Struct ServeArgs 

pub struct ServeArgs {

    pub listen: SocketAddr,
    pub tls_cert: PathBuf,
    pub tls_key: PathBuf,
    pub client_ca: Option<PathBuf>,
    pub fleet_ca_cert: Option<PathBuf>,
    pub fleet_ca_key: Option<PathBuf>,
    pub tpm_ca_pubkey_raw: Option<PathBuf>,
    pub tpm_ca_sign_wrapper: Option<PathBuf>,
    pub allow_file_ca_key: bool,
    pub audit_log_path: Option<PathBuf>,
    pub artifact_path: PathBuf,
    pub signature_path: PathBuf,
    pub trust_path: PathBuf,
    pub observed_path: PathBuf,
    pub freshness_window: Duration,
    pub confirm_deadline_secs: i64,
    pub channel_refs: Option<ChannelRefsSource>,
    pub revocations: Option<RevocationsSource>,
    pub bootstrap_nonces: Option<BootstrapNoncesSource>,
    pub db_path: Option<PathBuf>,
    pub closure_upstream: Option<String>,
    pub rollouts_dir: Option<PathBuf>,
    pub rollouts_source: Option<RolloutsSource>,
    pub strict: bool,
    pub agent_cn_suffix: String,
    pub agent_cert_validity: Duration,
    pub mark_ready_at_startup: bool,
    pub initial_nonces: Option<AllowedNoncesView>,
}

Default defaults are bogus on purpose; prod paths fail at first IO if clap parsing is skipped.

Fields

listen: SocketAddr

tls_cert: PathBuf

tls_key: PathBuf

client_ca: Option<PathBuf>

fleet_ca_cert: Option<PathBuf>

Often the same path as client_ca.

fleet_ca_key: Option<PathBuf>

File-backed CA signer’s private key PEM. TPM (pubkey + wrapper) wins.

tpm_ca_pubkey_raw: Option<PathBuf>

TPM-backed CA signer: keyslot scope’s pubkey.raw (64 raw P-256 X||Y).

tpm_ca_sign_wrapper: Option<PathBuf>

TPM-backed CA signer: keyslot scope’s tpm-sign-<keyname> wrapper.

allow_file_ca_key: bool

Permit the file-backed CA-issuance backend under --strict. Default false: in strict mode, the file backend is refused unless TPM is also configured (in which case TPM wins) or this flag is set explicitly. See RFC-0010 §1.5.1.

audit_log_path: Option<PathBuf>

artifact_path: PathBuf

signature_path: PathBuf

trust_path: PathBuf

observed_path: PathBuf

File-backed fallback used only when no agents checked in AND channel_refs is None.

freshness_window: Duration

confirm_deadline_secs: i64

channel_refs: Option<ChannelRefsSource>

None -> file-backed --artifact only.

revocations: Option<RevocationsSource>

bootstrap_nonces: Option<BootstrapNoncesSource>

db_path: Option<PathBuf>

None -> in-memory state only.

closure_upstream: Option<String>

None -> /v1/agent/closure/<hash> returns 501.

rollouts_dir: Option<PathBuf>

Pre-signed <rolloutId>.{json,sig} pairs; falls back to rollouts_source, then 503.

rollouts_source: Option<RolloutsSource>

HTTP-fetched manifests; required when nixfleet-release writes manifests post-build.

strict: bool

Refuse to start when any security-fallback flag is unset.

agent_cn_suffix: String

agent-<machineId>.<suffix> for issued cert CNs. Must match the issuance CA’s dNSName name constraint (D14).

agent_cert_validity: Duration

Validity baked into agent certs at enroll + renew. Default 30d; shortened by operators for hardware testing of renewal flows.

mark_ready_at_startup: bool

Test-only: skip the readiness gate so endpoint tests don’t have to drive a real channel-refs poll. Production paths MUST leave false; the CLI never sets it.

initial_nonces: Option<AllowedNoncesView>

Test-only: seed the in-memory bootstrap-nonces allowlist at startup without running the poll loop. Production paths MUST leave None; the CLI never sets it.

Trait Implementations

impl Clone for ServeArgs

fn clone(&self) -> ServeArgs

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServeArgs

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ServeArgs

fn default() -> Self

Returns the “default value” for a type.