Struct TlsCfg 

pub struct TlsCfg {
    pub enabled: bool,
    pub cert_path: String,
    pub key_path: String,
    pub self_signed: bool,
    pub self_signed_hosts: Vec<String>,
    pub self_signed_days: u32,
    pub redirect_port: u16,
    pub redirect_status: u16,
    pub redirect_hosts: Vec<String>,
    pub acme: AcmeCfg,
}

TLS termination. When enabled, EdgeGuard serves HTTPS on the public port using a certificate either loaded from cert_path/key_path or obtained automatically via ACME. self_signed_days and redirect_status need non-zero defaults (a zero-day certificate and a 0 status are both nonsense), so Default is written out rather than derived.

Fields

enabled: bool

Terminate TLS in EdgeGuard itself. Leave off when something upstream already does (a load balancer, a platform edge) and EdgeGuard only sees plaintext behind it.

cert_path: String

PEM certificate chain (leaf first). When ACME is enabled this is where the obtained certificate is written/read.

key_path: String

PEM private key (PKCS#8/PKCS#1/SEC1).

self_signed: bool

Generate a self-signed certificate at cert_path/key_path when none is there yet, instead of requiring one to exist before TLS can be enabled at all. It encrypts the connection — which is what makes HSTS, Secure cookies and the hardening headers mean anything — but proves no identity, so browsers warn and strict clients refuse. Right for localhost, a private network, or a staging box; for the public internet use [tls.acme]. Ignored once a certificate exists, so a restart keeps serving the same one.

self_signed_hosts: Vec<String>

Hostnames/IPs to put in the generated certificate’s subject-alternative names. Empty means localhost, 127.0.0.1 and ::1 — a client is only satisfied by a name it finds in here, so add the address you actually browse to.

self_signed_days: u32

How long the generated certificate is valid, in days. The default is deliberately short: a self-signed certificate is meant to be a stopgap, and an expiry that arrives is a better reminder to move to [tls.acme] than a decade-long one nobody revisits.

redirect_port: u16

Plain-HTTP port to run an HTTP→HTTPS redirect listener on; 0 (default) disables it. Terminating TLS only protects traffic that reaches the TLS port, and a browser given a bare hostname tries :80 first — so without this, the first request of every visit is still plaintext. Set to 80 alongside a [server] port = 443. Overridden by REDIRECT_PORT.

redirect_status: u16

Status the redirect listener answers with. 308 (default) preserves the method and body, so a POST arriving on the plaintext port is replayed over TLS rather than silently downgraded to a GET; 301 is the older browser-facing convention. Must be 3xx.

redirect_hosts: Vec<String>

Hostnames the redirect listener will reflect into Location. Empty (default) accepts any syntactically valid host. Host is attacker-controlled, so pinning it to the names you actually serve is what stops a request with a forged Host from turning this listener into an open redirect that carries your domain’s reputation to someone else’s site.

acme: AcmeCfg

Automatic certificate issuance. See [tls.acme].

Implementations

impl TlsCfg

pub fn self_signed_host_list(&self) -> Vec<String>

SAN list for a generated certificate: the configured hosts, or the loopback defaults.

Trait Implementations

impl Clone for TlsCfg

fn clone(&self) -> TlsCfg

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TlsCfg

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TlsCfg

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for TlsCfg

where TlsCfg: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.