kinetic_common/
tls.rs

1//! Shared TLS configuration logic for sources and sinks.
2
3use kinetic_doc_derive::FieldDoc;
4use serde::{Deserialize, Serialize};
5use snafu::Snafu;
6use std::path::PathBuf;
7
8#[derive(Debug, Snafu)]
9pub enum Error {
10    #[snafu(display("Failed to read TLS certificate file: {}", path.display()))]
11    ReadCert {
12        path: PathBuf,
13        source: std::io::Error,
14    },
15    #[snafu(display("TLS configuration is not yet fully implemented, but was enabled."))]
16    Unimplemented,
17}
18
19type Result<T, E = Error> = std::result::Result<T, E>;
20
21/// Standard TLS configuration options available to any component that
22/// opens network connections or binds to a port.
23#[derive(Clone, Debug, Deserialize, Serialize, Default, FieldDoc)]
24pub struct TlsConfig {
25    /// Whether TLS is enabled.
26    #[serde(default)]
27    #[doc_field(default = "false")]
28    pub enabled: bool,
29
30    /// Path to a PEM-encoded CA certificate file to use for verifying peers.
31    #[doc_field(example = "/etc/ssl/certs/ca-bundle.crt")]
32    pub ca_file: Option<PathBuf>,
33
34    /// Path to a PEM-encoded certificate file for mutual TLS.
35    #[doc_field(example = "/etc/kinetic/tls/client.crt")]
36    pub crt_file: Option<PathBuf>,
37
38    /// Path to a PEM-encoded private key file for mutual TLS.
39    #[doc_field(secret, example = "/etc/kinetic/tls/client.key")]
40    pub key_file: Option<PathBuf>,
41
42    /// Whether to skip certificate verification. Insecure — use only for testing.
43    #[serde(default)]
44    #[doc_field(default = "false")]
45    pub insecure_skip_verify: bool,
46}
47
48impl TlsConfig {
49    /// Loads the actual certificate data from disk if TLS is enabled.
50    ///
51    /// # Returns
52    /// Currently returns `Ok(())`. In the future, this will build a
53    /// `rustls::ClientConfig` or `rustls::ServerConfig`.
54    pub fn build(&self) -> Result<()> {
55        if self.insecure_skip_verify || self.enabled {
56            return Err(Error::Unimplemented);
57        }
58
59        Ok(())
60    }
61}
kinetic_common/tls.rs

kinetic_common/
tls.rs
