[package]
name = "geiserx_ts_runtime"
version.workspace = true
description = "tailscale runtime"
categories = ["network-programming"]
keywords = ["tailscale", "runtime"]

repository.workspace = true
edition.workspace = true
license.workspace = true
rust-version.workspace = true


[lib]
name = "ts_runtime"
[dependencies]
# `StatusNode.last_seen` exposes a `chrono::DateTime<Utc>` on a public field (mirrors
# `ts_control::Node.last_seen` / Go `PeerStatus.LastSeen`). Already a transitive dep via `ts_control`.
chrono = { workspace = true }
# Our crates.
ts_bart.workspace = true
ts_bart_packetfilter.workspace = true
ts_control.workspace = true
ts_dataplane.workspace = true
ts_dns_wire.workspace = true
ts_forwarder.workspace = true
ts_keys.workspace = true
ts_magicsock.workspace = true
ts_netcheck.workspace = true
ts_netstack_smoltcp = { workspace = true, features = ["tokio"] }
ts_overlay_router.workspace = true
ts_packet.workspace = true
ts_packetfilter = { workspace = true, features = ["checking-filter"] }
ts_packetfilter_state.workspace = true
ts_tka.workspace = true
ts_transport.workspace = true
ts_transport_tun = { workspace = true, optional = true }
ts_host_net = { workspace = true, optional = true }
ts_derp.workspace = true
ts_tunnel.workspace = true

# Unconditionally required dependencies.
base64.workspace = true
# TUN-mode only: parse inbound IPv4+UDP TUN packets and build the MagicDNS reply
# (recomputing IPv4+UDP checksums) for the in-datapath quad-100 DNS intercept.
etherparse = { version = "0.19", optional = true }
futures.workspace = true
httparse.workspace = true
ipnet.workspace = true
kameo = "0.19"
kameo_actors = "0.4"
thiserror.workspace = true
tokio = { workspace = true, features = ["net", "time", "io-util", "sync"] }
tracing.workspace = true
smallvec.workspace = true
# For `DeviceState::NeedsLogin(url::Url)` / `RegistrationError::NeedsLogin` — the interactive-auth
# URL control hands back, surfaced through the device-state machine.
url.workspace = true

[features]
# Off by default. Enables the TUN-mode overlay transport (ts_transport_tun) so the runtime can
# run the application data path over a real OS TUN interface instead of the userspace netstack.
# TUN device creation needs root/CAP_NET_ADMIN; off the ring-only egress path.
tun = ["dep:ts_transport_tun", "dep:ts_host_net", "dep:etherparse"]
# Client-side ACME (Let's Encrypt) cert issuance via the node's set-dns RPC. Off by default and
# SaaS-only (forwards to `ts_control/acme`). Enables `Runtime::get_certificate` + the ControlRunner
# `GetCertificate` message; a self-hosted control plane 501s on set-dns so issuance is
# non-functional there.
acme = ["ts_control/acme"]

[dev-dependencies]
rand = "0.10"
proptest = "1.11"
itertools = "0.14"
# Test-only: sign the TKA node-key-signature fixtures the peer_tracker TKA enforcement tests verify
# against (mirrors how `ts_tka`'s own unit tests build a valid signature). Not on any egress path.
ed25519-dalek = "2"

[lints]
workspace = true
