Module system 

Schema for system.yaml: process-level settings (data-plane listener, TLS, HTTP/2, timeouts, logging, admin API). Loaded once at startup and never hot-reloaded; every top-level field has a serde default, so any section may be omitted.

Structs

AcmeConfig

Top-level ACME settings (acme: in system.yaml).

AcmeEabConfig

External Account Binding credentials issued by the CA.

AcmeSlot

One ACME-managed certificate slot.

AdminConfig

Admin REST API settings; presence of this section enables the admin server on a separate port from the data plane.

CacheConfig

Process-wide response-cache limits.

ConfigSourceConfig

Selects the gateway-config backend.

DebugConfig

Debug mode: per-request policy-execution tracing plus the plugin sandbox.

EtcdConfig

etcd connection settings (used when config.source is etcd).

Http2Config

HTTP/2 support toggle; enabled by default.

ListenerConfig

Bind address and port for the data-plane HTTP listener.

LoggingConfig

Logging configuration for the tracing subscriber.

McpConfig

admin.mcp — the MCP server exposed to agents.

McpTokenConfig

One MCP bearer token.

SniCert

One SNI-selected certificate for multi-domain TLS termination: an exact or single-label-wildcard server name mapped to its own cert/key.

SniRoute

One SNI passthrough route: an exact or single-label-wildcard server name mapped to its own upstream pool.

StreamListenerConfig

An L4 stream listener: binds bind:port and proxies raw TCP or UDP to an upstream pool. Bound once at startup (fail-fast), like the HTTP listener.

StreamUpstreamConfig

Upstream pool for an L4 stream listener.

SystemConfig

Root of system.yaml.

TimeoutConfig

Connection lifecycle timeouts in seconds.

TlsConfig

TLS termination settings for a listener (data plane or admin).

Enums

AcmeStorageConfig

ACME state storage backend (acme.storage.type).

ConfigSourceKind

Which config backend to use.

McpScope

What an MCP token may do. write implies read.

StreamProtocol

Transport protocol for an L4 stream listener.

Constants

MCP_MIN_TOKEN_LEN

Minimum accepted length of an MCP bearer token, in characters.

Functions

default_acme_dir 🔒

default_acme_directory 🔒

default_acme_key_type 🔒

default_acme_renew_before 🔒

default_admin_port 🔒

default_bind 🔒

default_etcd_prefix 🔒

default_etcd_timeout 🔒

default_listener 🔒

default_log_format 🔒

default_log_level 🔒

default_mcp_path 🔒

default_port 🔒

default_timeout_30 🔒

default_timeout_300 🔒

default_tls_min_version 🔒

default_trigger_header 🔒

default_true 🔒

normalize_domain

Lowercases and validates one ACME DNS identifier: no wildcards, no IPs, only [a-z0-9.-], non-empty labels.

parse_duration

Parses 30d / 12h / 5m / 90s / bare seconds into a [Duration].