OPENPGP KEY SERVER — RUST

Volta

OVERVIEW

Volta is an OpenPGP key server derived from Hagrid, the software behind keys.openpgp.org, serving the HKP protocol, the verifying-keyserver (VKS) API, and Web Key Directory with email-verified publication. The README explicitly corrects earlier descriptions that called it a reverse proxy: "It is not one and never has been."

HOW IT WORKS

1The `volta` binary (Rocket 0.5 server) starts and extracts its figment configuration from `Rocket.toml` or `ROCKET_*` environment variables.
2Anyone may upload a key through HKP (`/pks/add`), the VKS API (`/vks/v1/upload`), or the web UI (`/upload`).
3The `volta-database` crate parses the key with Sequoia-OpenPGP, cleans it (stripping unverified and revoked material per policy), and stores it on the filesystem keyed by fingerprint, key ID, and email.
4An email address is not published as searchable until its owner confirms it by clicking a verification token link mailed to that address; owners can manage or delete addresses through tokenized `/manage` links.
5Lookups are served over three surfaces: HKP (`/pks/lookup`), the VKS API (`/vks/v1/by-fingerprint/<fpr>`, `/vks/v1/by-email/<email>`, `/vks/v1/by-keyid/<kid>`), and Web Key Directory (`/.well-known/openpgpkey/<domain>/hu/<hash>` and `/policy`).
6Operators use `voltactl` to bulk-import keyrings into the database and regenerate the derived directory layout; a separate `volta-delete` binary removes a single key.

How it works, step by step — each step as the project's own documentation states it.

CONCEPTS

Volta's two flows: publication is gated on email verification — a submitted key is parsed, cleaned, and stored, but an address becomes searchable only when its owner clicks the mailed token link — and lookups arrive over HKP, the VKS API, and Web Key Directory. Routes are Volta's own, from its book.

CONFIGURATION

Option	Default	What it does
`address` (`[global]`)	0.0.0.0` in `Rocket.toml.dist	Rocket listen address
`port` (`[global]`)	8080` in `Rocket.toml.dist	Rocket listen port
ROCKET_ADDRESS` / `ROCKET_PORT	example: `127.0.0.1` / `8080`	Environment override used in the Quickstart run command
`base-URI`	`http://localhost:8080` in the `[debug]` profile	Public base URI of the server
`base-URI-Onion`	not stated in source	Onion base URI (named in the operations key list; present in the `[release]` profile)
`from`	`noreply@localhost` in the `[debug]` profile	Sender address for verification/management mail
`token_validity`	3600` in `Rocket.toml.dist	Validity period for mailed tokens (seconds, as written in the file)
`token_secret`	operator-supplied (value not reproduced)	Secret used for sealed tokens
`template_dir`	`dist/templates` in the `[debug]` profile	Web template directory
`email_template_dir`	`dist/email-templates` in the `[debug]` profile	Email template directory
`assets_dir`	`dist/assets` in the `[debug]` profile	Static assets directory
`keys_internal_dir`	`state/keys-internal` in the `[debug]` profile	Internal key storage directory
`keys_external_dir`	`state/keys-external` in the `[debug]` profile	External (published) key storage directory
`token_dir`	`state/tokens` in the `[debug]` profile	Token directory
`tmp_dir`	`state/tmp` in the `[debug]` profile	Temporary directory
`maintenance_file`	`state/maintenance` in the `[debug]` profile	Maintenance-mode flag file
`mail_rate_limit`	60` in `[debug]`/`[staging]`; `3600` in `[release]	Mail rate limit per profile in the dist file
`enable_prometheus`	false` in `Rocket.toml.dist	Enable the Prometheus `/metrics` endpoint
`x-accel-redirect`	false` in `[debug]`; `true` in `[staging]`/`[release]	Delegate file serving via X-Accel-Redirect
`filemail_into`	not stated in source	File-spool mail delivery for development (named in the operations key list)
`root`	not stated in source	Server root (named in the operations key list)

CONTROLS

Action	Control
Build	`cargo build --release`
Build / develop with Nix	nix build` / `nix develop
Run the server	`ROCKET_ADDRESS=127.0.0.1 ROCKET_PORT=8080 ./target/release/volta`
Build the documentation book	`mdbook build`
Bulk-import keys	`voltactl import [--dry-run/-n] <keyring files...>`
Regenerate the derived directory layout	`voltactl regenerate`
Select `voltactl` config file	`voltactl -c/--config <FILE>` (default file named in source: `Rocket.toml`)
Select `voltactl` environment	`voltactl -e/--env <dev\
Remove a single key	`volta-delete` binary (second binary of the root package)
Upload / search / verify / manage keys (web UI)	/upload`, `/search`, `/verify/<token>`, `/manage`, `/manage/<token>`, `/manage/unpublish

NOT COVERED

- `Rocket.toml.dist` is a starting-point template with debug/staging/release profiles inherited from upstream Hagrid (its staging/release `base-URI` values still name keys.openpgp.org); production Volta values are not stated in the repo files read. - The `rewrite/` tree in the repo contains a separate in-progress rewrite (its own crates and book); this pack describes the main tree (`src/`, `database/`, `voltactl/`) that the README and `docs/src/` describe. - Individual VKS/HKP request parameters (e.g. HKP `op`/`search`) were not enumerated beyond the route paths in `docs/src/introduction.md`.

REFERENCES

RFC 9580 — OpenPGPThe current OpenPGP specification: the key format Volta parses with Sequoia-OpenPGP, cleans, stores, and serves.
OpenPGP Web Key Directory (IETF draft, draft-koch-openpgp-webkey-service)The draft specifying the /.well-known/openpgpkey lookup path (hu/<hash>, and /policy) that Volta serves as its Web Key Directory surface.
Hagrid — verifying OpenPGP keyserverThe upstream keyserver Volta is derived from — the software behind keys.openpgp.org; its email-verified publication model is the flow in the diagram.