nordisk/holger

examples/secure-update-gateway/ot-critical-readonly.ron

// Protected OT node — Critical security profile + ReadOnly operation mode.
//
// `holger-mikro start --config ot-critical-readonly.ron`
//
// Startup REFUSES this config unless it can enforce the Critical profile:
//   - audit.enabled = true and the audit sink opens
//   - auth configured with a non-static mechanism (mTLS here)
//   - auth.require_auth_for_reads = true
//   - every exposed endpoint is mTLS (cert + key + client_ca)
//   - every repository initializes
// In ReadOnly mode every network mutation is refused before the body is read.
//
// The `bundles` raw repository's `ron_data_dir` is the served bundle store that
// `holger-server bundle import` writes into. Replace the /etc/holger/pki/* paths
// with your real certificates.
(
    security_profile: Critical,
    operation_mode: ReadOnly,

    repositories: [
        (
            ron_name: "bundles",
            ron_repo_type: "raw",
            ron_upstreams: [],
            ron_in: None,
            ron_out: None,
            ron_data_dir: Some("/var/lib/holger/bundle-store/bundles"),
        ),
    ],

    exposed_endpoints: [
        (
            ron_name: "grpc",
            ron_url: "0.0.0.0:50443",
            ron_http_url: Some("0.0.0.0:8443"),
            ron_tls: Some((
                cert: "/etc/holger/pki/server.crt",
                key: "/etc/holger/pki/server.key",
                client_ca: Some("/etc/holger/pki/client-ca.crt"),
                // HOL-NCSC: the client certificates' revocation list (Critical requires it).
                crl: Some("/etc/holger/pki/client-ca.crl"),
            )),
        ),
    ],

    storage_endpoints: [],

    auth: Some((
        methods: [ Mtls(ca_cert: "/etc/holger/pki/client-ca.crt") ],
        require_auth_for_reads: true,
        default_role: Some(Reader),
    )),

    audit: (dir: "/var/lib/holger/bundle-store/audit", enabled: true),
)