spin_factor_outbound_networking/
runtime_config.rs

1#[cfg(feature = "spin-cli")]
2pub mod spin;
3
4pub use rustls_pki_types::{CertificateDer, PrivateKeyDer};
5
6/// Runtime configuration for outbound networking.
7#[derive(Debug, Default)]
8pub struct RuntimeConfig {
9    /// Blocked IP networks
10    pub blocked_ip_networks: Vec<ip_network::IpNetwork>,
11    /// If true, non-globally-routable networks are blocked
12    pub block_private_networks: bool,
13    /// TLS client configs
14    pub client_tls_configs: Vec<ClientTlsRuntimeConfig>,
15    /// Maximum number of outbound TCP/UDP socket connections across all instances of this app.
16    /// `None` means unlimited (default).
17    pub max_socket_connections: Option<usize>,
18    /// Maximum number of outbound connections across ALL connection types (global cap).
19    /// `None` means unlimited (default).
20    pub max_total_connections: Option<usize>,
21    /// If set, limits how long `acquire` will wait for a socket connection permit.
22    pub wait_timeout: Option<std::time::Duration>,
23}
24
25/// TLS configuration for one or more component(s) and host(s).
26#[derive(Debug)]
27pub struct ClientTlsRuntimeConfig {
28    /// The component(s) this configuration applies to.
29    pub components: Vec<String>,
30
31    /// The host(s) this configuration applies to.
32    pub hosts: Vec<String>,
33
34    /// If `true`, the operating system's certificate store will be used for
35    /// root certificate verification
36    /// [`rustls-platform-verifier`](rustls_platform_verifier).
37    ///
38    /// By default this is `true`.
39    pub use_platform_roots: bool,
40
41    /// If `true`, the "standard" CA certs in the
42    /// [`webpki-root-certs`](webpki_root_certs) crate will be considered valid
43    /// roots.
44    ///
45    /// By default this is `true`.
46    pub use_webpki_roots: bool,
47
48    /// A set of CA certs that should be considered valid roots.
49    ///
50    /// These will be used _in addition_ to roots enabled by
51    /// [`use_platform_roots`](Self::use_platform_roots) and
52    /// [`use_webpki_roots`](Self::use_webpki_roots).
53    pub root_certificates: Vec<CertificateDer<'static>>,
54
55    /// A certificate and private key to be used as the client certificate for
56    /// "mutual TLS" (mTLS).
57    pub client_cert: Option<ClientCertRuntimeConfig>,
58}
59
60impl Default for ClientTlsRuntimeConfig {
61    fn default() -> Self {
62        Self {
63            components: vec![],
64            hosts: vec![],
65            root_certificates: vec![],
66            use_platform_roots: true,
67            use_webpki_roots: true,
68            client_cert: None,
69        }
70    }
71}
72
73#[derive(Debug)]
74pub struct ClientCertRuntimeConfig {
75    pub cert_chain: Vec<CertificateDer<'static>>,
76    pub key_der: PrivateKeyDer<'static>,
77}
spin_factor_outbound_networking/runtime_config.rs

spin_factor_outbound_networking/
runtime_config.rs
