windmill_api/models/
vault_settings.rs

1/*
2 * Windmill API
3 *
4 * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
5 *
6 * The version of the OpenAPI document: 1.863.0
7 * Contact: contact@windmill.dev
8 * Generated by: https://openapi-generator.tech
9 */
10
11use crate::models;
12use serde::{Deserialize, Serialize};
13
14#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
15pub struct VaultSettings {
16    /// HashiCorp Vault server address (e.g., https://vault.company.com:8200)
17    #[serde(rename = "address")]
18    pub address: String,
19    /// KV v2 secrets engine mount path (e.g., windmill). Empty to test the connection used for `$external:vault://` references, which checks only that Vault accepts Windmill's token.
20    #[serde(rename = "mount_path", skip_serializing_if = "Option::is_none")]
21    pub mount_path: Option<String>,
22    /// Optional path prefix inserted between the KV data/metadata segment and the workspace id (e.g., \"apps/windmill\"). When set, secrets are stored at `<mount>/data/<prefix>/<workspace>/<secret>`, allowing a Vault policy scoped to exactly `<mount>/data/<prefix>/_*`.
23    #[serde(rename = "kv_secret_path_prefix", skip_serializing_if = "Option::is_none")]
24    pub kv_secret_path_prefix: Option<String>,
25    /// Vault JWT auth role name for Windmill (optional, if not provided token auth is used)
26    #[serde(rename = "jwt_role", skip_serializing_if = "Option::is_none")]
27    pub jwt_role: Option<String>,
28    /// Mount path for the JWT auth method in Vault (optional, defaults to \"jwt\"). Set this when the JWT auth method is mounted at a non-default path, e.g. via `vault auth enable -path=<mount> jwt`.
29    #[serde(rename = "jwt_mount_path", skip_serializing_if = "Option::is_none")]
30    pub jwt_mount_path: Option<String>,
31    /// AppRole role_id (optional). When set and no static token is given, Windmill logs in with AppRole; the secret_id is read from the `VAULT_APPROLE_SECRET_ID` environment variable of servers and workers.
32    #[serde(rename = "approle_role_id", skip_serializing_if = "Option::is_none")]
33    pub approle_role_id: Option<String>,
34    /// Mount path of the AppRole auth method (optional, defaults to \"approle\").
35    #[serde(rename = "approle_mount_path", skip_serializing_if = "Option::is_none")]
36    pub approle_mount_path: Option<String>,
37    /// Vault Enterprise namespace (optional)
38    #[serde(rename = "namespace", skip_serializing_if = "Option::is_none")]
39    pub namespace: Option<String>,
40    /// Static Vault token for testing/development (optional, if provided this is used instead of JWT authentication)
41    #[serde(rename = "token", skip_serializing_if = "Option::is_none")]
42    pub token: Option<String>,
43    /// Skip TLS certificate verification when connecting to Vault. Only use for self-signed certificates in development environments.
44    #[serde(rename = "skip_ssl_verify", skip_serializing_if = "Option::is_none")]
45    pub skip_ssl_verify: Option<bool>,
46}
47
48impl VaultSettings {
49    pub fn new(address: String) -> VaultSettings {
50        VaultSettings {
51            address,
52            mount_path: None,
53            kv_secret_path_prefix: None,
54            jwt_role: None,
55            jwt_mount_path: None,
56            approle_role_id: None,
57            approle_mount_path: None,
58            namespace: None,
59            token: None,
60            skip_ssl_verify: None,
61        }
62    }
63}
64
windmill_api/models/vault_settings.rs

windmill_api/models/
vault_settings.rs
