Struct ReloadableResolver 

pub struct ReloadableResolver { /* private fields */ }

Available on crate feature tls only.

A ResolvesServerCert whose backing rustls::sign::CertifiedKey can be swapped at runtime via ReloadableResolver::reload_from_pem.

Backed by arc_swap::ArcSwap, the swap is atomic and lock-free on the hot path (one Arc clone per TLS handshake). Use it via TlsCert::resolver and keep the returned Arc so callers can trigger reloads from anywhere (file watcher, signal handler, admin endpoint, …).

Example

use std::sync::Arc;
use tako_rs_server::{ReloadableResolver, Server, TlsCert};

let resolver = Arc::new(ReloadableResolver::from_pem("cert.pem", "key.pem")?);
let cert = TlsCert::resolver(resolver.clone());
let server = Server::builder().tls(cert).build();
// Later, after a cert rotation:
resolver.reload_from_pem("cert.pem", "key.pem")?;

Implementations

impl ReloadableResolver

pub fn from_pem(cert_path: &str, key_path: &str) -> Result<Self>

Construct from on-disk PEM files.

pub fn reload_from_pem(&self, cert_path: &str, key_path: &str) -> Result<()>

Atomically swap to a new cert + key loaded from the given PEM files.

Hot-path TLS handshakes pick up the new cert on the next resolve call without dropping any in-flight session.

pub fn reload(&self, ck: CertifiedKey)

Atomically swap to a pre-built rustls::sign::CertifiedKey.

Trait Implementations

impl Debug for ReloadableResolver

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ResolvesServerCert for ReloadableResolver

fn resolve(&self, _client_hello: ClientHello<'_>) -> Option<Arc<CertifiedKey>>

Choose a certificate chain and matching key given simplified ClientHello information.

fn only_raw_public_keys(&self) -> bool

Return true when the server only supports raw public keys.