Struct FlowServiceTlsOptions 

pub struct FlowServiceTlsOptions { /* private fields */ }

Enables verified TLS for a Client or Worker’s outbound FlowService connection.

Pass independently to crate::ClientOptions::flow_service_tls and crate::WorkerOptions::flow_service_tls. Omitting these settings keeps plaintext gRPC. An empty options value enables TLS 1.2 or newer with native system roots. Additional roots extend that trust store. The endpoint must negotiate HTTP/2 through ALPN h2. The address must be host:port, dns:///host:port, or dns://authority/host:port. DNS authority syntax is accepted, but resolution uses the operating system resolver. Credentials remain bearer call metadata. These settings do not change an API-key token endpoint.

crate::Client::try_new and crate::Worker::try_new return SdkError::InvalidArgument for an invalid address, nonempty bundle without a valid root, or invalid server name. Native-root loading errors are logged; successfully loaded roots remain usable. An empty trust store constructs successfully but cannot verify a server. Connections open lazily: certificate, hostname, and handshake failures appear on the first Client call or crate::Worker::start as service errors.

use std::sync::Arc;
use dex_sdk::{BlobCache, BlobCacheConfig, Client, ClientOptions, FileCredential,
    FlowServiceTlsOptions, Registry, Worker, WorkerOptions};
let cache = Arc::new(BlobCache::open(BlobCacheConfig::new(
    "/tmp/dex-tls-blobs", 64 * 1024 * 1024, 0,
)?)?);
let tls = FlowServiceTlsOptions::new()
    .additional_root_cas_pem(std::fs::read("/etc/dex/root-ca.pem")?);
let credential = Arc::new(FileCredential::new("/var/run/secrets/dex/token")?);
let registry = Registry::new();
let worker = Worker::try_new(registry.clone(), cache.clone(), WorkerOptions::new()
    .server_address("dex.example.com:443").flow_service_tls(tls.clone())
    .credential(credential.clone()))?;
let client = Client::try_new(registry, cache, ClientOptions::new()
    .server_address("dex.example.com:443").flow_service_tls(tls)
    .credential(credential))?;
client.health_check()?;
worker.start()?;

Implementations

impl FlowServiceTlsOptions

pub fn new() -> Self

Creates verified TLS options using native system roots and the address host.

Equivalent to Self::default. No additional roots or server name override are set. Pass these options to a Client or Worker as shown in the enclosing type’s example.

pub fn additional_root_cas_pem(self, value: impl Into<Vec<u8>>) -> Self

Adds PEM-encoded CA certificates to the native system trust store.

Defaults to no additional certificates. Empty bytes have the same effect. Takes ownership of value and returns these options with that bundle. Construction reads the bytes once; file changes are not watched. A nonempty bundle must contain at least one parsable certificate, or construction returns SdkError::InvalidArgument. Other blocks and malformed certificates are skipped when another certificate parses. Additional roots remain usable when the native store is empty or fails to load. See the enclosing type’s example.

pub fn server_name(self, value: impl Into<String>) -> Self

Overrides the address host for certificate verification, SNI, and HTTP/2 authority.

Defaults to verifying the address host and retaining its host and port as authority. Takes ownership of value and returns these options with that override. Use a DNS name or unbracketed IP address without a port. Empty or invalid names cause construction to return SdkError::InvalidArgument. An IP address sends no SNI and requires a matching IP SAN. An override becomes the authority without a port; a gateway must accept that name. An IPv6 override is bracketed in :authority (for example, [::1]), while certificate verification uses the bare address. See the enclosing type’s example, adding .server_name("dex.example.com") to the TLS options when a gateway requires that name.

Trait Implementations

impl Clone for FlowServiceTlsOptions

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FlowServiceTlsOptions

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for FlowServiceTlsOptions

fn default() -> Self

Returns the “default value” for a type.