[package]
name = "nono-proxy"
version = "0.65.1"
edition.workspace = true
rust-version.workspace = true
authors.workspace = true
license.workspace = true
repository.workspace = true
homepage.workspace = true
description = "Network filtering proxy for the nono sandbox"
keywords = ["sandbox", "security", "proxy", "network"]
categories = ["network-programming", "web-programming"]

[features]
default = ["system-keyring"]
# Enables OS system keyring access (macOS Keychain / Linux Secret Service).
# Headless/container consumers opt out with default-features = false.
system-keyring = ["nono/system-keyring"]

[dependencies]
nono = { version = "0.65.1", path = "../nono", default-features = false }
tokio.workspace = true
hyper.workspace = true
hyper-util.workspace = true
http-body-util.workspace = true
thiserror.workspace = true
serde.workspace = true
serde_json.workspace = true
tracing.workspace = true
zeroize.workspace = true
sha2.workspace = true
getrandom.workspace = true
base64 = "0.22"
subtle = "2"
url.workspace = true
urlencoding = "2"
globset.workspace = true

# TLS for upstream connections (reverse proxy mode)
hyper-rustls = { version = "0.27", features = ["http1", "ring", "webpki-tokio"] }
tokio-rustls = "0.26"
rustls = { version = "0.23", features = ["ring"] }
webpki-roots = "1"

# TLS interception (CONNECT-mode L7 filtering and credential injection):
# ephemeral session CA + per-host leaf certificate generation. `ring` matches
# the rustls crypto provider used elsewhere; `aws_lc_rs` is disabled to avoid
# a second, redundant crypto stack in the dependency tree.
rcgen = { version = "0.14", default-features = false, features = ["pem", "ring", "x509-parser"] }
x509-parser = "0.18"
# Read the host's system trust store (used to compose the trust bundle that
# the sandboxed child consumes via SSL_CERT_FILE / REQUESTS_CA_BUNDLE / etc.).
# We need full DER certs for PEM emission; webpki-roots only ships parsed
# TrustAnchors, so it can't be the source for a system bundle.
rustls-native-certs = "0.8"
# Date/time used by `rcgen` for cert validity windows. Already pulled in as a
# transitive dep of rcgen; declared explicitly because we use OffsetDateTime
# directly to set not_before/not_after.
time = { version = "0.3", default-features = false, features = ["std"] }

[dev-dependencies]
tempfile.workspace = true
tokio = { version = "1", features = ["test-util", "rt-multi-thread", "macros"] }

[lints]
workspace = true
