Module tls 

Optional TLS transport (SPEC-008 CAN-020, SRV-040, FR-29).

TLS is an additive, off-by-default capability: the plaintext path is untouched and carries no rustls dependency unless the crate is built with --features tls. There is no STARTTLS — TLS is decided at connect time, before any Thunder frame is exchanged, so the wire codec never sees the difference between a plaintext and an encrypted byte stream.

The config types (ServerTls, ClientTls) are plain data and always compile, so an application can carry TLS settings regardless of the feature; only the rustls acceptor/connector builders below are feature-gated. A deployment that sets TLS config without the tls feature is refused at connect time with a clear error rather than silently running plaintext.

Structs

ClientTls

Client-side TLS material (FR-29). Presence of this on the client config makes the client dial TLS; absence keeps it plaintext.

ServerTls

Server-side TLS material (SRV-040). Presence of this on the listener config turns TLS on for that deployment; absence keeps it plaintext.