krabka_remote_storage/worm/
config.rs

1//! Configuration for the write-once (WORM) archive backend.
2
3use std::path::PathBuf;
4
5/// Settings that make an object-store backend a write-once archive.
6///
7/// # Debug output is deliberately plain
8///
9/// This struct derives the ordinary [`Debug`]. It holds a key *path* and a
10/// public key id, and it never holds secret material: the private key stays in
11/// the file that [`Self::signing_key_path`] names, and only
12/// [`FileEd25519Signer`](krabka_audit::signing::FileEd25519Signer) reads it.
13/// Do not redact these fields. An operator who reads a log line must be able to
14/// tell which key signed a chain. A `***` in place of the key id removes the
15/// one field that answers that question.
16#[derive(Debug, Clone, Default, PartialEq, Eq)]
17pub struct WormConfig {
18    /// Path to the `PKCS#8` Ed25519 key that signs each manifest.
19    ///
20    /// Default: `None`. Manifests then carry no signature, and the archive
21    /// keeps only the per-object digests and the hash chain.
22    pub signing_key_path: Option<PathBuf>,
23    /// Stable identifier recorded in every manifest signature, so a chain
24    /// stays verifiable across a key rotation.
25    ///
26    /// Default: `None`.
27    pub signing_key_id: Option<String>,
28    /// Refuse every remote fetch from this archive.
29    ///
30    /// Default: `false`. When `true`, remote fetch is unavailable: a consumer
31    /// that asks for an offset whose local segment was evicted gets
32    /// [`WormError::ReadRefused`](crate::WormError::ReadRefused), not a slow
33    /// read. The archive is then a compliance sink, not a storage tier.
34    pub write_only: bool,
35}
krabka_remote_storage/worm/config.rs

krabka_remote_storage/worm/
config.rs
