Struct SecurityPosture 

pub struct SecurityPosture {

    pub allow_unauthenticated_public_bind: bool,
    pub max_upload_bytes: u64,
    pub allow_site_unix_upstreams: bool,
    pub allow_site_private_upstreams: bool,
    pub allow_guest_private_egress: bool,
    pub allow_guest_self_egress: bool,
    pub allow_guest_egress_extra_ca: bool,
    pub max_handler_blob_bytes: u64,
    pub max_component_bytes: u64,
    pub oidc_require_audience: bool,
    pub domain_verify_allow_private: bool,
    pub domain_verify_self_serve: bool,
    pub allow_shared_kernel_compute: bool,
    pub allow_compute_exec: bool,
    pub ratelimit_fail_open: bool,
    pub allow_implicit_routing: bool,
    pub require_pop: bool,
    pub require_domain_verification: bool,
    pub allow_env_secret_refs: bool,
    pub allow_guest_email: bool,
    pub allow_guest_mint_capability: bool,
    pub max_guest_capability_ttl_secs: u64,
    pub allow_guest_admin_domains: bool,
    pub allow_guest_admin_email: bool,
    pub allow_guest_admin_site: bool,
    pub allow_guest_admin_secrets: bool,
    pub require_tenancy_declaration: bool,
    pub allow_cross_tenant_db: bool,
}

The resolved security posture: every knob a concrete value. Default is the strict multi-tenant preset, so a server with no [security] section — and any code path that defaults this — is locked down. Byte caps: 0 = unlimited.

Fields

allow_unauthenticated_public_bind: bool

Permit binding a non-loopback address with control-plane auth disabled.

max_upload_bytes: u64

Default blob-upload cap in bytes, 0 = unlimited.

allow_site_unix_upstreams: bool

Permit site-declared unix: gateway upstreams.

allow_site_private_upstreams: bool

Permit site-declared gateway upstreams to private/loopback IPs.

allow_guest_private_egress: bool

Permit a guest handler’s outbound wasi:http to reach a private/loopback/ link-local address. Off under multi-tenant (the SSRF default — a guest can only reach globally-routable hosts); on under single-tenant/dev. This is the guest egress analog of allow_site_private_upstreams (which gates operator-declared gateway upstreams, a different path). It does not cover a guest calling its own site — that is served in-process, host-asserted, and is never treated as private egress.

allow_guest_self_egress: bool

Permit a guest handler’s outbound wasi:http to reach this instance’s own HTTP serve socket (loopback / the bind address on the serve port) even when allow_guest_private_egress is off. A much tighter grant than opening the whole private range: the only reachable internal target is boatramp’s own front door, which re-enters the full pipeline (host routing, visitor auth, rate-limit, DV) — so a guest reaches only what any anonymous client could. A self-recursion is bounded by a process-stamped depth cap. On by default in every posture. (For depth-capped, allowlisted function-to-function calls, prefer the invoke binding, which is unaffected by any egress knob.)

allow_guest_egress_extra_ca: bool

Whether a guest’s outbound wasi:http TLS client trusts an operator-supplied EXTRA CA (guest_egress_extra_ca_file) on top of the webpki roots. Off under multi-tenant; a trusted single-tenant/dev fleet may opt in (e.g. to reach a hermetic HTTPS test double under a test CA). Verification is still fully performed — this only widens the accepted CA set.

max_handler_blob_bytes: u64

Cap on handler blobstore host reads/ranges/copies, 0 = unlimited.

max_component_bytes: u64

Cap on a Wasm component blob, 0 = unlimited.

oidc_require_audience: bool

Require an OIDC audience when OIDC is enabled.

domain_verify_allow_private: bool

Permit HTTP domain-verification probes to private hosts.

domain_verify_self_serve: bool

Serve pending HTTP ownership challenges from the edge before host routing (the domain-attach chicken-and-egg fix).

allow_shared_kernel_compute: bool

Permit untrusted workloads on shared-kernel compute backends.

allow_compute_exec: bool

Permit boatramp compute exec (run a command inside a running workload).

ratelimit_fail_open: bool

Fail open instead of closed on rate-limit KV errors.

allow_implicit_routing: bool

Resolve an unmatched Host to a site without an explicit domain registration (first-label <site>.host or the sole served site). Off under multi-tenant; a loopback bind enables it regardless.

require_pop: bool

Require every control-plane token to be cnf-bound and PoP-proven (fleet-wide holder-key enforcement). Off by default.

require_domain_verification: bool

Refuse to serve a non-local Host that is not a verified, attached virtualhost — the request gets the “verification pending” holding page instead of any default_site/implicit fallback. On under multi-/single- tenant; off under dev. Local hosts (localhost/*.localhost/*.local/ IP literals) always serve. An operator disables it globally in [security], or excludes one host with an admin domain add --unverified.

allow_env_secret_refs: bool

Permit a site handler’s / function’s secrets map to resolve a bare or env:-scheme reference against the serve process’s own environment. That namespace is the operator’s, so a bare ref is only safe when the config author IS the operator: on under single-tenant/dev, off under multi-tenant. When off, resolve_secret_env refuses such a ref (fail-closed) instead of injecting the host value, so an untrusted tenant can’t name an arbitrary host env var to exfiltrate it across the tenant boundary.

allow_guest_email: bool

Permit a guest handler/function’s email capability to actually send (bind the send verb). Off under multi-tenant — an untrusted tenant can’t use the shared node’s SMTP egress until the operator opts in — and on under single-tenant/dev. Independent of the guest-HTTP egress knobs: email is a host-mediated SMTP connection whose credentials the guest never sees (a separate path), so it is gated separately. When off, the binding is absent and send returns access-denied. The SMTP relay host is additionally held to the SSRF rule (a private/loopback relay is refused unless allow_guest_private_egress is on).

allow_guest_mint_capability: bool

Permit a guest’s capability capability to MINT fleet-signed target-capability tokens (boatramp:handlers/capability, PLAN-delegable-capabilities). A minted token is bounded: its audience is host-forced to the guest’s OWN project (never redeemable elsewhere), its TTL is clamped to max_guest_capability_ttl_secs, and its power is fully gated at redeem by the operator’s target-eligible route config (a token is inert anywhere no matching via:[capability] route is opened). Off under multi-tenant (an untrusted tenant can’t mint); on under single-tenant/dev. When off, the binding is absent and mint returns access-denied.

max_guest_capability_ttl_secs: u64

The operator’s ceiling (seconds) on a guest-minted capability’s TTL (R5). A mint requesting a larger TTL is clamped to this; 0 disables minting (any request is refused). Defaults to 1h.

allow_guest_admin_domains: bool

Permit a guest’s admin capability to manage the project’s domains (add / verify / attach-verified / remove) via boatramp:handlers/admin. Off under multi-tenant, on under single-tenant/dev. Per-surface + operator-set (a tenant can’t turn it on via site config); domain attach still runs the real ownership probe, and there is no guest path to the unverified-attach admin route.

allow_guest_admin_email: bool

Permit a guest’s admin capability to manage the project’s SMTP email profiles (set / delete). Passwords stay sealed and are never returned to the guest.

allow_guest_admin_site: bool

Permit a guest’s admin capability to write site config + aliases (routing, headers, cache). A config write can’t attach an unverified domain (the verified-domain guard is shared with the HTTP path).

allow_guest_admin_secrets: bool

Permit a guest’s admin capability to write the project’s sealed secrets (set / rotate / delete — write-only, redacted). The most sensitive surface: an operator can withhold it while still allowing domains/email/site self-service.

require_tenancy_declaration: bool

Require an explicit in-site tenancy decision (Dimension 0) from any site/function that imports sql/orm: it must declare either tenancy: disabled (deliberately plain) or a scoped config. On under multi-tenant — so running a query unscoped on an untrusted-tenant fleet is a reviewed choice, never an accidental omission — and off under single-tenant/dev (one operator; undeclared silently means plain). When on, an undeclared sql/orm importer is refused at activation.

allow_cross_tenant_db: bool

Permit an in-site tenancy grant to reach across tenants (read/write: all) — the operator ceiling on the cross-tenant mode. Off under multi-tenant (an all grant is refused until the operator opts in) and on under single-tenant/dev. Independent of the per-function grant: even a function that declares all is capped to own (its resolved tenant) while this is off, so a compromised/misconfigured tenant can’t read the fleet.

Implementations

impl SecurityPosture

pub fn base_project_tenancy(&self) -> ResolvedProjectTenancy

The base (no per-project override) resolved tenancy/capability knobs for this posture.

pub fn project_tenancy( &self, ovr: &ProjectPostureOverride, ) -> ResolvedProjectTenancy

Apply a ProjectPostureOverride over this posture’s base tenancy knobs (Gap 4a). Each Some field of the override wins; the rest fall through to the fleet posture. Only affects this project’s own in-project tenancy + capability-mint ceiling — never cross-project reach.

Trait Implementations

impl Clone for SecurityPosture

fn clone(&self) -> SecurityPosture

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for SecurityPosture

impl Debug for SecurityPosture

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityPosture

fn default() -> Self

Returns the “default value” for a type.

impl Eq for SecurityPosture

impl PartialEq for SecurityPosture

fn eq(&self, other: &SecurityPosture) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for SecurityPosture