feat: TLS support for ember-cli - #83
Merged
Merged
Conversation
adds rustls-native-certs to the workspace and TLS dependencies to the CLI crate. introduces a new tls.rs module with: - TlsClientConfig struct for CLI TLS options - MaybeTlsStream enum wrapping plain TCP or TLS connections - AsyncRead/AsyncWrite implementations for transparent dispatch - connect() function supporting system roots, custom CA, and insecure mode (with NoVerifier for self-signed certs)
replaces raw TcpStream with MaybeTlsStream in Connection and BenchConnection. adds --tls-ca-cert and --tls-insecure CLI flags. removes the "tls not yet supported" early-exit stub and passes TlsClientConfig through REPL, one-shot, cluster, and benchmark modes.
removes "TLS coming soon" note from root README and updates the TLS example to use ember-cli. adds a TLS section to the CLI README with examples for custom CA, insecure mode, REPL, and benchmarks. updates the options table with the new --tls-ca-cert and --tls-insecure flags.
kacy
added a commit
that referenced
this pull request
Feb 11, 2026
* feat: add TLS client module for ember-cli adds rustls-native-certs to the workspace and TLS dependencies to the CLI crate. introduces a new tls.rs module with: - TlsClientConfig struct for CLI TLS options - MaybeTlsStream enum wrapping plain TCP or TLS connections - AsyncRead/AsyncWrite implementations for transparent dispatch - connect() function supporting system roots, custom CA, and insecure mode (with NoVerifier for self-signed certs) * feat: wire TLS support through all CLI code paths replaces raw TcpStream with MaybeTlsStream in Connection and BenchConnection. adds --tls-ca-cert and --tls-insecure CLI flags. removes the "tls not yet supported" early-exit stub and passes TlsClientConfig through REPL, one-shot, cluster, and benchmark modes. * docs: update READMEs for CLI TLS support removes "TLS coming soon" note from root README and updates the TLS example to use ember-cli. adds a TLS section to the CLI README with examples for custom CA, insecure mode, REPL, and benchmarks. updates the options table with the new --tls-ca-cert and --tls-insecure flags. * style: fix rustfmt formatting
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
summary
wires up actual TLS client connections so ember-cli can connect to TLS-enabled servers. the
--tlsflag previously printed "tls is not yet supported" and exited — now it performs a real TLS handshake using rustls.the approach uses a
MaybeTlsStreamenum that wraps either a plainTcpStreamor aTlsStream<TcpStream>, implementingAsyncReadandAsyncWritefor transparent dispatch. every code path that creates a connection (REPL, one-shot, cluster, benchmark) accepts an optionalTlsClientConfigand passes it through.new CLI flags:
--tls— enable TLS--tls-ca-cert <path>— custom CA certificate (PEM) for server verification; defaults to the system trust store--tls-insecure— skip certificate verification (prints a warning to stderr)what was tested
cargo clippy --workspace -- -D warnings— zero warningscargo test --workspace— all tests pass (80 CLI tests + full workspace)design considerations
MaybeTlsStreamenum overBox<dyn AsyncRead + AsyncWrite>to avoid heap allocation on every connection and keep the dispatch branch-predictable on the hot path.rustls-native-certsfor loading the system trust store — avoids shipping bundled CA certs and stays in sync with the OS.NoVerifierfor--tls-insecurematches theredis-cli --tls --insecurebehavior. always prints a warning to stderr when active.Box<TlsStream>inside the enum to keep thePlainvariant small —TlsStreamis significantly larger thanTcpStream.