1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
/*
* Windmill API
*
* No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
*
* The version of the OpenAPI document: 1.864.0
* Contact: contact@windmill.dev
* Generated by: https://openapi-generator.tech
*/
use crate::models;
use serde::{Deserialize, Serialize};
#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
pub struct VaultSettings {
/// HashiCorp Vault server address (e.g., https://vault.company.com:8200)
#[serde(rename = "address")]
pub address: String,
/// KV v2 secrets engine mount path (e.g., windmill). Empty to test the connection used for `$external:vault://` references, which checks only that Vault accepts Windmill's token.
#[serde(rename = "mount_path", skip_serializing_if = "Option::is_none")]
pub mount_path: Option<String>,
/// Optional path prefix inserted between the KV data/metadata segment and the workspace id (e.g., \"apps/windmill\"). When set, secrets are stored at `<mount>/data/<prefix>/<workspace>/<secret>`, allowing a Vault policy scoped to exactly `<mount>/data/<prefix>/_*`.
#[serde(rename = "kv_secret_path_prefix", skip_serializing_if = "Option::is_none")]
pub kv_secret_path_prefix: Option<String>,
/// Vault JWT auth role name for Windmill (optional, if not provided token auth is used)
#[serde(rename = "jwt_role", skip_serializing_if = "Option::is_none")]
pub jwt_role: Option<String>,
/// Mount path for the JWT auth method in Vault (optional, defaults to \"jwt\"). Set this when the JWT auth method is mounted at a non-default path, e.g. via `vault auth enable -path=<mount> jwt`.
#[serde(rename = "jwt_mount_path", skip_serializing_if = "Option::is_none")]
pub jwt_mount_path: Option<String>,
/// AppRole role_id (optional). When set and no static token is given, Windmill logs in with AppRole; the secret_id is read from the `VAULT_APPROLE_SECRET_ID` environment variable of servers and workers.
#[serde(rename = "approle_role_id", skip_serializing_if = "Option::is_none")]
pub approle_role_id: Option<String>,
/// Mount path of the AppRole auth method (optional, defaults to \"approle\").
#[serde(rename = "approle_mount_path", skip_serializing_if = "Option::is_none")]
pub approle_mount_path: Option<String>,
/// Vault Enterprise namespace (optional)
#[serde(rename = "namespace", skip_serializing_if = "Option::is_none")]
pub namespace: Option<String>,
/// Static Vault token for testing/development (optional, if provided this is used instead of JWT authentication)
#[serde(rename = "token", skip_serializing_if = "Option::is_none")]
pub token: Option<String>,
/// Skip TLS certificate verification when connecting to Vault. Only use for self-signed certificates in development environments.
#[serde(rename = "skip_ssl_verify", skip_serializing_if = "Option::is_none")]
pub skip_ssl_verify: Option<bool>,
}
impl VaultSettings {
pub fn new(address: String) -> VaultSettings {
VaultSettings {
address,
mount_path: None,
kv_secret_path_prefix: None,
jwt_role: None,
jwt_mount_path: None,
approle_role_id: None,
approle_mount_path: None,
namespace: None,
token: None,
skip_ssl_verify: None,
}
}
}