Struct CacheConfig 

pub struct CacheConfig {
    pub enabled: bool,
    pub directory: Option<PathBuf>,
    pub ttl_secs: u64,
    pub stale_grace_secs: u64,
    pub refresh_interval_secs: u64,
    pub refresh_jitter_secs: u64,
    pub encryption_key: Option<SensitiveString>,
    pub allow_plaintext_disk_cache: bool,
    pub dir_mode: Option<u32>,
    pub file_mode: Option<u32>,
}

Available on crate feature secrets only.

Cache configuration.

Fields

enabled: bool

Enable caching.

directory: Option<PathBuf>

Cache directory path.

ttl_secs: u64

Cache TTL in seconds (how long cached secrets are considered fresh).

stale_grace_secs: u64

Stale cache grace period in seconds (how long to use expired cache on provider failure).

refresh_interval_secs: u64

Background refresh interval in seconds.

refresh_jitter_secs: u64

Refresh jitter in seconds (randomize to avoid thundering herd).

encryption_key: Option<SensitiveString>

Disk-cache encryption key. When set, on-disk cache entries are sealed with AES-256-GCM (see secrets::crypto); the value is redacted in serialisation and debug output. When None, the disk cache is memory-only UNLESS allow_plaintext_disk_cache is explicitly enabled.

allow_plaintext_disk_cache: bool

Explicitly permit writing UNENCRYPTED secrets to the disk cache when no encryption_key is configured. Default false: without a key the disk tier is silently skipped (memory-only) rather than persisting plaintext secrets. Enabling this is rejected by validate under a production profile.

dir_mode: Option<u32>

Unix permission mode for the cache directory. Default 0o700. Set to None to skip chmod entirely – required on backing stores that reject chmod: S3-FUSE, root-squashed NFS, some other network mounts. Operators are responsible for upstream perms in that case.

file_mode: Option<u32>

Unix permission mode for cache files. Default 0o600. None skips chmod, see dir_mode.

Implementations

impl CacheConfig

pub fn validate(&self, is_production: bool) -> Result<(), String>

Validate the cache configuration against the deployment profile.

Rejects writing plaintext secrets to disk in production: if the disk cache is enabled with no encryption_key and allow_plaintext_disk_cache is set, this returns an error under a production profile. Call at startup (e.g. from the config registry).

Errors

Returns Err when is_production and the config would persist unencrypted secrets to disk.

Trait Implementations

impl Clone for CacheConfig

fn clone(&self) -> CacheConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CacheConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CacheConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for CacheConfig

where CacheConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for CacheConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.