Struct TrustConfig 

pub struct TrustConfig {
    pub schema_version: u32,
    pub ci_release_key: KeySlot,
    pub cache_keys: Vec<String>,
    pub org_root_key: Option<KeySlot>,
    pub root_ca_pem: Option<String>,
    pub issuance_ca_pems: Vec<String>,
}

Loaded from /etc/nixfleet/{cp,agent}/trust.json. Restart-only reload.

Fields

schema_version: u32

ci_release_key: KeySlot

cache_keys: Vec<String>

Forwarded opaquely to nix.settings.trusted-public-keys.

org_root_key: Option<KeySlot>

root_ca_pem: Option<String>

PEM-encoded fleet root CA cert. Offline-signed (operator workstation, file or Yubikey) and embedded in trust.json so verifiers anchor cert chains at a key the CP never holds at rest. None until the operator has run nixfleet-trust-bootstrap.

issuance_ca_pems: Vec<String>

PEM-encoded issuance CAs the fleet trusts to mint agent certs, each signed by root_ca_pem. Multiple entries support rotation overlap - agents accept any cert chain anchored at one of these intermediates.

Implementations

impl TrustConfig

pub const CURRENT_SCHEMA_VERSION: u32 = 1

Trait Implementations

impl Clone for TrustConfig

fn clone(&self) -> TrustConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TrustConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for TrustConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for TrustConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.