Struct RelayConfig 

pub struct RelayConfig {
    pub enabled: bool,
    pub url: String,
    pub node_id: String,
    pub token: String,
    pub relay_ca_path: String,
    pub relay_host: String,
    pub relay_insecure: bool,
    pub tofu: bool,
    pub outer_client_cert: String,
    pub outer_client_key: String,
    pub node_id_rotation_days: u64,
}

Nominated-relay client ([relay]).

When enabled, the daemon keeps a persistent outbound connection to a relay and registers node_id, so clients behind NAT can reach it through the relay. The relay is a blind forwarder: the inner client<->daemon mTLS still terminates at the daemon’s WSS listener and is never decrypted by the relay.

Fields

enabled: bool

Enable the relay bridge (default: false).

url: String

Relay address to connect to, as host:port.

node_id: String

Opaque node-id this daemon registers under (clients dial this id). Leave empty (recommended) to auto-mint and persist a random 128-bit capability at <data_dir>/relay/node_id; set it only to pin a specific id. It must stay unguessable and is decoupled from the cert - do NOT use a name or a cert thumbprint (a guessable/derivable id lets attackers probe and flood you).

token: String

Relay account token presented at registration (admission credential).

relay_ca_path: String

PEM CA to trust for the relay’s OWN (outer) TLS certificate. When set, this explicit CA takes precedence over remembered/TOFU relay pins. Empty uses the built-in public roots unless a stored pin or tofu is active.

relay_host: String

Server name to expect on the relay’s outer certificate. Empty derives it from the host portion of url.

relay_insecure: bool

Skip verification of the relay’s outer certificate (self-signed dev only).

tofu: bool

Trust-on-first-use for the relay’s OUTER certificate (default false): accept the first leaf seen and pin it at <data_dir>/relay/relay_pin thereafter (the pin is also handed to enrolling clients). Opt-in; ignored once a pin is stored or relay_ca_path is set. A configured relay CA also bypasses any previously stored TOFU pin. The outer TLS is a metadata boundary, not the RPC boundary (the inner mTLS is); see threat A2.

outer_client_cert: String

PEM cert/key the daemon presents to the relay on the OUTER TLS layer (outer-mTLS variant), required only when the relay sets outer_client_auth = required. Empty presents no outer client cert. This is separate from the inner mTLS client identity.

outer_client_key: String

node_id_rotation_days: u64

Auto-rotate the auto-minted node-id every N days (default 0 = never). Rotation mints a fresh id, registers it alongside the old one for a short grace window (so in-flight clients keep working), then retires the old id; the new id reaches clients in-band on their next certificate renewal. Only applies when node_id is empty (an operator-pinned id is never rotated).

Implementations

impl RelayConfig

pub fn configurable_prefix() -> &'static str

Returns the #[prefix] value for this Configurable struct.

pub fn init_requires_explicit_config() -> bool

True when this struct has a required leaf field that a bare/ancestor-prefix init_defaults scaffold must not materialize (it would fill the field with its Rust Default, which prune_empty_leaves then strips on save, leaving a partial sub-table that fails strict reload). Explicitly targeting this section (or a descendant of it) still scaffolds regardless of this flag, so the section can be materialized for the operator to fill in.

pub fn secret_fields(&self) -> Vec<SecretFieldInfo>

Returns metadata about all #[secret] fields on this struct and nested children.

pub fn secret_field_terminals() -> Vec<&'static str>

pub fn encrypt_secrets(&mut self, store: &SecretStore) -> Result<(), Error>

Encrypt all secret fields in place using the provided store.

pub fn decrypt_secrets(&mut self, store: &SecretStore) -> Result<(), Error>

Decrypt all secret fields in place using the provided store.

pub fn set_secret(&mut self, name: &str, value: String) -> Result<(), Error>

Set a secret field by its full dotted name, dispatching to nested children.

pub fn prop_fields(&self) -> Vec<PropFieldInfo>

Returns metadata about all property fields on this struct and nested children.

pub fn get_prop(&self, name: &str) -> Result<String, Error>

Get a property value by its full dotted name, returning it as a display string.

pub fn set_prop(&mut self, name: &str, value_str: &str) -> Result<(), Error>

Set a property value by its full dotted name, parsing from string.

pub fn prop_is_secret(name: &str) -> bool

Check if a property name refers to a secret field (static, no instance needed).

pub fn init_defaults(&mut self, prefix: Option<&str>) -> Vec<&'static str>

Instantiate None nested sections whose prefix matches. Returns the prefixes that were initialized.

pub fn map_key_sections() -> Vec<MapKeySection>

Enumerate every map-keyed (HashMap<String, T>) and list-shaped (Vec<T>) section discoverable from this Configurable’s tree. The dashboard / CLI consume this to surface “+ Add” affordances without hardcoding the section list.

pub fn nested_section_help(name: &str) -> Option<&'static str>

Help blurb for a #[nested] field on this struct, sourced from the field-level /// docstring. Returns None for unknown names so callers can fall through to a different lookup.

pub fn nested_section_group(name: &str) -> Option<&'static str>

pub fn get_map_keys(&self, section_path: &str) -> Option<Vec<String>>

Return the current alias keys at section_path, or None if the path doesn’t resolve to a map-keyed section in this tree.

pub fn nested_option_entries(&self) -> Vec<NestedOptionEntry>

pub fn create_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn delete_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn rename_map_key( &mut self, section_path: &str, map_key: &str, new_key: &str, ) -> Result<bool, String>

Trait Implementations

impl Clone for RelayConfig

fn clone(&self) -> RelayConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RelayConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for RelayConfig

fn default() -> RelayConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RelayConfig

fn deserialize<__D>( __deserializer: __D, ) -> Result<RelayConfig, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for RelayConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl MaskSecrets for RelayConfig

fn mask_secrets(&mut self)

fn restore_secrets_from(&mut self, current: &RelayConfig)

impl Serialize for RelayConfig

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.