Function acceptor_from_source 

pub fn acceptor_from_source(
    tls: &TlsConfig,
    source: Option<Arc<dyn TlsCertSource>>,
) -> Result<Option<TlsAcceptor>, TlsError>

Build the TlsAcceptor with an injected cert source, or Ok(None) when TLS is off. tls.enabled (operator switch) and tls.alpn still come from config; the source only governs cert provenance — when Some, the file paths in config are ignored, so an enterprise ACME/managed-PKI source needs no cert_path/key_path. None falls back to the OPEN FileCertSource. An enabled-but-unbuildable terminator is Err → the proxy fails to bind (fatal boot, no silent cleartext fallback).