Struct AdminConfig 

pub struct AdminConfig {
    pub bind: String,
    pub tls: AdminTlsConfig,
    pub rbac: Option<AdminRbacConfig>,
    pub api_tokens: Option<AdminApiTokensConfig>,
    pub audit: Option<AdminAuditConfig>,
}

Admin listener configuration (DW-022).

Fields

bind: String

Bind address of the admin listener. Default 127.0.0.1:2019 (loopback-only; frozen decision 6) — override only to place the admin API on a dedicated management interface, and rely on mTLS for access control: there is no token layer in v1 (the client certificate IS the auth).

tls: AdminTlsConfig

mTLS material for the admin listener; all three files are required.

rbac: Option<AdminRbacConfig>

SEC-01: RBAC bindings for mTLS-authenticated admin clients. Maps client certificate fingerprints (SHA-256 of the cert DER) to roles. When present, a valid client certificate with NO binding is denied (fail-closed: no implicit admin). When absent (the default), any CA-valid client certificate is treated as full admin (the v1 behavior — backward compatible).

api_tokens: Option<AdminApiTokensConfig>

SEC-01: API token authentication. When present, the admin API accepts an Authorization: Bearer <token> header in addition to mTLS. Tokens are hashed (SHA-256) at rest; the config lists token hashes, not plaintext tokens. When absent (the default), only mTLS is accepted (the v1 behavior).

audit: Option<AdminAuditConfig>

SEC-01: Admin audit log. When present, all mutating admin actions (PATCH /config, purge) are recorded in an append-only audit table in the state store. Each entry includes the actor (cert fingerprint or token hash), the action, the before/after config hash, and a timestamp. When absent (the default), no audit log is kept.

Trait Implementations

impl Clone for AdminConfig

fn clone(&self) -> AdminConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AdminConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AdminConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for AdminConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for AdminConfig

fn eq(&self, other: &AdminConfig) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for AdminConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AdminConfig