Struct RelayBridgeConfig 

pub struct RelayBridgeConfig {

    pub relay_addr: String,
    pub relay_host: String,
    pub node_id: String,
    pub relay_token: Option<String>,
    pub local_wss_addr: String,
    pub local_enroll_addr: Option<String>,
    pub enroll_bridge_ports: Option<BridgePortSet>,
    pub signing_key_pkcs8: Vec<u8>,
    pub relay_ca_path: Option<String>,
    pub relay_insecure: bool,
    pub relay_tofu: bool,
    pub outer_client_cert: Option<String>,
    pub outer_client_key: Option<String>,
    pub max_conns: usize,
    pub open_burst: u32,
    pub open_rate_per_sec: f64,
    pub data_dir: PathBuf,
    pub node_id_rotation_days: u64,
    pub rotation_allowed: bool,
}

Everything the bridge needs to register with, and verify, a relay.

Fields

relay_addr: String

Relay host:port to dial.

relay_host: String

Server name presented for the relay’s outer TLS cert (its SAN).

node_id: String

Opaque node-id this daemon claims (clients dial it).

relay_token: Option<String>

Optional shared-secret admission gate.

local_wss_addr: String

Loopback address of the daemon’s own WSS listener (e.g. 127.0.0.1:9781).

local_enroll_addr: Option<String>

Optional loopback address of the daemon’s narrow enrollment listener.

enroll_bridge_ports: Option<BridgePortSet>

Shared with the enrollment endpoint: the bridge registers each outbound enroll-dial source port here BEFORE connecting, so the endpoint can classify those loopback connections as relay-routed (shared-identity peers) rather than direct clients. See enroll::BridgePortSet.

signing_key_pkcs8: Vec<u8>

PKCS#8 of the daemon’s Ed25519 registration key.

relay_ca_path: Option<String>

PEM CA to trust for the relay’s outer cert; None uses public roots.

relay_insecure: bool

Skip relay outer-cert verification (test only).

relay_tofu: bool

Opt-in trust-on-first-use for the relay’s OUTER leaf cert (A2): accept the first leaf and record its pin to <data_dir>/relay/relay_pin, pinning it thereafter. Never silently enabled; ignored when a relay CA is configured.

outer_client_cert: Option<String>

Outer-mTLS variant: PEM cert/key the daemon presents to the relay on the OUTER layer (needed when the relay sets outer_client_auth = required). None presents no outer client cert. Separate from the inner mTLS.

outer_client_key: Option<String>

max_conns: usize

Cap on simultaneously-bridged client connections (bridge-side DoS cap).

open_burst: u32

Per-node OPEN handshake-rate cap (A6): burst allowance + steady refill per second. A flood of OPENs beyond this is fast-rejected with Close BEFORE a loopback mTLS handshake is spun up, so the relay’s caps are not the only line of defense.

open_rate_per_sec: f64

data_dir: PathBuf

Daemon data dir; the node-id + rotation-trigger files live under relay/.

node_id_rotation_days: u64

Auto-rotate the node-id every N days (0 = never). Only meaningful when the id is auto-minted (rotation_allowed).

rotation_allowed: bool

Whether node-id rotation is permitted: true only when the operator did not pin [relay].node_id (a pinned id is fixed). Gates both scheduled and on-demand rotation.

Trait Implementations

impl Clone for RelayBridgeConfig

fn clone(&self) -> RelayBridgeConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.