[package]
name = "geiserx_ts_control"
version.workspace = true
description = "tailscale control client"
categories = ["api-bindings", "network-programming"]
keywords = ["tailscale", "control"]

repository.workspace = true
edition.workspace = true
license.workspace = true

rust-version.workspace = true


[lib]
name = "ts_control"
[dependencies]
# Our crates.
ts_bitset.workspace = true
ts_capabilityversion = { workspace = true, features = ["serde"] }
ts_control_noise.workspace = true
ts_control_serde.workspace = true
ts_dynbitset.workspace = true
ts_http_util.workspace = true
ts_keys.workspace = true
ts_nodecapability = { workspace = true, features = ["serde"] }
ts_packet.workspace = true
ts_packetfilter.workspace = true
ts_packetfilter_state.workspace = true
ts_tls_util.workspace = true
ts_derp.workspace = true

# Unconditionally required dependencies.
bytes.workspace = true
# TLS server material for `Device::listen_tls` / `get_certificate`. Same
# `tokio-rustls`/`ring` provider the rest of the stack (`ts_tls_util`) uses, so
# no second crypto backend is introduced. Pure-Rust PEM decoder keeps musl-static.
tokio-rustls = { version = "0.26", default-features = false, features = ["ring"] }
# SHA-256 over the canonical VIP-services JSON for `HostInfo.ServicesHash` (the c2n
# `/vip-services` advertise signal). Already in the dep tree via `ts_tls_util` +
# `tokio-rustls`'s `ring` provider, so this introduces NO new crypto backend
# (ring-only — never aws-lc-rs / openssl). Used un-gated (not behind `acme`).
ring = "0.17"
rustls-pemfile = "2"
chrono = { workspace = true, features = ["serde"] }
gethostname.workspace = true
ipnet = { workspace = true, features = ["serde"] }
lazy_static.workspace = true
pin-project-lite.workspace = true
serde.workspace = true
serde_json.workspace = true
thiserror.workspace = true
tokio-util = { workspace = true, features = ["time"] }
tracing.workspace = true
url = { workspace = true, features = ["serde", "std"] }
zerocopy.workspace = true

# Required dependencies for the async_tokio feature.
futures-util = { workspace = true, optional = true }
tokio = { workspace = true, optional = true, features = ["fs"] }
tokio-stream = { version = "0.1", optional = true, default-features = false, features = ["sync"] }

# Required dependencies for the `acme` feature (client-side ACME / Let's Encrypt cert issuance).
# Hand-rolled on the existing ring-based HTTP/TLS stack (ts_http_util + tokio-rustls/ring), so it
# pulls NO aws-lc-rs / openssl / second TLS stack. `ring` (now an unconditional dep, see above) does
# the ES256 JWS signing + SHA-256 digests; `base64` does the base64url encoding; `rcgen` (ring)
# builds the finalize CSR.
base64 = { workspace = true, optional = true }
rcgen = { version = "0.13", default-features = false, features = ["ring", "pem"], optional = true }

[dev-dependencies]
# TEST-ONLY ephemeral self-signed cert to exercise the rustls acceptor wiring in
# `serve`/`cert` tests. Never a production issuance path.
rcgen = { version = "0.13", default-features = false, features = ["ring", "pem"] }
tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "io-util"] }

[features]
default = ["async_tokio"]
async_tokio = ["dep:futures-util", "dep:tokio", "dep:tokio-stream"]

# Allow derp connections to be made without verifying TLS certs. Only for use in tests.
insecure-derp = ["ts_derp/insecure-for-tests"]
# Allow control keys to be fetched over plain HTTP1 without TLS. Only for use in tests.
insecure-keyfetch = []
# SaaS-only WIF/OAuth-client auth-key bootstrap (off by default; a self-hosted control plane lacks these endpoints).
identity-federation = []
# Client-side ACME (Let's Encrypt) cert issuance + the POST /machine/set-dns Noise RPC that
# publishes the DNS-01 challenge TXT. Off by default and SaaS-only: a self-hosted control plane typically returns HTTP 501
# for `set-dns`, so issuance is non-functional there (built for full tsnet parity, like WIF). Pulls
# `ring`/`base64`/`rcgen` (all ring-only — no aws-lc-rs). Requires `async_tokio` for the Noise RPC.
acme = ["async_tokio", "dep:base64", "dep:rcgen"]

[lints]
workspace = true
