Struct SecurityPosture 

pub struct SecurityPosture {

    pub allow_unauthenticated_public_bind: bool,
    pub max_upload_bytes: u64,
    pub allow_site_unix_upstreams: bool,
    pub allow_site_private_upstreams: bool,
    pub max_handler_blob_bytes: u64,
    pub max_component_bytes: u64,
    pub oidc_require_audience: bool,
    pub domain_verify_allow_private: bool,
    pub domain_verify_self_serve: bool,
    pub allow_shared_kernel_compute: bool,
    pub ratelimit_fail_open: bool,
    pub allow_implicit_routing: bool,
    pub require_pop: bool,
    pub require_domain_verification: bool,
}

The resolved security posture: every knob a concrete value. Default is the strict multi-tenant preset, so a server with no [security] section — and any code path that defaults this — is locked down. Byte caps: 0 = unlimited.

Fields

allow_unauthenticated_public_bind: bool

Permit binding a non-loopback address with control-plane auth disabled.

max_upload_bytes: u64

Default blob-upload cap in bytes, 0 = unlimited.

allow_site_unix_upstreams: bool

Permit site-declared unix: gateway upstreams.

allow_site_private_upstreams: bool

Permit site-declared gateway upstreams to private/loopback IPs.

max_handler_blob_bytes: u64

Cap on handler blobstore host reads/ranges/copies, 0 = unlimited.

max_component_bytes: u64

Cap on a Wasm component blob, 0 = unlimited.

oidc_require_audience: bool

Require an OIDC audience when OIDC is enabled.

domain_verify_allow_private: bool

Permit HTTP domain-verification probes to private hosts.

domain_verify_self_serve: bool

Serve pending HTTP ownership challenges from the edge before host routing (the domain-attach chicken-and-egg fix).

allow_shared_kernel_compute: bool

Permit untrusted workloads on shared-kernel compute backends.

ratelimit_fail_open: bool

Fail open instead of closed on rate-limit KV errors.

allow_implicit_routing: bool

Resolve an unmatched Host to a site without an explicit domain registration (first-label <site>.host or the sole served site). Off under multi-tenant; a loopback bind enables it regardless.

require_pop: bool

Require every control-plane token to be cnf-bound and PoP-proven (fleet-wide holder-key enforcement). Off by default.

require_domain_verification: bool

Refuse to serve a non-local Host that is not a verified, attached virtualhost — the request gets the “verification pending” holding page instead of any default_site/implicit fallback. On under multi-/single- tenant; off under dev. Local hosts (localhost/*.localhost/*.local/ IP literals) always serve. An operator disables it globally in [security], or excludes one host with an admin domain add --unverified.

Trait Implementations

impl Clone for SecurityPosture

fn clone(&self) -> SecurityPosture

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for SecurityPosture

impl Debug for SecurityPosture

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityPosture

fn default() -> Self

Returns the “default value” for a type.

impl Eq for SecurityPosture

impl PartialEq for SecurityPosture

fn eq(&self, other: &SecurityPosture) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for SecurityPosture