TLS

tls takes a TlsConnector or a TlsConfig on any topology; a rediss:// or valkeys:// URL switches TLS on for a standalone server.

TLS comes with one of three features, all off by default. tls-rustls builds on rustls with the aws-lc-rs crypto provider, tls-rustls-ring on rustls with ring, and tls-native-tls on the platform's own TLS library. The features add to each other rather than exclude each other. The crate re-exports TlsConnector and TlsConfig from fred, so a service names them without a dependency on fred.

TlsConnector::default_rustls() trusts the system's root certificates and presents no client certificate. It reads the certificates from the system and can fail, so the connector is built in main before the service starts. A connector built from a rustls ClientConfig carries a private certificate authority or a client certificate. Every connection of the broker uses it, the subscriptions' own included.

A TestApp test runs no handshake, so it proves the service starts and works with the connector in place.

Example

The dependency line:

ruststream-fred = { version = "0.7", features = ["tls-rustls"] }

The service reaches a cluster over TLS and logs in as the ACL user worker.

Macros

examples/redis_broker_tls.rs

/// The cluster over TLS, logged in as the ACL user `worker`.
fn broker(tls: TlsConnector, password: &str) -> RedisBroker {
    RedisBroker::cluster(["redis-1.internal:6380", "redis-2.internal:6380"])
        .credentials("worker", password)
        .tls(tls)
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn Error>> {
    // The system's trust roots, and no client certificate.
    let tls = TlsConnector::default_rustls()?;
    let password = env::var("REDIS_PASSWORD")?;
    service(broker(tls, &password)).run().await?;
    Ok(())
}

Manual

examples/manual/redis_broker_tls.rs

/// The cluster over TLS, logged in as the ACL user `worker`.
fn broker(tls: TlsConnector, password: &str) -> RedisBroker {
    RedisBroker::cluster(["redis-1.internal:6380", "redis-2.internal:6380"])
        .credentials("worker", password)
        .tls(tls)
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn Error>> {
    // The system's trust roots, and no client certificate.
    let tls = TlsConnector::default_rustls()?;
    let password = env::var("REDIS_PASSWORD")?;
    service(broker(tls, &password)).run().await?;
    Ok(())
}