Skip to main content

plecto_control/manifest/
tls.rs

1//! One TLS server certificate (`[[tls]]`, ADR 000014).
2
3use serde::{Deserialize, Serialize};
4
5/// One TLS server certificate (ADR 000014). The fast path terminates TLS with rustls and selects
6/// a cert by SNI: `host` names the SNI this cert serves (case-insensitive); `None` is the default
7/// cert presented when no SNI matches. `cert_path` / `key_path` are manifest-relative PEM files
8/// (a cert chain and its private key). Only the **paths** ride the manifest content hash, so a
9/// path change reloads but an in-place file edit does not (ADR 000014).
10#[derive(Debug, Clone, Deserialize, schemars::JsonSchema, Serialize)]
11#[serde(deny_unknown_fields)]
12pub struct TlsCert {
13    /// SNI host this cert serves (case-insensitive). `None` = the default cert.
14    #[serde(default)]
15    pub host: Option<String>,
16    /// Manifest-relative path to the PEM cert chain.
17    pub cert_path: String,
18    /// Manifest-relative path to the PEM private key.
19    pub key_path: String,
20}