Enum TransportConfig 

pub enum TransportConfig {
    Tls {
        ca_cert_path: Option<String>,
        client_cert_path: Option<String>,
        client_key_path: Option<String>,
        allow_invalid_certificates: bool,
        allow_invalid_hostnames: bool,
    },
    Plaintext,
    RustlsConfig {
        config: RustlsClientConfig,
    },
}

Transport configuration for a connector instance.

Variants

Tls

Use TLS transport.

Set ca_cert_path to verify the server against a custom CA bundle; set client_cert_path + client_key_path to enable mutual TLS (mTLS).

Fields

ca_cert_path: Option<String>

Optional PEM-encoded CA certificate file used to verify the server. When absent the system trust store is used.

client_cert_path: Option<String>

Optional PEM-encoded client certificate file for mTLS authentication. Must be paired with client_key_path.

client_key_path: Option<String>

Optional PEM-encoded client private key file for mTLS authentication. Must be paired with client_cert_path.

allow_invalid_certificates: bool

When true, accept invalid or unknown CA certificates.

This is intended only for local testing or tightly controlled private environments where certificate distribution is not practical.

allow_invalid_hostnames: bool

When true, skip TLS hostname verification.

This is intended only for local testing or tightly controlled private environments where DNS/SAN validation is not practical.

Plaintext

Use plaintext (unencrypted) transport.

Security Warning

Plaintext transport transmits credentials and data in the clear. Only use this for localhost or fully-trusted private-network deployments (e.g., VPC-internal clusters) where all traffic is already isolated. Do not use plaintext over public or shared networks.

RustlsConfig

Use a fully-constructed rustls::ClientConfig injected at runtime.

This variant is intended for advanced use-cases where the caller needs complete control over TLS configuration that cannot be expressed through the file-path-based TransportConfig::Tls variant — for example:

• Custom certificate verifiers or pinning logic.
• Client certificates loaded from a hardware security module (HSM).
• Integration tests that generate ephemeral CA certificates in-process.

Because rustls::ClientConfig is not serializable, this variant serializes as the string "<RustlsClientConfig>" and cannot be round-tripped through a config file. Inject it programmatically only.

Requires the tls Cargo feature.

Fields

config: RustlsClientConfig

The pre-built rustls client configuration.

Implementations

impl TransportConfig

pub fn tls() -> Self

Construct a TLS transport configuration using the system trust store and no client certificate (server-auth-only TLS).

pub fn tls_with_ca_cert_path(ca_cert_path: Option<String>) -> Self

Construct a TLS transport configuration with an optional CA bundle.

pub fn mtls( ca_cert_path: Option<String>, client_cert_path: String, client_key_path: String, ) -> Self

Construct a mutual TLS (mTLS) configuration.

Both client_cert_path and client_key_path are required. ca_cert_path is optional and falls back to the system trust store.

pub fn tls_insecure_skip_verify() -> Self

Construct TLS transport that skips certificate and hostname validation.

Use only for local testing or tightly controlled private environments.

pub const fn plaintext() -> Self

Construct a plaintext (unencrypted) transport configuration.

See the TransportConfig::Plaintext variant for security guidance.

pub fn rustls_config(config: Arc<ClientConfig>) -> Self

Inject a pre-built rustls::ClientConfig directly.

Use this when the file-path-based TransportConfig::Tls variant does not provide the level of control you need (custom verifiers, HSM keys, ephemeral in-process CAs, etc.).

Requires the tls Cargo feature.

pub fn is_tls(&self) -> bool

Return true when TLS transport is configured.

pub fn is_mtls(&self) -> bool

Return true when mutual TLS (mTLS) is configured (client cert + key both set).

pub fn ca_cert_path(&self) -> Option<&str>

Return the configured CA bundle path, if any.

pub fn allow_invalid_certificates(&self) -> bool

Return true when TLS certificate verification is disabled.

Always returns false for TransportConfig::RustlsConfig — the injected ClientConfig is assumed to already encode the desired verification policy.

pub fn allow_invalid_hostnames(&self) -> bool

Return true when TLS hostname verification is disabled.

Always returns false for TransportConfig::RustlsConfig — the injected ClientConfig is assumed to already encode the desired hostname policy.

pub fn client_cert_path(&self) -> Option<&str>

Return the configured client certificate path, if any.

pub fn client_key_path(&self) -> Option<&str>

Return the configured client private key path, if any.

pub fn warn_if_insecure(&self, source_label: &str)

Emit tracing::warn! events for any insecure TLS flags.

Call this once per connection attempt. When allow_invalid_certificates or allow_invalid_hostnames is set, a structured warning is emitted so that log-aggregation pipelines and alerting rules can detect accidental production use of insecure TLS configuration.

Trait Implementations

impl Clone for TransportConfig

fn clone(&self) -> TransportConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TransportConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TransportConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for TransportConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for TransportConfig

impl PartialEq for TransportConfig

fn eq(&self, other: &TransportConfig) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for TransportConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for TransportConfig