Struct TlsProfileMap 

pub struct TlsProfileMap { /* private fields */ }

Bundle of precompiled rustls configs for the peer plane, keyed by datacenter name plus an optional default profile used as a fallback for any DC without an explicit entry.

The map is built once at startup by TlsProfileMap::build and shared (cheaply, every member is an Arc under the hood) across the dnode listener and every per-peer outbound supervisor. Lookups are O(log n) in the number of DCs.

Examples

use std::collections::BTreeMap;
use std::path::PathBuf;
use dynomite::net::tls::{TlsProfileMap, TlsProfileSpec};

let mut per_dc = BTreeMap::new();
per_dc.insert(
    "dc1".to_string(),
    TlsProfileSpec {
        cert: PathBuf::from("/etc/dynomite/dc1.pem"),
        key: PathBuf::from("/etc/dynomite/dc1.key"),
        ca: None,
    },
);
let map = TlsProfileMap::build(None, per_dc).unwrap();
assert!(map.client_config_for_dc("dc1").is_some());
assert!(map.client_config_for_dc("dc-without-profile").is_none());

Implementations

impl TlsProfileMap

pub fn build( default: Option<TlsProfileSpec>, per_dc: BTreeMap<String, TlsProfileSpec>, ) -> Result<Self, TlsError>

Build a map from a default profile (the legacy peer_tls_* triple) plus a dc -> TlsProfileSpec map.

Either argument may be empty: a None default plus an empty per_dc produces an empty map (peer plane runs plaintext).

Errors

Returns the first TlsError from a failing PEM load.

pub fn is_empty(&self) -> bool

True when no profile (default or per-DC) is configured. In this state the peer plane runs plaintext.

pub fn server_config_for_dc(&self, dc: &str) -> Option<Arc<ServerConfig>>

Server config to use for a connection negotiated with a peer in dc. Returns the per-DC entry if present, otherwise the default profile, otherwise None.

pub fn client_config_for_dc(&self, dc: &str) -> Option<Arc<ClientConfig>>

Client config to use when dialing a peer in dc. Returns the per-DC entry if present, otherwise the default profile, otherwise None.

pub fn default_server_config(&self) -> Option<Arc<ServerConfig>>

Default server config (the legacy / fallback profile).

pub fn default_client_config(&self) -> Option<Arc<ClientConfig>>

Default client config (the legacy / fallback profile).

pub fn requires_client_auth(&self) -> bool

True when at least one configured profile carries a CA bundle. When set, the SNI listener requires every inbound peer to present a certificate signed by one of the configured CAs (mTLS).

pub fn dc_names(&self) -> Vec<String>

Names of the DCs with explicit per-DC entries (sorted).

pub fn build_sni_acceptor(&self) -> Result<Option<TlsAcceptor>, TlsError>

Build a single tokio_rustls::TlsAcceptor whose ServerConfig picks the certificate by SNI hostname (dc-<dc-name>.dynomite.local) and falls back to the default profile when SNI is missing or does not match.

Returns None when Self::is_empty is true.

Errors

Returns TlsError::Rustls when rustls rejects the assembled root store / verifier (e.g. a malformed CA certificate that slipped through the loader).

Trait Implementations

impl Clone for TlsProfileMap

fn clone(&self) -> TlsProfileMap

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsProfileMap

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TlsProfileMap

fn default() -> TlsProfileMap

Returns the “default value” for a type.