Add S3 OCSP status publishing and standalone Rust Axum responder

server/.env.example

@@ -51,6 +51,18 @@ OTEL_EXCLUDED_PATHS=/api/health
 #OTEL_METRIC_EXPORT_INTERVAL_MILLIS=60000
 #OTEL_METRICS_POLL_INTERVAL_SECONDS=15
 
+# --- OCSP status publisher (optional) --------------------------------------
+# When a bucket is configured, KCA publishes one full JSON status snapshot
+# per CA. The standalone OCSP responder reads these objects. Uses the normal
+# AWS credential chain (AWS_ACCESS_KEY_ID /
+# AWS_SECRET_ACCESS_KEY, role, instance profile, ...).
+#KCA_OCSP_S3_BUCKET=kca-ocsp
+KCA_OCSP_S3_PREFIX=ocsp
+#KCA_OCSP_S3_REGION=eu-central-1
+#KCA_OCSP_S3_ENDPOINT=http://localhost:9000
+KCA_OCSP_S3_FORCE_PATH_STYLE=false
+KCA_OCSP_PUBLISH_INTERVAL_SECONDS=1
+
 # --- CORS (optional) -------------------------------------------------------
 #CORS_ALLOW_ORIGINS=
 #CORS_ALLOW_ORIGIN_REGEX=