Struct EnrollServer 

pub struct EnrollServer {
    pub bind_addr: SocketAddr,
    pub acceptor: TlsAcceptor,
    pub ca_cert_pem: String,
    pub ca_key_pem: Zeroizing<String>,
    pub ledger: Arc<CertLedger>,
    pub pairing: Arc<PairingGuard>,
    pub static_client_pins_configured: bool,
    pub allow_unpaired_until: Option<DateTime<Utc>>,
    pub relay_profile: RelayProfile,
    pub bridge_ports: Option<BridgePortSet>,
    pub relay_attempt_bucket: RelayAttemptBucket,
    pub paircode_admin_data_dir: Option<PathBuf>,
}

Fields

bind_addr: SocketAddr

acceptor: TlsAcceptor

Server-authentication-only TLS acceptor (no client cert; this is the bootstrap surface, not the mTLS RPC plane).

ca_cert_pem: String

CA cert PEM (returned to the client and used for the SAS fingerprint).

ca_key_pem: Zeroizing<String>

CA key PEM (decrypted), used only to sign CSRs. Held in memory for the endpoint’s lifetime; never written or returned.

ledger: Arc<CertLedger>

pairing: Arc<PairingGuard>

static_client_pins_configured: bool

Static WSS pin allowlists cannot admit freshly issued in-band certs unless the operator updates the canonical pin source out of band.

allow_unpaired_until: Option<DateTime<Utc>>

RFC3339 instant before which a code-less (“unpaired”) enrollment is accepted - the time-boxed migration window. None means closed.

relay_profile: RelayProfile

Relay coordinates to hand back, when the relay bridge is configured.

bridge_ports: Option<BridgePortSet>

Data dir used for local operator requests to mint additional pairing codes. This is intentionally not exposed through the public enrollment HTTP route because relay traffic reaches this listener over loopback. Ports the relay bridge dials enrollment from (None = no relay bridge).

relay_attempt_bucket: RelayAttemptBucket

Class-wide attempt budget for relay-routed enrollment.

paircode_admin_data_dir: Option<PathBuf>