config.toml

The server reads one TOML file; its path comes from the AS2D_CONFIG environment variable (default /etc/as2d/config.toml).

listen = "0.0.0.0:8080"          # partner-facing listener

[storage]
kind = "local"                    # "local" | "postgres"
data_dir = "/data"                # local: payloads + state.db; postgres: only used when payloads = "filesystem"
partnerships_file = "/config/partnerships.toml"
keys_dir = "/keys"                # PEM keystore directory

# Required when kind = "postgres":
# [storage.postgres]
# url = "postgres://user:pass@host:5432/db?sslmode=require"
# payloads = "database"           # "database" (multi-replica-safe) | "filesystem"

# Optional overrides, composable with either kind:
# [storage.blob]                  # payloads in Azure Blob Storage
# account = "myaccount"
# account_key = "..."
# container = "as2-payloads"
# endpoint = "https://myaccount.blob.core.windows.net"
#
# [storage.key_vault]             # keys/certs from Azure Key Vault
# vault_url = "https://myvault.vault.azure.net"
# (auth: managed identity by default)

[limits]
max_body_mb = 256                 # maximum accepted HTTP body
decompress_limit_mb = 512         # zip-bomb ceiling for decompression

[license]
path = "/etc/as2d/license.lic"    # the signed license file

[observability]
log_format = "json"               # "json" | "text"
log_level = "info"                # RUST_LOG env var overrides

[observability.metrics]
enabled = false                   # opt-in Prometheus
listen = "0.0.0.0:9090"           # DEDICATED listener — never expose to partners

Field notes:

• listen — TLS is not terminated here; put your ingress/load balancer in front. Routes served: POST / and POST /as2 (messages, with receipts auto-detected), POST /as2/mdn (asynchronous receipts), GET /healthz.
• storage.kind = "local" — SQLite + filesystem under data_dir. Single replica only; zero external services.
• storage.kind = "postgres" — all state shared; required for multiple replicas or scale-to-zero. Any PostgreSQL works; TLS honored via sslmode in the URL. With payloads = "filesystem" payload bytes stay on local disk (single replica or shared volume only).
• Overrides — [storage.blob] and [storage.key_vault] replace just the payload store / keystore and compose with either kind.
• [license].path — a missing file boots the server in the degraded unlicensed state; an invalid file refuses to boot. See Installing your license.
• The server validates everything it can at startup — storage connectivity, partnership identifiers, license entitlements — and refuses to boot with a specific message rather than failing on the first partner message.