Struct TenantPasswayWorkload 

pub struct TenantPasswayWorkload {
    pub schema_version: SchemaVersion,
    pub domain: String,
    pub listen: String,
    pub upstreams: Vec<String>,
    pub tls: TenantPasswayTls,
    pub idle_ttl: Option<Millis>,
    pub command: Option<String>,
    pub env: BTreeMap<String, String>,
}

One cold, per-tenant passway — a TLS terminator that serves exactly one custom tenant domain, forked on demand by kamaji’s JIT tier (kamaji::jit::JitRuntime) and self-reaped when idle.

This is the declaration W267’s free-tier ingress design was missing. R779 shipped every mechanism — the SNI demux that splices :443 by ClientHello without terminating TLS, passway’s fd-3 adoption + idle self-reap, the R2-backed cert store off raft, the per-domain DNS-01 issuer — but nothing could say “there is a passway for shop.tenant.io at 127.0.0.1:8443”, because kamaji’s on-demand tier was reachable only through MesofactServeBundle, a mesofact-specific carrier.

Why a variant and not an annotated Workload::Container

The W267 node appliance is a container (see Workload::Container’s doc comment): one resident passway per public-IP node, image-pulled, supervised like anything else, so an archetype + annotation expressed it with no wire change. A per-tenant passway is the opposite on every axis that decides the question. It is native-forked, not containerized — kamaji’s JIT tier hands the child an inherited fd, and that path (kamaji::jit) forks a process, not a container. It is zero-resident, so the deploy Ack means “socket bound and armed”, not “a process is running”. And there are ten thousand of them, generated from the enrollment set rather than written by hand. Squeezing that into Container would mean a spec whose image is a lie and whose supervision arm is chosen by an annotation nobody reading the type would look for.

The bind string is the fd-table key

listen is declared, never allocated. It is the address the tenant’s enrollment record already names as its demux backend (yubaba::cert_store::Enrollment::tls_backend), so kamaji must bind exactly it — an allocator picking a port here would arm a socket the demux never routes to, and the tenant’s domain would resolve, handshake, and hang.

The same string is also passway’s PASSWAY_LISTEN, and it must match byte for byte: passway’s socket-activation path (on by default) panics rather than binding fresh when LISTEN_FDS is set and the seed does not take, so a drifted string is a workload that forks and immediately dies on every connection. jit_spec is the reason that cannot happen — it renders PASSWAY_LISTEN from this one field rather than asking a caller to restate it, the same “derive, never re-state” rule yubaba::domain_admin applies to the DNS-01 record name.

Fields

schema_version: SchemaVersion

domain: String

The single custom domain this passway terminates TLS for — the SNI the demux matched to route here, and the hostname jit_spec keys the rendered PASSWAY_UPSTREAMS entries on.

listen: String

host:port kamaji binds and holds in custody, and the address the demux splices this domain’s bytes to. See the type doc: declared, not allocated, and byte-identical to PASSWAY_LISTEN.

upstreams: Vec<String>

Plaintext backends passway forwards to after terminating TLS, as bare host:port. Rendered as <domain>=<addr> entries — repeated entries load-balance (R844-F3), which is why this is a list and not one address.

Empty is legal and means “no backend yet”: passway answers 503 rather than refusing to start, so a domain can be enrolled and issued before the tenant’s app is placed.

tls: TenantPasswayTls

Where the per-domain PEM pair the R2 cert store holds (yubaba::cert_store) has been materialized on the node.

idle_ttl: Option<Millis>

Idle time with no in-flight request before the process exits, leaving kamaji holding the socket and re-forking on the next connection.

None means never reap — a long-running per-tenant passway. That is the shape the free tier exists to avoid (10k resident processes is the number W267 §“Scaling B to a free tier” set out to dissolve), and it also re-opens a rotation gap a cold passway does not have: a cold one re-reads tls at every cold start, while a resident one holds the chain it started with. Sub-second values round up to one second, and zero is not “never” — see idle_ttl_secs.

No skip_serializing_if: this rides the positional postcard wire.

command: Option<String>

Node path of the passway binary to fork. None → DEFAULT_PASSWAY_COMMAND.

env: BTreeMap<String, String>

Extra environment for the forked process — the ACME/auth/health knobs passway reads that this type has no opinion about.

Cannot override the derived keys. jit_spec applies this map first and the derived (PASSWAY_LISTEN/LISTEN_FDS/PASSWAY_IDLE_TTL_SECS/ PASSWAY_UPSTREAMS/PASSWAY_TLS_*) keys last, so an escape hatch cannot silently break the fd handoff — which would surface as a domain that hangs, not as a config error.

Implementations

impl TenantPasswayWorkload

pub fn cold(domain: impl Into<String>, listen: impl Into<String>) -> Self

A cold per-tenant passway for domain on listen, with the conventional cert paths and a one-minute idle TTL.

pub fn with_upstreams<S: Into<String>>( self, addrs: impl IntoIterator<Item = S>, ) -> Self

Point this passway at addrs (bare host:port).

pub fn command_path(&self) -> &str

The passway binary this workload forks.

pub fn idle_ttl_secs(&self) -> Option<u64>

PASSWAY_IDLE_TTL_SECS, or None for “never reap”.

Rounds up to one second, for the reason the bundle JIT path rounds up: passway reads this as an integer number of seconds, so a 500 ms TTL would truncate to 0 — and 0 there does not mean “reap immediately”, it means the reap never fires. Rounding down would turn a declared cold workload resident without any error to read.

pub fn passway_upstreams(&self) -> String

PASSWAY_UPSTREAMS for this domain: <domain>=<addr> per backend, comma-joined. Empty when no backend is declared, which passway reads as “fail ready with 503”.

pub fn jit_spec(&self, id: &str) -> WorkloadSpec

The WorkloadSpec kamaji’s JIT runtime forks for this tenant.

id is the kamaji workload identity (also the mesh ident and the custodian key). Everything else is derived from self — see the type doc for why no caller is allowed to restate PASSWAY_LISTEN.

• entrypoint is the passway binary; command is empty, because passway is configured entirely by environment (it has no config-file parser).
• restart_policy is RestartPolicy::Never: the JIT supervisor owns re-forking on the next connection, and an idle self-reap is an expected exit, not a crash.
• expose.mesh.ports is parsed back off listen rather than carried separately, so the declared port cannot drift from the bound one.
• LISTEN_FDS=1 is set here as well as by the JIT supervisor. That is deliberate redundancy, not a duplicate: it makes the spec truthful about how this process expects to get its socket to anyone reading the spec alone, and setting it twice to the same value is inert.

pub fn listen_port(&self) -> Option<u16>

Port half of listen, when it parses.

Trait Implementations

impl Clone for TenantPasswayWorkload

fn clone(&self) -> TenantPasswayWorkload

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TenantPasswayWorkload

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for TenantPasswayWorkload

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for TenantPasswayWorkload

impl PartialEq for TenantPasswayWorkload

fn eq(&self, other: &TenantPasswayWorkload) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for TenantPasswayWorkload

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for TenantPasswayWorkload

impl TS for TenantPasswayWorkload

type WithoutGenerics = TenantPasswayWorkload

If this type does not have generic parameters, then WithoutGenerics should just be Self. If the type does have generic parameters, then all generic parameters must be replaced with a dummy type, e.g ts_rs::Dummy or ().
The only requirement for these dummy types is that EXPORT_TO must be None.

type OptionInnerType = TenantPasswayWorkload

If the implementing type is std::option::Option<T>, then this associated type is set to T. All other implementations of TS should set this type to Self instead.

fn ident(cfg: &Config) -> String

Identifier of this type, excluding generic parameters.

fn docs() -> Option<String>

JSDoc comment to describe this type in TypeScript - when TS is derived, docs are automatically read from your doc comments or #[doc = ".."] attributes

fn name(cfg: &Config) -> String

Name of this type in TypeScript, including generic parameters

fn decl_concrete(cfg: &Config) -> String

Declaration of this type using the supplied generic arguments. The resulting TypeScript definition will not be generic. For that, see TS::decl(). If this type is not generic, then this function is equivalent to TS::decl().

fn decl(cfg: &Config) -> String

Declaration of this type, e.g. type User = { user_id: number, ... }. This function will panic if the type has no declaration.

fn inline(cfg: &Config) -> String

Formats this types definition in TypeScript, e.g { user_id: number }. This function will panic if the type cannot be inlined.

fn inline_flattened(cfg: &Config) -> String

Flatten a type declaration. This function will panic if the type cannot be flattened.

fn visit_generics(v: &mut impl TypeVisitor)

where Self: 'static,

Iterates over all type parameters of this type.

fn output_path() -> Option<PathBuf>

Returns the output path to where T should be exported, relative to the output directory. The returned path does not include any base directory.

fn visit_dependencies(v: &mut impl TypeVisitor)

where Self: 'static,

Iterates over all dependency of this type.

fn dependencies(cfg: &Config) -> Vec<Dependency>

where Self: 'static,

Resolves all dependencies of this type recursively.

fn export(cfg: &Config) -> Result<(), ExportError>

where Self: 'static,

Manually export this type to the filesystem. To export this type together with all of its dependencies, use TS::export_all.

fn export_all(cfg: &Config) -> Result<(), ExportError>

where Self: 'static,

Manually export this type to the filesystem, together with all of its dependencies. To export only this type, without its dependencies, use TS::export.

fn export_to_string(cfg: &Config) -> Result<String, ExportError>

where Self: 'static,

Manually generate bindings for this type, returning a String. This function does not format the output, even if the format feature is enabled.