rust_web_server/config_check/
mod.rs

1//! `rws --check`: validate `rws.config.toml` without starting the server —
2//! the counterpart of `nginx -t` / `caddy validate`.
3//!
4//! Reports unknown keys (in settings and in proxy sections), values of the
5//! wrong type, TLS files that can't be loaded, proxy routes pointing at
6//! undeclared upstreams, auth secrets that aren't set, and similar mistakes
7//! that would otherwise surface as a warning in the startup log or as a 503
8//! at request time. Nothing is bound and the environment is not modified.
9//!
10//! ```bash
11//! rws --check                      # the file rws would load (RWS_CONFIG_FILE or ./rws.config.toml)
12//! rws --check=/etc/rws/site.toml   # a specific file
13//! ```
14
15#[cfg(test)]
16mod tests;
17
18use std::io::Cursor;
19use std::path::Path;
20
21use crate::entry_point::config_file::collect_settings;
22use crate::entry_point::Config;
23
24/// Errors and warnings found in a configuration file.
25#[derive(Debug, Default, Clone, PartialEq)]
26pub struct ConfigReport {
27    /// Mistakes: the configuration does not do what it says.
28    pub errors: Vec<String>,
29    /// Likely mistakes that don't stop the server working.
30    pub warnings: Vec<String>,
31}
32
33impl ConfigReport {
34    pub fn error(&mut self, message: impl Into<String>) {
35        self.errors.push(message.into());
36    }
37
38    pub fn warn(&mut self, message: impl Into<String>) {
39        self.warnings.push(message.into());
40    }
41
42    /// `true` when there are no errors (warnings are allowed).
43    pub fn is_ok(&self) -> bool {
44        self.errors.is_empty()
45    }
46
47    /// One JSON object: `{"path":…,"ok":…,"errors":[…],"warnings":[…]}`.
48    /// Strings are escaped; exit codes stay with the caller.
49    pub fn render_json(&self, path: &str) -> String {
50        fn escaped(s: &str) -> String {
51            let mut out = String::with_capacity(s.len() + 2);
52            for c in s.chars() {
53                match c {
54                    '"' => out.push_str("\\\""),
55                    '\\' => out.push_str("\\\\"),
56                    '\n' => out.push_str("\\n"),
57                    '\r' => out.push_str("\\r"),
58                    '\t' => out.push_str("\\t"),
59                    c if (c as u32) < 0x20 => out.push_str(&format!("\\u{:04x}", c as u32)),
60                    c => out.push(c),
61                }
62            }
63            out
64        }
65        let list = |items: &[String]| {
66            let inner: Vec<String> = items.iter().map(|i| format!("\"{}\"", escaped(i))).collect();
67            format!("[{}]", inner.join(","))
68        };
69        format!(
70            "{{\"path\":\"{}\",\"ok\":{},\"errors\":{},\"warnings\":{}}}",
71            escaped(path),
72            self.is_ok(),
73            list(&self.errors),
74            list(&self.warnings),
75        )
76    }
77
78    /// Human-readable report, one finding per line, ending in a verdict.
79    pub fn render(&self, path: &str) -> String {
80        let mut out = String::new();
81        for e in &self.errors {
82            out.push_str(&format!("error: {e}\n"));
83        }
84        for w in &self.warnings {
85            out.push_str(&format!("warning: {w}\n"));
86        }
87        if self.is_ok() {
88            out.push_str(&format!("{path}: configuration OK"));
89            if !self.warnings.is_empty() {
90                out.push_str(&format!(" ({} warning{})", self.warnings.len(), plural(self.warnings.len())));
91            }
92        } else {
93            out.push_str(&format!(
94                "{path}: {} error{}, {} warning{}",
95                self.errors.len(), plural(self.errors.len()),
96                self.warnings.len(), plural(self.warnings.len()),
97            ));
98        }
99        out.push('\n');
100        out
101    }
102}
103
104fn plural(n: usize) -> &'static str {
105    if n == 1 { "" } else { "s" }
106}
107
108/// The path `--check` targets in `args` (the process arguments), or `None`
109/// when `--check` is absent. `--check=<path>` and `--check <path>` name a
110/// file; a bare `--check` checks the file the server would load.
111pub fn check_target_from_args(args: &[String]) -> Option<String> {
112    let mut iter = args.iter().skip(1).peekable();
113    while let Some(arg) = iter.next() {
114        if let Some(path) = arg.strip_prefix("--check=") {
115            return Some(path.to_string());
116        }
117        if arg == "--check" {
118            return Some(match iter.peek() {
119                Some(next) if !next.starts_with('-') => next.to_string(),
120                _ => default_config_path(),
121            });
122        }
123    }
124    None
125}
126
127/// Whether the arguments ask for machine-readable output (`--format=json`).
128pub fn wants_json_output(args: &[String]) -> bool {
129    args.iter().any(|a| a == "--format=json")
130}
131
132/// `RWS_CONFIG_FILE` if set, else `rws.config.toml` in the working directory.
133pub fn default_config_path() -> String {
134    std::env::var("RWS_CONFIG_FILE")
135        .ok()
136        .filter(|p| !p.trim().is_empty())
137        .unwrap_or_else(|| "rws.config.toml".to_string())
138}
139
140/// Check the configuration file at `path`.
141pub fn check_file(path: &str) -> ConfigReport {
142    match std::fs::read_to_string(path) {
143        Ok(content) => check_str(&content),
144        Err(e) => {
145            let mut report = ConfigReport::default();
146            report.error(format!("cannot read {path}: {e}"));
147            report
148        }
149    }
150}
151
152thread_local! {
153    static OFFLINE: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
154}
155
156/// `true` inside [`check_str_offline`]: checks that would read this
157/// machine's files or environment are skipped.
158pub(crate) fn offline() -> bool {
159    OFFLINE.with(|o| o.get())
160}
161
162/// [`check_str`] without looking at this machine: no file is opened or
163/// tested for existence (certificates, keys, CA bundles, htpasswd files,
164/// static roots, programs) and no environment variable is read (auth
165/// secrets, DNS API credentials). For configuration text from someone else,
166/// e.g. the docs MCP server's `check_config` tool, where those answers would
167/// describe the server, not the caller's deployment.
168pub fn check_str_offline(content: &str) -> ConfigReport {
169    struct Reset;
170    impl Drop for Reset {
171        fn drop(&mut self) {
172            OFFLINE.with(|o| o.set(false));
173        }
174    }
175    OFFLINE.with(|o| o.set(true));
176    let _reset = Reset;
177    check_str(content)
178}
179
180/// Check configuration text. Relative file paths in it (certificates,
181/// htpasswd files, static roots) are resolved against the working directory,
182/// as the server resolves them.
183pub fn check_str(content: &str) -> ConfigReport {
184    let mut report = ConfigReport::default();
185    if content.contains('\0') {
186        report.error("the file contains a NUL byte");
187        return report;
188    }
189
190    match collect_settings(Cursor::new(content.as_bytes()), String::new()) {
191        Ok(resolved) => {
192            for key in &resolved.unknown {
193                report.error(format!("unknown setting '{key}' — ignored"));
194            }
195            check_settings(&resolved.settings, &mut report);
196        }
197        Err(e) => report.error(format!("unable to parse: {e}")),
198    }
199
200    #[cfg(not(target_arch = "wasm32"))]
201    if content.contains("[[route]]") || content.contains("[[upstream]]")
202        || content.contains("[[tcp_proxy]]") || content.contains("[[udp_proxy]]") || content.contains("[[ws_proxy]]")
203    {
204        crate::proxy_config::validate::check_unknown_keys(content, &mut report);
205        crate::proxy_config::ProxyConfig::from_str(content).validate(&mut report);
206    } else if content.lines().any(|l| l.trim().starts_with("[middleware")) {
207        report.warn("[middleware] only applies in proxy mode (a file with [[route]] or [[upstream]] sections)");
208    }
209
210    report
211}
212
213/// Type and consistency checks for the `RWS_CONFIG_*` settings in the file.
214fn check_settings(settings: &[(String, String)], report: &mut ConfigReport) {
215    let get = |name: &str| settings.iter().rev().find(|(n, _)| n == name).map(|(_, v)| v.trim());
216
217    for (name, value) in settings {
218        let value = value.trim();
219        let key = setting_key(name);
220        match name.as_str() {
221            Config::RWS_CONFIG_PORT | Config::RWS_CONFIG_HTTP_REDIRECT_PORT | Config::RWS_CONFIG_ACME_CHALLENGE_PORT => {
222                if !(name == Config::RWS_CONFIG_HTTP_REDIRECT_PORT && value.is_empty())
223                    && !value.parse::<u16>().is_ok_and(|p| p > 0)
224                {
225                    report.error(format!("{key} = {value:?}: not a port number (1-65535)"));
226                }
227            }
228            Config::RWS_CONFIG_IP => {
229                if value.parse::<std::net::IpAddr>().is_err() {
230                    report.error(format!("{key} = {value:?}: not an IP address (use 0.0.0.0 or :: for all interfaces)"));
231                }
232            }
233            Config::RWS_CONFIG_THREAD_COUNT => {
234                if !value.parse::<usize>().is_ok_and(|n| n > 0) {
235                    report.error(format!("{key} = {value:?}: not a positive number"));
236                }
237            }
238            Config::RWS_CONFIG_REQUEST_ALLOCATION_SIZE_IN_BYTES => {
239                if !value.parse::<u64>().is_ok_and(|n| n > 0) {
240                    report.error(format!("{key} = {value:?}: not a positive number"));
241                }
242            }
243            "RWS_CONFIG_MAX_BODY_SIZE_IN_BYTES" | "RWS_CONFIG_OPEN_FILE_CACHE_SECS" | "RWS_CONFIG_RATE_LIMIT_MAX_REQUESTS" | "RWS_CONFIG_RATE_LIMIT_WINDOW_SECS"
244            | "RWS_CONFIG_ACME_RENEW_BEFORE_DAYS" | "RWS_CONFIG_ACME_RENEW_CHECK_INTERVAL_SECS"
245            | "RWS_CONFIG_CIRCUIT_BREAKER_FAILURE_THRESHOLD" | "RWS_CONFIG_CIRCUIT_BREAKER_MAX_HALF_OPEN_PROBES"
246            | "RWS_CONFIG_CIRCUIT_BREAKER_RECOVERY_SECS" | Config::RWS_CONFIG_CORS_MAX_AGE => {
247                if value.parse::<u64>().is_err() {
248                    report.error(format!("{key} = {value:?}: not a whole number"));
249                }
250            }
251            Config::RWS_CONFIG_CORS_ALLOW_ALL | Config::RWS_CONFIG_CORS_ALLOW_CREDENTIALS | Config::RWS_CONFIG_ACME_STAGING
252            | "RWS_CONFIG_CLIENT_HINTS" | "RWS_CONFIG_OPEN_FILE_CACHE_STRICT"
253            | "RWS_CONFIG_SECURITY_HEADERS" | "RWS_CONFIG_NANOS_HEADERS" | "RWS_CONFIG_SERVE_DOTFILES" | "RWS_CONFIG_WATCH"
254            | "RWS_CONFIG_PROXY_PROTOCOL" | "RWS_CONFIG_GATEWAY_API_ENABLED" => {
255                if !matches!(value.to_ascii_lowercase().as_str(), "true" | "false") {
256                    report.error(format!("{key} = {value:?}: expected true or false"));
257                }
258            }
259            "RWS_CONFIG_GATEWAY_API_MODE" => {
260                if !matches!(value.to_ascii_lowercase().as_str(), "shared" | "provisioned") {
261                    report.error(format!("{key} = {value:?}: expected shared or provisioned"));
262                }
263            }
264            "RWS_CONFIG_ACCESS_LOG_MAX_SIZE" | "RWS_CONFIG_ACCESS_LOG_KEEP" => {
265                if crate::disk_guard::parse_size(value).is_none() {
266                    report.error(format!("{key} = {value:?}: expected a number of bytes or files (e.g. 104857600 or 100M)"));
267                }
268            }
269            "RWS_CONFIG_RUNTIME" => {
270                if !matches!(value.to_ascii_lowercase().as_str(), "shared" | "per-core") {
271                    report.error(format!("{key} = {value:?}: expected \"shared\" or \"per-core\""));
272                }
273            }
274            "RWS_CONFIG_LOG_FORMAT" => {
275                if !matches!(value.to_ascii_lowercase().as_str(), "combined" | "json" | "off" | "none") {
276                    report.error(format!("{key} = {value:?}: expected \"combined\", \"json\" or \"off\""));
277                }
278            }
279            "RWS_CONFIG_TLS_CLIENT_CA_FILE" | Config::RWS_CONFIG_ACME_CA_FILE => {
280                if !offline() && !value.is_empty() && !Path::new(value).is_file() {
281                    report.error(format!("{key} = {value:?}: file not found"));
282                }
283            }
284            #[cfg(feature = "http2")]
285            "RWS_CONFIG_TLS_CLIENT_CRL_FILE" => {
286                if !offline() && !value.is_empty() {
287                    if let Err(e) = crate::tls::load_crls(value) {
288                        report.error(format!("{key}: {e}"));
289                    }
290                }
291            }
292            "RWS_CONFIG_TEMPLATE_DIR" => {
293                if !offline() && !value.is_empty() && !Path::new(value).is_dir() {
294                    report.warn(format!("{key} = {value:?}: directory not found"));
295                }
296            }
297            _ => {}
298        }
299    }
300
301    #[cfg(not(target_arch = "wasm32"))]
302    crate::admin::validate(&|name| get(name).map(str::to_string), report);
303
304    // TLS: both files or neither; loadable unless ACME will create them.
305    let acme_domains = get(Config::RWS_CONFIG_ACME_DOMAINS).unwrap_or("");
306    let acme = !acme_domains.is_empty();
307    let cert = get(Config::RWS_CONFIG_TLS_CERT_FILE).unwrap_or("");
308    let key = get(Config::RWS_CONFIG_TLS_KEY_FILE).unwrap_or("");
309    match (cert.is_empty(), key.is_empty()) {
310        (false, true) => report.error("tls_cert_file is set but tls_key_file is not"),
311        (true, false) => report.error("tls_key_file is set but tls_cert_file is not"),
312        (false, false) if !acme => check_tls_pair("tls_cert_file / tls_key_file", cert, key, report),
313        _ => {}
314    }
315    // spa_fallback names a file relative to the working directory; if it is
316    // missing, every client-side route except / 404s.
317    if let Some(fallback) = get(Config::RWS_CONFIG_SPA_FALLBACK).filter(|v| !v.is_empty()) {
318        if !offline() && !std::path::Path::new(fallback).is_file() {
319            report.warn(format!(
320                "spa_fallback = {fallback:?}: the file does not exist in the working directory, so every client-side route would 404"
321            ));
322        }
323    }
324
325    // [cors] allow_origins must match what the browser sends in Origin:
326    // scheme://host[:port], no trailing slash, no path.
327    if let Some(origins) = get(Config::RWS_CONFIG_CORS_ALLOW_ORIGINS) {
328        for origin in origins.split(',').map(str::trim).filter(|o| !o.is_empty()) {
329            if origin != "*" && !origin.starts_with("http://") && !origin.starts_with("https://") {
330                report.warn(format!(
331                    "[cors] allow_origins: '{origin}' does not look like scheme://host[:port]; a browser's Origin header never matches it"
332                ));
333            } else if origin != "*" && (origin.ends_with('/') || origin.rsplit_once("://").is_some_and(|(_, rest)| rest.contains('/'))) {
334                report.warn(format!(
335                    "[cors] allow_origins: '{origin}' has a path or trailing slash; Origin headers carry none, so it never matches"
336                ));
337            }
338        }
339    }
340
341    let mut seen_domains: Vec<&str> = Vec::new();
342    for i in 0.. {
343        let domain = get(&format!("RWS_CONFIG_VIRTUAL_HOST_{i}_DOMAIN"));
344        let cert = get(&format!("RWS_CONFIG_VIRTUAL_HOST_{i}_CERT_FILE"));
345        let key = get(&format!("RWS_CONFIG_VIRTUAL_HOST_{i}_KEY_FILE"));
346        if domain.is_none() && cert.is_none() && key.is_none() {
347            break;
348        }
349        let label = format!("[[virtual_host]] {}", domain.unwrap_or("(no domain)"));
350        match (domain, cert, key) {
351            (Some(d), Some(c), Some(k)) if !d.is_empty() => {
352                // Two entries with the same domain: only one certificate can
353                // win, so the loser is a silent misconfiguration.
354                if seen_domains.contains(&d) {
355                    report.error(format!(
356                        "{label}: a second [[virtual_host]] with the same domain; only one certificate can win"
357                    ));
358                } else {
359                    seen_domains.push(d);
360                }
361                check_tls_pair(&label, c, k, report)
362            }
363            _ => report.error(format!("{label}: needs domain, cert_file and key_file")),
364        }
365    }
366
367    if acme {
368        #[cfg(not(feature = "acme"))]
369        report.error("[acme] is configured, but this rws binary was built without the `acme` feature — no certificate would be requested");
370        if get(Config::RWS_CONFIG_ACME_EMAIL).unwrap_or("").is_empty() {
371            report.warn("[acme] has no email: the CA can't warn you about expiring or revoked certificates");
372        }
373        let challenge = get(Config::RWS_CONFIG_ACME_CHALLENGE).map(str::trim).filter(|v| !v.is_empty()).unwrap_or("http-01").to_ascii_lowercase();
374        if !matches!(challenge.as_str(), "http-01" | "tls-alpn-01" | "dns-01" | "dns-persist-01") {
375            report.error(format!("[acme] challenge = {challenge:?}: expected http-01, tls-alpn-01, dns-01 or dns-persist-01"));
376        }
377        for domain in acme_domains.split(',').map(str::trim) {
378            // A wildcard is one leading "*." label (RFC 8555 §7.1.3).
379            let (wildcard, name) = match domain.strip_prefix("*.") {
380                Some(rest) => (true, rest),
381                None => (false, domain),
382            };
383            if name.is_empty() || name.contains('*') || name.contains('/') || name.contains(':') || !name.contains('.') {
384                report.error(format!("[acme] domains: '{domain}' is not a domain name"));
385            } else if wildcard && !challenge.starts_with("dns-") {
386                report.error(format!("[acme] domains: the wildcard '{domain}' needs challenge = \"dns-01\" or \"dns-persist-01\""));
387            }
388        }
389        let port = get(Config::RWS_CONFIG_PORT).unwrap_or("7878");
390        let challenge_port = get(Config::RWS_CONFIG_ACME_CHALLENGE_PORT).unwrap_or("80");
391        let redirect_port = get(Config::RWS_CONFIG_HTTP_REDIRECT_PORT).unwrap_or("");
392        if challenge == "http-01" && redirect_port.is_empty() {
393            report.warn(format!(
394                "[acme] without http_redirect_port: nothing answers the HTTP-01 challenge on port {challenge_port}; set http_redirect_port = {challenge_port}"
395            ));
396        }
397        if challenge == "dns-01" {
398            check_acme_dns(&get, report);
399        }
400        if challenge == "dns-persist-01" && get(Config::RWS_CONFIG_ACME_DNS_PROVIDER).is_some_and(|p| !p.trim().is_empty()) {
401            report.warn("[acme] dns_provider is ignored with dns-persist-01: you publish its record once yourself (rws prints it)");
402        }
403        let on_demand = get(Config::RWS_CONFIG_ACME_ON_DEMAND).unwrap_or("").trim().to_ascii_lowercase();
404        if !matches!(on_demand.as_str(), "" | "true" | "false") {
405            report.error(format!("[acme] on_demand = {on_demand:?}: expected true or false"));
406        } else if on_demand == "true" {
407            match get(Config::RWS_CONFIG_ACME_ON_DEMAND_ASK).map(str::trim).filter(|v| !v.is_empty()) {
408                None => report.error("[acme] on_demand needs on_demand_ask: without it anyone could make rws order certificates for any name pointed at it"),
409                Some(ask) if !(ask.starts_with("http://") || ask.starts_with("https://")) => {
410                    report.error(format!("[acme] on_demand_ask = {ask:?}: expected an http:// or https:// URL"))
411                }
412                Some(_) => {}
413            }
414            if challenge.starts_with("dns-") {
415                report.error(format!("[acme] on_demand works with http-01 and tls-alpn-01, not {challenge} (it would need every customer's DNS zone)"));
416            }
417        }
418        if port != "443" {
419            report.warn(format!("[acme] with port = {port}: browsers expect HTTPS on 443 (fine if a port mapping forwards 443 here)"));
420        }
421    }
422}
423
424/// `dns_api_url`, when set: an http(s) URL.
425fn check_api_url(url: Option<&str>, report: &mut ConfigReport) {
426    if let Some(url) = url.filter(|u| !(u.starts_with("https://") || u.starts_with("http://"))) {
427        report.error(format!("[acme] dns_api_url = {url:?}: expected an http:// or https:// URL"));
428    }
429}
430
431/// `[acme] challenge = "dns-01"`: a provider and what it needs.
432fn check_acme_dns<'a>(get: &dyn Fn(&str) -> Option<&'a str>, report: &mut ConfigReport) {
433    let set = |name: &str| get(name).map(str::trim).filter(|v| !v.is_empty());
434    match set(Config::RWS_CONFIG_ACME_DNS_PROVIDER).map(str::to_ascii_lowercase).as_deref() {
435        Some("rfc2136") => {
436            match set(Config::RWS_CONFIG_ACME_DNS_SERVER) {
437                None => report.error("[acme] dns_provider = \"rfc2136\" needs dns_server (the primary DNS server, host[:port])"),
438                Some(server) if server.contains('/') || server.is_empty() => report.error(format!("[acme] dns_server = {server:?}: expected host[:port]")),
439                Some(_) => {}
440            }
441            match (set(Config::RWS_CONFIG_ACME_DNS_TSIG_KEY), set(Config::RWS_CONFIG_ACME_DNS_TSIG_SECRET)) {
442                (Some(_), None) | (None, Some(_)) => report.error("[acme] dns_tsig_key and dns_tsig_secret go together"),
443                (None, None) => report.warn("[acme] rfc2136 without a TSIG key: the server must accept unsigned updates from this host"),
444                (Some(_), Some(secret)) => {
445                    #[cfg(feature = "acme")]
446                    if crate::acme::base64_secret(secret).is_none() {
447                        report.error("[acme] dns_tsig_secret is not base64");
448                    }
449                    #[cfg(not(feature = "acme"))]
450                    let _ = secret;
451                }
452            }
453            if let Some(algorithm) = set(Config::RWS_CONFIG_ACME_DNS_TSIG_ALGORITHM) {
454                if !matches!(algorithm.to_ascii_lowercase().as_str(), "hmac-sha256" | "hmac-sha512") {
455                    report.error(format!("[acme] dns_tsig_algorithm = {algorithm:?}: expected hmac-sha256 or hmac-sha512"));
456                }
457            }
458        }
459        Some("exec") => match set(Config::RWS_CONFIG_ACME_DNS_EXEC) {
460            None => report.error("[acme] dns_provider = \"exec\" needs dns_exec (the program)"),
461            Some(program) if !offline() && !Path::new(program).is_file() => report.error(format!("[acme] dns_exec = {program:?}: file not found")),
462            Some(_) => {}
463        },
464        Some("cloudflare") => {
465            // Usually kept out of the file, in the environment.
466            let in_env = offline() || std::env::var(Config::RWS_CONFIG_ACME_DNS_API_TOKEN).is_ok_and(|v| !v.trim().is_empty());
467            if set(Config::RWS_CONFIG_ACME_DNS_API_TOKEN).is_none() && !in_env {
468                report.error("[acme] dns_provider = \"cloudflare\" needs dns_api_token (an API token with DNS edit permission; or RWS_CONFIG_ACME_DNS_API_TOKEN)");
469            }
470            check_api_url(set(Config::RWS_CONFIG_ACME_DNS_API_URL), report);
471        }
472        Some("route53") => {
473            let aws = |name: &str| offline() || std::env::var(name).is_ok_and(|v| !v.trim().is_empty());
474            if !(aws("AWS_ACCESS_KEY_ID") && aws("AWS_SECRET_ACCESS_KEY")) {
475                report.warn("[acme] dns_provider = \"route53\" reads AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY from the environment, and they aren't set here");
476            }
477            check_api_url(set(Config::RWS_CONFIG_ACME_DNS_API_URL), report);
478        }
479        Some(other) => report.error(format!("[acme] dns_provider = {other:?}: expected rfc2136, cloudflare, route53 or exec")),
480        None => report.error("[acme] challenge = \"dns-01\" needs dns_provider (rfc2136, cloudflare, route53 or exec)"),
481    }
482    if let Some(secs) = set(Config::RWS_CONFIG_ACME_DNS_PROPAGATION_SECS) {
483        if secs.parse::<u64>().is_err() {
484            report.error(format!("[acme] dns_propagation_secs = {secs:?}: not a whole number"));
485        }
486    }
487}
488
489/// `RWS_CONFIG_CORS_ALLOW_ALL` → `cors_allow_all`, for messages.
490fn setting_key(env_name: &str) -> String {
491    env_name.trim_start_matches("RWS_CONFIG_").to_ascii_lowercase()
492}
493
494fn check_tls_pair(label: &str, cert: &str, key: &str, report: &mut ConfigReport) {
495    if offline() {
496        return;
497    }
498    let mut missing = false;
499    for (what, path) in [("certificate", cert), ("key", key)] {
500        if !Path::new(path).is_file() {
501            report.error(format!("{label}: {what} file '{path}' not found"));
502            missing = true;
503        }
504    }
505    if missing {
506        return;
507    }
508    #[cfg(all(feature = "http2", not(target_arch = "wasm32")))]
509    if let Err(e) = crate::tls::create_tls_acceptor(cert, key) {
510        report.error(format!("{label}: {e}"));
511    }
512    #[cfg(not(feature = "http2"))]
513    report.warn(format!("{label}: this build has no TLS support (`http1` only), so the certificate is not used"));
514}
rust_web_server/config_check/mod.rs

rust_web_server/config_check/
mod.rs
