Struct Config 

#[non_exhaustive]
pub struct Config {
    pub proxy: ProxyConfig,
    pub waf: WafConfig,
    pub limits: LimitsConfig,
    pub modules: ModulesConfig,
    pub rate_limit: RateLimitConfig,
    pub network: NetworkConfig,
    pub resilience: ResilienceConfig,
    pub tls: TlsConfig,
    pub metrics: MetricsConfig,
}

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

proxy: ProxyConfig

waf: WafConfig

limits: LimitsConfig

modules: ModulesConfig

rate_limit: RateLimitConfig

network: NetworkConfig

Shared network settings (trusted-proxy client-IP resolution). Reused by rate limiting, structured logging and future Geo/IP-reputation.

resilience: ResilienceConfig

Per-scenario behaviour when the WAF itself is in trouble.

tls: TlsConfig

Inbound TLS termination (Phase 12). Default off → the listener stays cleartext, exactly as before. Basic, cert-from-file termination is core (BOUNDARY.md §3.2); cert management at scale (ACME/rotation/mTLS-PKI) is enterprise.

metrics: MetricsConfig

Prometheus metrics exposition (B1). Default off → no separate listener. Served on a dedicated loopback port (never the data port — see ARCHITECTURE §9).

Implementations

impl Config

pub fn validate(&self) -> Result<(), ConfigError>

Semantic validation, separate from TOML parsing. Called at startup (after parse, before build) and reused by hot reload. Fails fast with a specific error rather than starting with values that look valid but aren’t.

Trait Implementations

impl Clone for Config

fn clone(&self) -> Config

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Config

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Config

fn default() -> Self

A valid, non-disruptive base for programmatic/test construction: detection-only mode (detects but never blocks), the standard detection modules ON at their defaults (GraphQL/gRPC off — opt-in), rate limiting off, cleartext, metrics off. Production always supplies [proxy]/[waf] from TOML; this default exists so external code never needs a Config { .. } literal (forbidden by #[non_exhaustive]).

impl<'de> Deserialize<'de> for Config

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.