nordisk/holger

examples/secure-update-gateway/intake-critical.ron

// Intake / review-side registry (internet-connected side of the airgap).
//
// The intake side runs `holger-agent --strict --receipt ...` to fetch vendor
// artifacts, then `holger-bundle prepare/approve/finalize`. A holger-server on this
// side is optional (a staging registry for candidates). This example is a Standard
// profile with authenticated writes — the review environment, NOT the protected
// node. Egress is expected here (unlike the OT node).
(
    security_profile: Standard,
    operation_mode: ReadWrite,

    repositories: [
        (
            ron_name: "staging",
            ron_repo_type: "raw",
            ron_upstreams: [],
            ron_in: None,
            ron_out: None,
            ron_data_dir: Some("/var/lib/holger/intake-staging"),
        ),
    ],

    exposed_endpoints: [
        (
            ron_name: "grpc",
            ron_url: "127.0.0.1:50051",
            ron_http_url: Some("127.0.0.1:8080"),
            ron_tls: Some((
                cert: "/etc/holger/pki/server.crt",
                key: "/etc/holger/pki/server.key",
                client_ca: Some("/etc/holger/pki/client-ca.crt"),
            )),
        ),
    ],

    storage_endpoints: [],

    auth: Some((
        methods: [ Mtls(ca_cert: "/etc/holger/pki/client-ca.crt") ],
        // Writers upload candidates; reads stay open on the review side.
        roles: { "CN=release-engineer": Writer },
    )),

    audit: (dir: "/var/lib/holger/intake-audit", enabled: true),
)
// The evidence signer's key may live in a hardware token (a build with `--features pkcs11`):
//   attestation: Some((trust_roots: ["/etc/holger/pki/scan-root.der"],
//       signer_hsm: Some(Pkcs11(module: "/usr/lib/softhsm/libsofthsm2.so", token_label: "holger",
//                               key_label: "scan", pin_file: "/etc/holger/pki/hsm.pin")),
//       signer_cert: Some("/etc/holger/pki/scan.der"), signer_alg: Some("ecdsa-p256"))),