It builds with one warning.

src/tls.rs

@@ -0,0 +1,219 @@
+use std::sync::Arc;
+use chrono::{DateTime, Duration as ChronoDuration, Utc};
+use rcgen::{
+    BasicConstraints, CertificateParams, DnType, ExtendedKeyUsagePurpose, IsCa,
+    Issuer, KeyPair, KeyUsagePurpose,
+};
+use rusqlite::Connection;
+use rustls::server::WebPkiClientVerifier;
+use rustls::RootCertStore;
+use rustls_pki_types::{CertificateDer, PrivateKeyDer};
+use serde::{Deserialize, Serialize};
+use tracing::info;
+use uuid::Uuid;
+
+use crate::db::{meta_set};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct JoinToken {
+    pub token: String,
+    pub expires_at: DateTime<Utc>,
+    pub used: bool,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct JoinClusterRequest {
+    pub token: String,
+    pub node_id: Uuid,
+    #[serde(default)]
+    pub san_list: Vec<String>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct JoinClusterResponse {
+    pub ca_pem: String,
+    pub cert_pem: String,
+    pub key_pem: String,
+}
+
+// ---------------------------------------------------------------------------
+// Certificate Generation
+// ---------------------------------------------------------------------------
+
+pub fn generate_ca() -> Result<(String, String), String> {
+    let ca_key = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256)
+        .map_err(|e| format!("CA key error: {e}"))?;
+
+    let mut ca_params = CertificateParams::new(vec![])
+        .map_err(|e| format!("CA params error: {e}"))?;
+    ca_params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
+    ca_params.distinguished_name.push(DnType::CommonName, "Cluster Root CA");
+    ca_params.key_usages = vec![KeyUsagePurpose::KeyCertSign, KeyUsagePurpose::CrlSign];
+
+    let ca_cert = ca_params
+        .self_signed(&ca_key)
+        .map_err(|e| format!("CA self-sign error: {e}"))?;
+
+    Ok((ca_cert.pem(), ca_key.serialize_pem()))
+}
+
+pub fn issue_leaf_cert(
+    ca_cert_pem: &str,
+    ca_key_pem: &str,
+    common_name: &str,
+    san_list: Vec<String>,
+) -> Result<(String, String), String> {
+    let ca_key = KeyPair::from_pem(ca_key_pem)
+        .map_err(|e| format!("Failed to parse CA private key: {e}"))?;
+
+    // In rcgen 0.14+, from_ca_cert_pem belongs to Issuer:
+    let issuer = Issuer::from_ca_cert_pem(ca_cert_pem, &ca_key)
+        .map_err(|e| format!("Failed to parse CA cert/create issuer: {e}"))?;
+
+    let leaf_key = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256)
+        .map_err(|e| format!("Leaf key error: {e}"))?;
+
+    let mut leaf_params = CertificateParams::new(san_list)
+        .map_err(|e| format!("Leaf params error: {e}"))?;
+    leaf_params.distinguished_name.push(DnType::CommonName, common_name);
+    leaf_params.use_authority_key_identifier_extension = true;
+    leaf_params.key_usages = vec![KeyUsagePurpose::DigitalSignature];
+    leaf_params.extended_key_usages = vec![
+        ExtendedKeyUsagePurpose::ServerAuth,
+        ExtendedKeyUsagePurpose::ClientAuth,
+    ];
+
+    let leaf_cert = leaf_params
+        .signed_by(&leaf_key, &issuer)
+        .map_err(|e| format!("Leaf sign error: {e}"))?;
+
+    Ok((leaf_cert.pem(), leaf_key.serialize_pem()))
+}
+
+// ---------------------------------------------------------------------------
+// Rustls Server & Reqwest Client Configuration
+// ---------------------------------------------------------------------------
+
+fn parse_certs(pem: &str) -> Result<Vec<CertificateDer<'static>>, String> {
+    let mut reader = pem.as_bytes();
+    let certs: Result<Vec<_>, _> = rustls_pemfile::certs(&mut reader).collect();
+    certs.map_err(|e| format!("failed to parse certs: {e}"))
+}
+
+fn parse_key(pem: &str) -> Result<PrivateKeyDer<'static>, String> {
+    let mut reader = pem.as_bytes();
+    rustls_pemfile::private_key(&mut reader)
+        .map_err(|e| format!("failed to parse private key: {e}"))?
+        .ok_or_else(|| "no private key found in pem".to_string())
+}
+
+pub fn create_mtls_server_config(
+    ca_pem: &str,
+    server_cert_pem: &str,
+    server_key_pem: &str,
+) -> Result<rustls::ServerConfig, String> {
+    let mut root_store = RootCertStore::empty();
+    for cert in parse_certs(ca_pem)? {
+        root_store
+            .add(cert)
+            .map_err(|e| format!("failed to add root cert: {e}"))?;
+    }
+
+    // allow_unauthenticated permits anonymous TLS connections (e.g., initial join requests)
+    // while enforcing valid CA signatures on any presented client certificates.
+    let client_verifier = WebPkiClientVerifier::builder(Arc::new(root_store))
+        .allow_unauthenticated()
+        .build()
+        .map_err(|e| format!("failed to build client verifier: {e}"))?;
+
+    let cert_chain = parse_certs(server_cert_pem)?;
+    let key = parse_key(server_key_pem)?;
+
+    let mut config = rustls::ServerConfig::builder()
+        .with_client_cert_verifier(client_verifier)
+        .with_single_cert(cert_chain, key)
+        .map_err(|e| format!("failed to build ServerConfig: {e}"))?;
+
+    config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
+    Ok(config)
+}
+
+pub fn create_mtls_client(
+    ca_pem: &str,
+    client_cert_pem: &str,
+    client_key_pem: &str,
+) -> Result<reqwest::Client, String> {
+    let root_cert = reqwest::Certificate::from_pem(ca_pem.as_bytes())
+        .map_err(|e| format!("failed to load CA pem for client: {e}"))?;
+
+    let identity_pem = format!("{client_cert_pem}\n{client_key_pem}");
+    let identity = reqwest::Identity::from_pem(identity_pem.as_bytes())
+        .map_err(|e| format!("failed to create client identity: {e}"))?;
+
+    reqwest::Client::builder()
+        .use_rustls_tls()
+        .add_root_certificate(root_cert)
+        .identity(identity)
+        .connect_timeout(std::time::Duration::from_secs(10))
+        .timeout(std::time::Duration::from_secs(60))
+        .build()
+        .map_err(|e| format!("failed to build reqwest client: {e}"))
+}
+
+// ---------------------------------------------------------------------------
+// Dynamic Enrollment / Join Helpers
+// ---------------------------------------------------------------------------
+
+pub fn create_join_token(ttl_secs: u64) -> JoinToken {
+    JoinToken {
+        token: Uuid::new_v4().to_string().replace('-', ""),
+        expires_at: Utc::now() + ChronoDuration::seconds(ttl_secs as i64),
+        used: false,
+    }
+}
+
+pub async fn bootstrap_replica_join(
+    primary_url: &str,
+    token: &str,
+    node_id: Uuid,
+    db: &Connection,
+) -> Result<(), String> {
+    let base = primary_url.trim_end_matches('/');
+
+    // 1. Initial bootstrap client without mTLS client cert
+    let bootstrap_client = reqwest::Client::builder()
+        .danger_accept_invalid_certs(true)
+        .build()
+        .map_err(|e| format!("bootstrap client build failed: {e}"))?;
+
+    // 2. Request enrollment
+    let join_req = JoinClusterRequest {
+        token: token.to_string(),
+        node_id,
+        san_list: vec!["localhost".into(), "127.0.0.1".into()],
+    };
+
+    let resp = bootstrap_client
+        .post(format!("{base}/api/cluster/join"))
+        .json(&join_req)
+        .send()
+        .await
+        .map_err(|e| format!("join request failed: {e}"))?;
+
+    if !resp.status().is_success() {
+        return Err(format!("join rejected with HTTP {}", resp.status()));
+    }
+
+    let payload: JoinClusterResponse = resp
+        .json()
+        .await
+        .map_err(|e| format!("failed to decode join response: {e}"))?;
+
+    // 3. Persist credentials locally
+    meta_set(db, "tls_ca_pem", &payload.ca_pem).map_err(|e| e.to_string())?;
+    meta_set(db, "tls_cert_pem", &payload.cert_pem).map_err(|e| e.to_string())?;
+    meta_set(db, "tls_key_pem", &payload.key_pem).map_err(|e| e.to_string())?;
+
+    info!("Replica successfully joined cluster and persisted mTLS certificates");
+    Ok(())
+}