Struct EncryptedSpawnPodRequest 

pub struct EncryptedSpawnPodRequest {
    pub cashu_token: String,
    pub pod_spec_id: Option<String>,
    pub pod_image: String,
    pub ssh_username: String,
    pub ssh_password: String,
    pub template_slug: Option<String>,
    pub replication: Option<ReplicationMode>,
    pub primary_npub: Option<String>,
    pub workload_id: Option<String>,
    pub volume_encryption: Option<VolumeEncryption>,
}

Fields

cashu_token: String

pod_spec_id: Option<String>

pod_image: String

ssh_username: String

ssh_password: String

template_slug: Option<String>

Optional template slug. When set, the provider materializes the workload’s image / ports / env from its OWN local template registry (paygress::templates) rather than trusting consumer-supplied bytes — so a consumer cannot smuggle an arbitrary image past the provider’s vetted list. pod_image is ignored when template_slug resolves. Old clients that don’t set this field continue to work (#[serde(default)]).

replication: Option<ReplicationMode>

Replication mode requested by the consumer (Unit 5 wiring completion). Old clients that don’t set this field default to ReplicationMode::None — same shape as before, no behavior change for unspecified spawns.

WarmStandby { standby_providers } is the load-bearing variant: the consumer sends the SAME spawn request to every provider in the standby set; each provider determines its own role (primary if it is not in the standby list, standby otherwise) and the orchestrator coordinates failover via the LeaseRevocation event published by #34’s wiring.

primary_npub: Option<String>

Primary provider’s npub. Required when replication is WarmStandby; ignored otherwise. Lets each receiving provider self-determine its role: if self.npub == primary_npub it acts as the primary (spawns + heartbeats); otherwise (and only if it is in standby_providers) it acts as a standby (reserves a slot, listens for revocations, promotes on signal).

workload_id: Option<String>

Consumer-assigned workload identifier (UUID-shaped string). Required when replication is WarmStandby so the primary and N standbys share one stable id across providers — the LeaseRevocation event uses this id, and the standby looks up its reserved slot by it on receipt. Single-provider spawns can leave this unset; the provider derives a vmid-based id internally.

volume_encryption: Option<VolumeEncryption>

Optional encryption key for the workload’s persistent data volume. When set, the provider creates a LUKS-encrypted volume (instead of a plain one) for template.data_path and destroys the volume header on tenancy end so post-eviction disk forensics reveal only ciphertext.

Threat model: protects against post-eviction snooping, lazy host-operator backups, co-tenant attacks on shared storage, and cold-disk forensics if the host is seized. Does NOT protect against a live host with CAP_SYS_PTRACE reading /proc//mem or extracting the LUKS key from the kernel keyring while the workload runs — that requires hardware confidential VMs (SEV-SNP / TDX), which the attested-research-tier IsolationLevel is reserved for.

The key travels inside this Nostr DM, which is itself NIP-04 / NIP-17 encrypted to the provider’s pubkey, so it is never visible on relays or in transit. The provider holds it only in memory while the workload runs.

Old clients that don’t set this field get plain volumes — same shape as before, no behavior change for unspecified spawns.

Trait Implementations

impl Clone for EncryptedSpawnPodRequest

fn clone(&self) -> EncryptedSpawnPodRequest

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EncryptedSpawnPodRequest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for EncryptedSpawnPodRequest

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for EncryptedSpawnPodRequest

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.