Server Configuration

Crabka brokers are configured from a TOML file. Each section below maps to a top-level key or [table] of that file.

General

Field	Type	Required	Default	Description
`auto_join`	boolean	no	`null`	Enable automatic dynamic controller enrollment.
`bootstrap_servers`	array	no	`[]`	KIP-853 controller discovery endpoints. Hosts remain unresolved so DNS names can be refreshed on each retry.
`broker_id`	integer	no
`controller_election_timeout`	string	no	`null`	Controller election timeout. Absent leaves the `BrokerConfig` default intact.
`controller_heartbeat_interval`	string	no	`null`	Controller heartbeat interval. Absent leaves the `BrokerConfig` default intact.
`controller_listener_protocol`	string	no	`null`	Controller listener security protocol. When `Some(Ssl)` the controller listener terminates TLS using `tls_config`.
`controller_quorum_voters`	array	no	`[]`	KIP-595 static controller quorum voter set. Each entry is `<node_id>@<host>:<port>` pointing at a broker's controller listener (port 9093). At apply time each entry is parsed (NOT DNS-resolved) and its `<host>:<port>` is carried verbatim into `BrokerConfig::controller_quorum_voters`. The inter-broker dialer re-resolves the host on every (re)connect (`TcpStream::connect`), so a peer that restarts on a new pod IP (a `StatefulSet` pod keeps its stable DNS name but gets a fresh A record) is reached again without restarting this broker — pre-resolving here would freeze the peer's boot-time IP and strand a rejoining voter. Empty leaves the single self-voter the binary seeds (standalone).
`controller_server_name`	string	no	`null`	TLS server name (SNI) presented when dialing a PEER's controller listener for the KIP-595 quorum. The operator renders the shared headless-Service FQDN here — a SAN on every broker's serving cert — so mTLS validation succeeds no matter which peer (resolved to a pod IP) is dialed. Absent falls back to `"localhost"`. Maps to [`crate::BrokerConfig::controller_server_name`].
`extra_log_dirs`	array	no	`[]`	Additional JBOD data directories (KIP-113). Maps to [`crate::BrokerConfig::extra_log_dirs`].
`heartbeat_interval`	string	no	`null`	How often this broker sends `BrokerHeartbeat` to the controller leader. Absent leaves the `BrokerConfig` default intact.
`heartbeat_timeout`	string	no	`null`	Controller-side session timeout for broker heartbeats. Absent leaves the `BrokerConfig` default intact.
`inter_broker_credentials`	object	no		Credentials this broker uses to authenticate to peer brokers (inter-broker initiate path). Only the `gssapi` variant is supported.
`inter_broker_listener_name`	string	no
`listeners`	array	no
`log_dir`	string	no
`max_connections`	integer	no	`null`	Maximum number of live broker connections across all listeners (Kafka `max.connections`). Connections accepted past this ceiling are closed immediately. Absent leaves the `BrokerConfig` default `usize::MAX` (unlimited), matching Kafka's `Integer.MAX_VALUE`.
`max_connections_per_ip`	integer	no	`null`	Maximum number of live connections from any single client IP (Kafka `max.connections.per.ip`). Absent leaves the `BrokerConfig` default `usize::MAX` (unlimited).
`rack`	string	no	`null`	KIP-392: this broker's rack id. Maps to `BrokerConfig::rack`.
`replica_lag_time_max`	string	no	`null`	Maximum follower lag before the leader proposes ISR shrink. Absent leaves the `BrokerConfig` default intact.
`replica_selector`	string	no	`null`	KIP-392: replica selector name (`"leader"` \| `"rack-aware"`). Maps to `BrokerConfig::replica_selector`.
`server_properties`	object	no	`{}`
`super_users`	array	no		Principals that are unconditionally authorized for all operations, including KIP-48 delegation-token `act-as`. The operator emits `super_users = ["ANONYMOUS"]` when `Kafka.spec.delegationToken` is set so its PLAINTEXT inter-broker reconcile loop can mint per-`KafkaUser` tokens. `None` and `Some(empty)` are equivalent — both leave `BrokerConfig.super_users` empty.

audit

FedRAMP 20x MLA audit subsystem configuration. Absent → secure default (enabled, standard internal topic name).

Field	Type	Required	Default	Description
`checkpoint`	object	no		Checkpoint emission cadence. `None` → use defaults.
`checkpoint.every_n`	integer	no	`1000`
`checkpoint.every_secs`	integer	no	`60`
`enabled`	boolean	no	`true`	Whether the audit subsystem is active.
`signing`	object	no		Ed25519 checkpoint signing key. `None` → chaining only, no checkpoints.
`signing.key_id`	string	yes
`signing.key_path`	string	yes
`spool`	object	no		Durable spool for the AU-5 degraded path. `None` → use defaults.
`spool.dir`	string	no	`audit-spool`
`spool.max_bytes`	integer	no	`1073741824`
`topic`	string	no	`__crabka_audit`	Internal topic name for audit records.

authorization

Pluggable cluster authorizer + super-user list. None ⇒ [crate::authorizer::AllowAllAuthorizer] with empty super-users (default-on-no-config behavior). When Some, the type field selects the authorizer implementation; for type = "opa", the [authorization.opa] subtable is required.

Field	Type	Required	Default	Description
`opa`	object	no		`Some` iff `authz_type == Opa`. Required in that case; `apply_to` returns [`FileConfigError::MissingSection`] when omitted.
`opa.allow_on_error`	boolean	no	`false`	Security-sensitive. Permit the operation when the OPA call fails (timeout, 5xx, parse error). When `true`, an OPA outage authorizes every request (fail-open). Default `false` (fail-closed) — omitting this field denies on error, matching the upstream Open Policy Agent Kafka plugin's `allow.on.error = false`.
`opa.expire_after_ms`	integer	no	`3600000`	Decision TTL, in milliseconds. Default `3_600_000` (1 h).
`opa.maximum_cache_size`	integer	no	`50000`	LRU cache capacity, in entries. Default `50_000`.
`opa.url`	string	yes		OPA decision endpoint URL — must include the data-API path, e.g. `http://opa:8181/v1/data/kafka/authz/allow`.
`super_users`	array	no	`[]`
`type`	string	no		Which [`crate::authorizer::Authorizer`] impl to instantiate. `snake_case` to match the spec's `type = "allow_all" \| "simple" \| "opa"` wire shape.

delegation_token

KIP-48: delegation-token master key + lifetime knobs. Env var CRABKA_DELEGATION_TOKEN_SECRET_KEY wins over secret_key here. When neither source provides a key, the broker disables delegation-token auth.

Field	Type	Required	Description
`default_renew_period_ms`	integer	no	Default renew period — the initial `expiry_timestamp_ms` offset at create time and the implicit renew period when `RenewDelegationToken.renew_period_ms == -1`. Distinct from `max_lifetime_ms` (the absolute ceiling). Default 24 hours.
`expiry_check_interval_ms`	integer	no	Background sweep cadence, ms. Default 1 hour.
`max_lifetime_ms`	integer	no	Hard upper bound on token lifetime, ms. Default 7 days.
`secret_key`	string	no	HMAC master key. Overridden by `CRABKA_DELEGATION_TOKEN_SECRET_KEY` when set. Bytes are wrapped in [`crabka_security::SecretBytes`] before reaching `BrokerConfig`.

gssapi

SASL/GSSAPI (Kerberos) accept-path config. Broker-global — there is one [gssapi] block per broker. Relevant when a listener enables the GSSAPI mechanism.

Field	Type	Required	Default	Description
`kdc`	string	no	`null`	KDC endpoint (e.g. `tcp://kdc:88`) that bypasses krb5.conf discovery; falls back to krb5.conf when omitted.
`keytab_path`	string	yes
`max_time_skew`	string	no	`null`	Maximum tolerated difference between client and broker clocks.
`principal_to_local_rules`	array	no	`[]`	`auth_to_local` rule specs, applied in order (first match wins).
`realm`	string	no	`null`	Default Kerberos realm, used for principals that omit their realm.
`service_name`	string	no	`null`	`sasl.kerberos.service.name`. Defaults to `"kafka"` when omitted.

oauthbearer

SASL/OAUTHBEARER validator tuning. Only relevant when a listener enables the OAUTHBEARER mechanism.

Field	Type	Required	Default	Description
`allowable_clock_skew_ms`	integer	no	`null`	Clock-skew tolerance, in milliseconds, for `exp` / `iat` / `nbf`. Default 30000.
`custom_claim_check`	string	no	`null`	Optional `JsonPath` expression (RFC 9535, via jsonpath-rust) evaluated against the token claim set. Token is rejected when the expression yields empty/null/false. Compiled once at broker startup; malformed expressions panic with a descriptive error.
`expected_audience`	string	no	`null`	When set, the token `aud` claim must contain this. Signed validator only.
`fallback_user_name_claim`	string	no	`null`	Alternate claim name for principal-name fallback.
`fallback_user_name_prefix`	string	no	`null`	Prepended on fallback only.
`groups_claim`	string	no	`null`	`JsonPath` expression (RFC 9535) extracting groups. Compiled once at broker startup; malformed expression panics with descriptive error.
`groups_claim_delimiter`	string	no	`null`	When `groups_claim` resolves to a string, split on this delimiter.
`idp_tls_trust`	string	no	`null`	PEM file containing the CA certificate(s) used to verify the `IdP`'s TLS certificate on ALL outbound HTTPS to the `IdP` — JWKS endpoint, introspection endpoint, and userinfo endpoint. When set, these are the only trust roots used for the outbound HTTPS (replaces the default webpki-roots — Strimzi-shaped). When unset, the broker uses reqwest's default rustls webpki-roots.
`introspection_client_id`	string	no	`null`	`client_id` the broker uses to authenticate (HTTP Basic Auth) against the introspection endpoint. Required when `introspection_endpoint_uri` is set.
`introspection_client_secret_path`	string	no	`null`	Filesystem path to a file containing the client secret the broker uses to authenticate against the introspection endpoint. Required when `introspection_endpoint_uri` is set. File-based (not literal) so secret material doesn't sit in the TOML; operator mounts a `Secret` and writes the mount path here. The file's trailing newline (if any) is stripped at config-load.
`introspection_endpoint_uri`	string	no	`null`	RFC 7662 introspection endpoint URL. When set, selects the introspection validator (mutually exclusive with `jwks_endpoint_uri`).
`introspection_http_timeout_ms`	integer	no	`null`	Timeout for the introspection (and userinfo) HTTP requests, in milliseconds. Default 10 000 (10 s).
`jwks_endpoint_uri`	string	no	`null`	JWKS endpoint URL. When set, tokens are validated as signed JWTs (RS256 / ES256) against the keys fetched from this URL, and the broker spawns a background refresher. When unset, the unsecured-JWS (`alg:none`) development validator is used.
`jwks_expiry_seconds`	integer	no	`null`	Maximum age (seconds) of the cached JWKS before validators reject tokens until the next successful refresh. Strimzi default 360 (6 minutes). Unset = no expiry check. Fails closed on prolonged `IdP` outage. Signed validator only.
`jwks_ignore_key_use`	boolean	no	`null`	When true, the JWKS parser keeps keys regardless of `use` field. Default false (filter out `use=enc`). Some identity providers publish signing keys with `use="enc"` by mistake; operators set this to true to accept them. Signed validator only.
`jwks_min_refresh_pause_seconds`	integer	no	`null`	Minimum pause (seconds) between on-demand JWKS refreshes triggered by validator signals (unknown-kid / bad-signature tokens). Defaults to 1 (Strimzi parity). Signed validator only.
`jwks_refresh_interval_ms`	integer	no	`null`	JWKS re-fetch interval, in milliseconds. Default 300000 (5 minutes). Signed validator only.
`max_session_lifetime_seconds`	integer	no	`null`	Optional ceiling on OAUTHBEARER session lifetime, in seconds. When set, the broker clamps `session_lifetime_ms` to `min(token_exp_ms - now_ms, cap * 1000)`. When unset, sessions last until the token's natural `exp`.
`principal_claim_name`	string	no	`null`	Claim whose value becomes the principal name. Default `sub`.
`userinfo_endpoint_uri`	string	no	`null`	Optional OIDC userinfo endpoint URL. When set, the introspection validator calls `GET userinfo` after a successful introspection and merges the profile claims over the introspection claims (introspection wins for `active`, `exp`, `iat`, `nbf`, `scope`, `client_id`, `sub`).
`valid_issuer_uri`	string	no	`null`	When set, the token `iss` claim must equal this. Signed validator only.
`valid_token_type`	string	no	`null`	Optional JWT `typ` header check. When set, JWT-mode validators (unsecured + signed JWS) require the JWT header's `typ` field to equal this string. Introspection-mode skips (no JWT header). Ignored when unset.

process

[process] section — KRaft process.roles. Absent / empty leaves the BrokerConfig default [Controller, Broker].

Field	Type	Required	Default	Description
`roles`	array	no	`[]`	Role strings: `"controller"`, `"broker"` (case-insensitive). Empty or absent leaves the `BrokerConfig` default `[Controller, Broker]`.

remote_storage

KIP-405: tiered-storage enablement. Setting storage_dir turns tiered storage on broker-wide and roots the local reference RemoteStorageManager there.

Field	Type	Required	Default	Description
`gcs`	object	no		Native Google Cloud Storage backend parameters. Omit to use `storage_dir` or `[remote_storage.s3]`.
`gcs.allow_http`	boolean	no	`false`	Allow plaintext HTTP (off-by-default; required by emulators running without TLS).
`gcs.application_credentials_path`	string	no	`null`	Path to an Application Default Credentials JSON file. Omit (along with the other credential fields) to use Workload Identity / ADC.
`gcs.bucket`	string	yes		GCS bucket name.
`gcs.endpoint`	string	no	`null`	Optional custom GCS API base URL (for emulators / fakes).
`gcs.multipart_chunk_size`	integer	no	`null`	Optional override of the per-part multipart chunk size (bytes). When `None`, [`crabka_remote_storage::DEFAULT_MULTIPART_CHUNK_SIZE`] applies.
`gcs.multipart_threshold`	integer	no	`null`	Optional override of the multipart-upload threshold (bytes). When `None`, [`crabka_remote_storage::DEFAULT_MULTIPART_THRESHOLD`] applies. Operators typically leave this alone; lower it to force multipart on smaller segments for testing.
`gcs.prefix`	string	no	`null`	Optional key prefix inside the bucket (lets multiple clusters share a bucket).
`gcs.service_account_key`	string	no	`null`	Inline service-account JSON key. Omit (along with the other credential fields) to use Workload Identity / ADC.
`gcs.service_account_path`	string	no	`null`	Path to a service-account JSON key file. Omit (along with the other credential fields) to use Workload Identity / ADC.
`kafka_metadata`	object	no		Opt-in to the topic-backed `RemoteLogMetadataManager`. When absent, the broker uses the in-memory fixture.
`kafka_metadata.bootstrap`	string	no	``	`host:port` the manager dials to reach its own broker. May be empty; the broker derives the address from the inter-broker listener at startup.
`kafka_metadata.event_queue_capacity`	integer	no	`null`	Capacity of the shared metadata-event delivery queue.
`kafka_metadata.fetch_max_bytes`	string	no	`null`	Maximum bytes returned by each per-partition metadata fetch.
`kafka_metadata.fetch_max_wait`	string	no	`null`	Maximum wait for each per-partition metadata fetch.
`kafka_metadata.fetch_retry_backoff`	string	no	`null`	Backoff after a failed metadata fetch.
`kafka_metadata.in_memory`	boolean	no	`false`	Explicit opt-out: run the non-durable in-memory RLMM instead of the topic-backed default. Tests / single-node dev only.
`kafka_metadata.num_partitions`	integer	no	`null`	Partition count for `__remote_log_metadata` on first creation. Defaults to 50 (Kafka's `remote.log.metadata.topic.num.partitions`).
`kafka_metadata.replication`	integer	no	`null`	Replication factor for `__remote_log_metadata` on first creation. Defaults to 3 (Kafka's `remote.log.metadata.topic.replication.factor`).
`kafka_metadata.snapshot_interval`	string	no	`null`	RLMM cache snapshot cadence.
`kafka_metadata.topic_create_timeout`	string	no	`null`	Timeout for provisioning each internal metadata topic.
`s3`	object	no		S3-compatible backend parameters. Omit to use `storage_dir`.
`s3.access_key_id`	string	no	`null`	Explicit access key id. Falls back to the AWS credential chain (env vars, instance profile, …) when omitted.
`s3.allow_http`	boolean	no	`false`	Allow plaintext HTTP (off-by-default; required by `MinIO` running without TLS).
`s3.bucket`	string	yes		S3 bucket name.
`s3.endpoint`	string	no	`null`	Optional custom endpoint URL (e.g. `MinIO` or Cloudflare R2).
`s3.multipart_chunk_size`	integer	no	`null`	Optional override of the per-part multipart chunk size (bytes). When `None`, [`crabka_remote_storage::DEFAULT_MULTIPART_CHUNK_SIZE`] applies. AWS requires parts ≥ 5 MiB except the last; `MinIO` tolerates smaller values.
`s3.multipart_threshold`	integer	no	`null`	Optional override of the multipart-upload threshold (bytes). When `None`, [`crabka_remote_storage::DEFAULT_MULTIPART_THRESHOLD`] applies. Operators typically leave this alone; lower it to force multipart on smaller segments for testing.
`s3.prefix`	string	no	`null`	Optional key prefix inside the bucket (lets multiple clusters share a bucket).
`s3.region`	string	yes		AWS region. Required even for non-AWS endpoints (use any value).
`s3.secret_access_key`	string	no	`null`	Explicit secret access key. Falls back to the AWS credential chain when omitted.
`storage_dir`	string	no		Root directory for the local `LocalTieredStorage` backend.

runtime

Operational runtime policy. Present values replace the current broker value; absent values retain it.

Field	Type	Required	Default
`acl_max_principal`	string	no	`null`
`acl_max_resource_name`	string	no	`null`
`audit_event_queue_capacity`	integer	no
`audit_partition_wait_timeout`	string	no	`null`
`audit_spool_replay_interval`	string	no	`null`
`audit_stats_poll_interval`	string	no	`null`
`audit_tail_read_max`	string	no	`null`
`audit_tail_window_offsets`	integer	no
`auto_join_retry_backoff`	string	no	`null`
`auto_join_voter_request_timeout`	string	no	`null`
`classic_group_initial_rebalance_delay`	string	no	`null`
`cleaner_interval`	string	no	`null`
`client_metrics_default_interval`	string	no	`null`
`client_metrics_eviction_tick`	string	no	`null`
`client_metrics_otlp_queue_capacity`	integer	no
`client_metrics_prom_snapshot_ttl`	string	no	`null`
`client_metrics_stale_floor`	string	no	`null`
`client_metrics_stale_push_intervals`	integer	no
`client_metrics_telemetry_max`	string	no	`null`
`connection_creation_throttle_max`	string	no	`null`
`consumer_group_heartbeat_interval`	string	no	`null`
`consumer_group_max_heartbeat_interval`	string	no	`null`
`consumer_group_max_session_timeout`	string	no	`null`
`consumer_group_max_size`	integer	no
`consumer_group_min_heartbeat_interval`	string	no	`null`
`consumer_group_min_session_timeout`	string	no	`null`
`consumer_group_session_timeout`	string	no	`null`
`controlled_shutdown_drain_timeout`	string	no	`null`
`controller_election_timeout`	string	no	`null`
`controller_fetch_miss_limit`	integer	no
`controller_heartbeat_interval`	string	no	`null`
`coordinator_actor_mailbox_capacity`	integer	no
`coordinator_session_expiry_tick`	string	no	`null`
`coordinator_shutdown_ack_timeout`	string	no	`null`
`default_min_insync_replicas`	integer	no
`delegation_token_default_renew_period`	string	no	`null`
`delegation_token_expiry_check_interval`	string	no	`null`
`delegation_token_max_lifetime`	string	no	`null`
`diskless_wal_local_replica_count`	integer	no
`future_log_move_read_chunk`	string	no	`null`
`future_log_move_retry_backoff`	string	no	`null`
`gauge_poll_interval`	string	no	`null`
`heartbeat_interval`	string	no	`null`
`heartbeat_timeout`	string	no	`null`
`inter_broker_server_name`	string	no
`isr_scan_interval`	string	no	`null`
`leader_imbalance_check_interval`	string	no	`null`
`leader_imbalance_per_broker`	string	no	`null`
`liveness_tick_interval`	string	no	`null`
`log_read_buffer_cap`	string	no	`null`
`log_timestamp_scan_window`	string	no	`null`
`max_connections`	integer	no
`max_connections_per_ip`	integer	no
`max_incremental_fetch_session_cache_slots`	integer	no
`max_produce_group`	integer	no
`metadata_max_between_snapshots`	string	no	`null`
`metadata_max_snapshot_interval`	string	no	`null`
`metadata_raft_command_queue_capacity`	integer	no
`metadata_raft_fetch_max`	string	no	`null`
`metadata_snapshot_fetch_max`	string	no	`null`
`metadata_snapshot_interval_records`	integer	no
`oauth_jwks_http_timeout`	string	no	`null`
`observer_fetch_max`	string	no	`null`
`observer_lag_bound`	integer	no
`observer_poll_interval`	string	no	`null`
`offsets_topic_metadata_wait_timeout`	string	no	`null`
`opa_http_timeout`	string	no	`null`
`operator_recovery_deadline`	string	no	`null`
`partition_disk_scan_interval`	string	no	`null`
`partition_writer_queue_depth`	integer	no
`producer_id_expiration`	string	no	`null`
`producer_id_expiration_scan_interval`	string	no	`null`
`quota_throttle_max`	string	no	`null`
`record_decompression_max_ratio`	string	no	`null`
`record_decompression_output_ceiling`	string	no	`null`
`record_decompression_output_floor`	string	no	`null`
`remote_log_manager_interval`	string	no	`null`
`replica_lag_time_max`	string	no	`null`
`replication_epoch_fence_backoff`	string	no	`null`
`replication_fetch_max`	string	no	`null`
`replication_fetch_max_wait`	string	no	`null`
`replication_fetch_min`	string	no	`null`
`replication_reconnect_delay_cap`	string	no	`null`
`replication_reconnect_initial_delay`	string	no	`null`
`replication_send_error_backoff`	string	no	`null`
`replication_throttle_exhausted_backoff`	string	no	`null`
`replication_unexpected_error_backoff`	string	no	`null`
`replication_unknown_topic_retry_delay`	string	no	`null`
`rlmm_bootstrap_backoff_initial`	string	no	`null`
`rlmm_bootstrap_backoff_max`	string	no	`null`
`rlmm_reconcile_tick`	string	no	`null`
`self_registration_backoff_max`	string	no	`null`
`self_registration_backoff_min`	string	no	`null`
`self_registration_max_attempts`	integer	no
`sendfile_min`	string	no	`null`
`share_group_enable`	boolean	no
`share_group_heartbeat_interval`	string	no	`null`
`share_group_isolation_level`	string	no
`share_group_max_delivery_attempts`	integer	no
`share_group_max_inflight_records`	integer	no
`share_group_record_lock_duration`	string	no	`null`
`share_group_session_timeout`	string	no	`null`
`share_recovery_read_max`	string	no	`null`
`share_session_cache_max_when_unlimited`	integer	no
`share_state_num_partitions`	integer	no
`share_state_replication_factor`	integer	no
`socket_receive_buffer`	string	no	`null`
`socket_request_max`	string	no	`null`
`socket_send_buffer`	string	no	`null`
`startup_leader_wait_timeout`	string	no	`null`
`streams_group_acceptable_recovery_lag`	integer	no
`streams_group_assignor`	string	no
`streams_group_heartbeat_interval`	string	no	`null`
`streams_group_num_standby_replicas`	integer	no
`streams_group_num_warmup_replicas`	integer	no
`streams_group_session_timeout`	string	no	`null`
`streams_group_task_offset_interval`	string	no	`null`
`streams_internal_topic_replication_factor`	integer	no
`sync_group_follower_wait`	string	no	`null`
`telemetry_decompressed_output_ceiling`	string	no	`null`
`telemetry_decompressed_output_floor`	string	no	`null`
`telemetry_max_decompression_ratio`	string	no	`null`
`tls_reload_interval`	string	no	`null`
`transaction_max_timeout`	string	no	`null`
`transaction_min_timeout`	string	no	`null`
`transaction_recovery_read_max`	string	no	`null`
`transaction_state_num_partitions`	integer	no
`transaction_state_replication_factor`	integer	no
`txn_abort_cleanup_interval`	string	no	`null`
`unclean_recovery_aggressive_deadline`	string	no	`null`
`unclean_recovery_balanced_deadline`	string	no	`null`
`unclean_recovery_queue_capacity`	integer	no

tls_config

TLS material for the controller listener (and any listener whose protocol is TLS-bearing).

Field	Type	Required	Default	Description
`cert_path`	string	yes
`client_auth`	string	no
`client_ca_path`	string	no	`null`
`key_path`	string	yes
`trust_roots_path`	string	no	`null`	PEM file of CA(s) this broker trusts when validating a PEER's server cert as an outbound inter-broker / controller-quorum dialer. The operator renders the cluster CA here so KIP-595 controller peers can mutually authenticate over the controller listener. Maps to [`crabka_security::TlsConfig::trust_roots_path`].