Struct ProtectConfig 

pub struct ProtectConfig {

    pub upstream: String,
    pub spec_content: Option<String>,
    pub spec_path: Option<String>,
    pub listen_addr: String,
    pub receipt_db: Option<String>,
    pub allow_ephemeral_receipts: bool,
    pub sidecar_control_token: Option<String>,
    pub signer_seed_hex: Option<String>,
    pub trusted_capability_issuers: Vec<PublicKey>,
    pub control_url: Option<String>,
    pub control_token: Option<String>,
    pub budget_db: Option<String>,
    pub revocation_db: Option<String>,
    pub require_nonce: bool,
    pub allow_advisory: bool,
    pub upstream_request_timeout: Duration,
}

Configuration for the protect proxy.

Fields

upstream: String

Upstream URL to proxy to.

spec_content: Option<String>

Optional in-memory OpenAPI spec content (YAML or JSON).

spec_path: Option<String>

Optional OpenAPI spec path. When omitted, the proxy auto-discovers the spec.

listen_addr: String

Address to listen on (e.g., “127.0.0.1:9090”).

receipt_db: Option<String>

Optional SQLite path for receipt persistence.

allow_ephemeral_receipts: bool

Explicit opt-in to run without a durable receipt store. A durable audit log is the product’s core promise, so a None receipt_db is refused at startup unless this is set, mirroring the CLI boot gate. When set, the proxy runs with in-memory receipts and revocations that are lost on every restart. Leave it false for durable-by-default embedding.

sidecar_control_token: Option<String>

Optional bearer token that authorizes remote sidecar control requests.

signer_seed_hex: Option<String>

Optional seed used to keep the sidecar signer stable across restarts.

trusted_capability_issuers: Vec<PublicKey>

Explicit capability issuers trusted by the HTTP authority.

control_url: Option<String>

Control-plane URL. When set, budget holds go through a RemoteBudgetStore.

control_token: Option<String>

Bearer token for the control-plane budget endpoints.

budget_db: Option<String>

Local SQLite budget-store path used when no control_url is configured.

revocation_db: Option<String>

Optional durable SQLite revocation-store path. When set, the sidecar loads its revoked capability ids at startup so operator revocations recorded through chio trust revoke --revocation-db <path> are enforced on /v1/evaluate and every other path that consults the revoked set. Opening or reading a configured store that fails is fatal (fail-closed): the sidecar refuses to start rather than run without the revocations it was told to enforce.

require_nonce: bool

Retained for API compatibility. The kernel-mediated /v1/evaluate route is a pre-execution authorization gate and always runs the mediation kernel in execution-nonce strict mode, so this flag no longer changes mediation behavior.

allow_advisory: bool

When true, the /v1/evaluate/advisory route is active. Defaults to false; production deployments should leave this off to prevent agents from receiving advisory receipts and bypassing the kernel-mediated route.

upstream_request_timeout: Duration

Wall-clock ceiling on a single upstream proxy hop, including reading the full response body. Raise it for upstreams with legitimately slow calls or large bounded responses; the serve site widens its drain window to match so an in-flight hop is still receipted before shutdown force-closes it. Defaults to DEFAULT_UPSTREAM_REQUEST_TIMEOUT.

Trait Implementations

impl Debug for ProtectConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.