Struct TlsSection 

pub struct TlsSection {
    pub acme_environment: Option<String>,
    pub contact: Option<Vec<String>>,
    pub cert_source: Option<String>,
    pub mode: Option<String>,
    pub ca_dir: Option<String>,
    pub hsts_max_age_secs: Option<u64>,
    pub hsts_include_subdomains: Option<bool>,
}

TLS certificate sourcing, mirroring didbot-tls’s configuration surface.

Reload: the certificate itself hot-reloads once issued (didbot-tls’s SwappableCert); the ACME environment and contact address do not — they govern how the next certificate is obtained, not the one already served.

Fields

acme_environment: Option<String>

staging or production ACME directory. Mirrors --acme-environment.

Staging (the default) issues untrusted certificates against generous rate limits, which is what iterating on a deployment wants. Production has hard weekly rate limits, and a run that burns them waits a week.

contact: Option<Vec<String>>

Contact URIs (mailto:ops@example.com) for the ACME account. Mirrors --acme-contact, and holds the same list.

cert_source: Option<String>

Where the certificate comes from: acme or a path to a fixed pair, for development.

mode: Option<String>

Which authority issues this deployment’s certificate: acme or local. Mirrors --tls.

Unset takes the one authority the primary zone may use, which is local for a zone under .localhost and acme for any other.

ca_dir: Option<String>

The directory holding the local certificate authority local signs with. Mirrors --tls-ca.

Unset keeps it under $XDG_STATE_HOME/didbot, which is one authority per machine: a developer trusts it once, and every local server on that machine presents leaves it signed. Point two checkouts at one directory to share an authority, or at two to keep them apart.

hsts_max_age_secs: Option<u64>

The max-age of the Strict-Transport-Security header, in seconds. No flag mirrors this, only this key. Unset is 63_072_000, two years, the same as did.bot’s own header (infra/site/).

Sent only by a run with mode = "acme" and acme_environment = "production". A browser that has seen the header refuses a certificate error under the names it covers for this long, with no way to click through, and every other certificate this server can serve chains to a root browsers do not trust.

Reasonable range: 15_768_000 (six months) to 63_072_000 (two years). Below six months, SSL Labs and the HTTP Observatory score the header as absent. 0 tells a browser to drop the header it already holds, which is how a deployment backs out of one.

hsts_include_subdomains: Option<bool>

Whether the Strict-Transport-Security header carries includeSubDomains. No flag mirrors this, only this key. Unset is false.

true commits every name below the one a browser reached, including names this server does not serve. That is right when this server’s zone is its own domain, so every name below it is an account served under this server’s wildcard certificate. It is wrong when the server sits at a domain that has other hosts.

Trait Implementations

impl Clone for TlsSection

fn clone(&self) -> TlsSection

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsSection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TlsSection

fn default() -> TlsSection

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for TlsSection

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for TlsSection

fn eq(&self, other: &TlsSection) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for TlsSection

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for TlsSection

impl StructuralPartialEq for TlsSection