Configuration Reference

SPORK CA can be configured through CLI flags, environment variables, and a TOML configuration file. This page documents every option.

Configuration Methods

Settings are resolved in the following order of precedence (highest first):

1. CLI flags — Override everything. Passed directly on the command line.
2. Environment variables — Override config file and defaults.
3. Config file — /etc/spork/config.toml (or path set by --config).
4. Built-in defaults — Sensible values that work for development and simple deployments.

Environment Variables

Core

Server Ports

TLS

HSM (PKCS#11)

ACME-Specific

Environment File

SPORK ACME is configured via CLI flags and environment variables. For systemd deployments, use an EnvironmentFile to store sensitive values outside the service file:

# /opt/spork-acme/spork-acme.env

# Keystore passphrase (encrypts CA private keys at rest)
SPORK_LOCKBOX_PASSPHRASE=your-secure-passphrase

# Admin dashboard credentials
SPORK_ADMIN_USER=admin
SPORK_ADMIN_PASSWORD=your-admin-password

# Log level (trace, debug, info, warn, error)
RUST_LOG=spork_acme=info

Reference it from the systemd service file:

[Service]
EnvironmentFile=/opt/spork-acme/spork-acme.env
ExecStart=/usr/local/bin/spork-acme -s /opt/spork-acme --auto-validate

CLI Flags

Common flags for spork-acme:

Domain Policy

SPORK ACME uses a deny-by-default domain policy to control which domains can receive certificates. The policy is configured via a TOML file in the state directory.

Policy File Format

Create domain-policy.toml in your state directory (e.g., /opt/spork-acme/domain-policy.toml):

# /opt/spork-acme/domain-policy.toml
[policy]
mode = "deny-by-default"  # or "allow-by-default"

[[allow]]
pattern = "*.quantumnexus.com"

[[allow]]
pattern = "quantumnexus.com"

[[deny]]
pattern = "*.evil.com"

CLI Integration

The policy file is loaded via --domain-policy-file. You can also add patterns additively from the command line:

# Load policy file and add extra patterns
spork-acme -s /opt/spork-acme \
  --domain-policy-file /opt/spork-acme/domain-policy.toml \
  --allow-domain "*.lab.local" \
  --deny-domain "*.test.invalid"

CLI patterns (--allow-domain, --deny-domain) are merged with the policy file. Deny rules always take precedence over allow rules.

Pattern Syntax

mTLS Setup

SPORK CA uses mutual TLS (mTLS) with admin certificates to authenticate destructive operations. Certificates contain a Policy OID that determines the access level:

Admin Certificate Hierarchy

Importing PFX in Your Browser

To access the admin web UI, import the admin PFX certificate into your browser:

1. Chrome/Edge: Settings → Privacy and Security → Security → Manage certificates → Import. Select the .pfx file and enter the passphrase.
2. Firefox: Settings → Privacy & Security → View Certificates → Your Certificates → Import. Select the .pfx file and enter the passphrase.
3. Safari: Double-click the .pfx file to add it to Keychain Access. Enter the passphrase when prompted.

Once imported, navigate to the admin UI (e.g., https://your-server:6446/admin). The browser will prompt you to select the client certificate. Choose the SPORK admin certificate.

Production Checklist

Before deploying SPORK CA in production, verify the following: