DomainProbe>>,
    pub default_site: Option<String>,
    pub implicit_routing: bool,
    pub protect_previews: bool,
    pub cluster_rate_limit_kv: Option<Arc<dyn KvStore>>,
    pub issuer: Option<Arc<dyn Signer>>,
    pub bootstrap_secret: Option<String>,
    pub bootstrap_attestation: Option<String>,
    pub mesh_control: Option<Arc<dyn MeshControl>>,
    pub cors_allowed_origins: Vec<String>,
    pub posture: SecurityPosture,
    pub served_over_tls: bool,
    pub pop_origin: Option<String>,
    pub daemon_runtime: Option<Arc<DaemonRuntime>>,
}

Server runtime knobs that aren’t part of the core (deploy, auth, handlers) triple: operational request limits and an optional custom domain-ownership DomainProbe (defaults to the live network probe).

Fields

limits: ServerLimits

Operational upload limits (size / idle / concurrency).

probe: Option<Arc<dyn DomainProbe>>

Domain-ownership probe override (tests inject a scripted one); None uses the live HTTP/DNS probe.

default_site: Option<String>

Site to serve for a Host that matches no domain, instead of 404. None keeps the 404 default.

implicit_routing: bool

Resolve an unmatched Host to a site without an explicit domain registration — by first host label (<site>.host), or, when exactly one site is served, as the sole site. The effective gate (posture knob OR a loopback bind), computed by serve. false (the default) keeps the strict behavior: an unmatched host resolves only to default_site or 404.

protect_previews: bool

Require a valid control-plane token to view a deployment preview (/_deploy/<id>/… and <id>.deploy.<host>) — the previews.protect setting. Off by default (previews are unguessable capability URLs).

cluster_rate_limit_kv: Option<Arc<dyn KvStore>>

When set, rate limiting uses a cluster-wide KV-backed fixed-window counter over this store instead of the per-node in-process buckets. Pass the shared/replicated KV (e.g. the cluster RaftKv).

issuer: Option<Arc<dyn Signer>>

The token signer (root private key / KMS / HSM), when this node issues tokens (the /api/tokens create route and the OIDC→token exchange). None ⇒ verify-only.

bootstrap_secret: Option<String>

An operator-set, single-use bootstrap secret enabling the POST /api/tokens/bootstrap first-token route. None ⇒ that route returns 501. Compared by SHA-256, single-use (rotating the secret re-enables it); unset once bootstrapped.

bootstrap_attestation: Option<String>

A bootstrap-TLS identity attestation (base64url COSE_Sign1) served at GET /.well-known/boatramp-bootstrap-identity — the root key vouching for this node’s --tls rpk control-plane TLS public key, so a client pinning only the root key can learn + pin the TLS identity. Set by serve under --tls rpk when an issuer is present; None ⇒ the route returns 404.

mesh_control: Option<Arc<dyn MeshControl>>

The cluster mesh control hook, wired in cluster mode over ClusterNode. Backs POST /api/cluster/join + /rotate-key; None (single-node) ⇒ those routes return 501.

cors_allowed_origins: Vec<String>

Origins allowed to call the control-plane /api/* routes cross-origin (CORS). Empty (the default) ⇒ no Access-Control-* headers at all, i.e. same-origin only — which is exactly the dogfood console, served from the same origin as the API. Set this to host the console (or any browser client) on a different origin: each entry is an exact scheme://host[:port] (e.g. https://console.example.com), or * to allow any origin. The API authenticates with a Bearer token (not cookies), so credentials are not enabled; the matched origin is echoed back with Vary: Origin, and a preflight OPTIONS is answered before auth runs.

posture: SecurityPosture

The resolved operator security posture (the hardening knobs). Carried as an extension so the gateway, proxy, domain-verify, and upload paths can consult it. Defaults to the strict multi-tenant preset.

served_over_tls: bool

Whether this server’s listener terminates TLS (the connection scheme is https). Set by serve from the TLS mode; used to derive the request scheme when X-Forwarded-Proto can’t be trusted. Default false (plain HTTP).

pop_origin: Option<String>

The fleet’s canonical public origin (e.g. https://cp.example.com) that a per-request PoP proof must be bound to (aud). Set from [serve] pop_origin in boatramp.cfg. Compared against a proof’s bound origin — never derived from a Host/X-Forwarded-* header. A holder-bound (cnf) token cannot be used against a server that has not configured this (its proof can’t be verified, so the request is rejected).

daemon_runtime: Option<Arc<DaemonRuntime>>

A pre-built dynamic daemon-config runtime. serve supplies one (built via config_baseline + DaemonRuntime::new) so it can wake it on SIGHUP / changelog; None (tests, embedders) ⇒ the router builds its own.

Trait Implementations

impl Clone for ServerOptions

fn clone(&self) -> ServerOptions

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for ServerOptions

fn default() -> ServerOptions

Returns the “default value” for a type.