v0.10.0: TOML config files + adoption polish

[guyte149]

Summary

Two distinct buckets of work that landed together because they share a version bump (CI requires one per PR):

1. TOML config files (--config <PATH>)

rusnel server and rusnel client both gain a --config <PATH> flag pointing at a TOML file with [server] and/or [client] sections. Schema mirrors the CLI flags one-for-one (snake_case); a single file can hold both sections.

• Precedence: explicit CLI flag > config file > built-in default. Detection of "explicit-on-CLI" uses ArgMatches::value_source (same approach ripgrep / bat use).
• TLS-mode group is atomic: passing any TLS-mode flag on the CLI (--insecure / --tls-self-signed / --tls-cert / --tls-key / --tls-ca on the server, equivalents on the client) causes all of the file's TLS-mode keys to be ignored — no ambiguous mixing of e.g. tls_self_signed = true with --tls-cert.
• Unknown keys rejected (#[serde(deny_unknown_fields)]) so typos surface as parse errors.
• Positional <server> / <remote>... can be supplied by the file when omitted from the CLI; CLI wins when both are present.
• 6 unit tests in src/config_file.rs cover parsing happy-path + every error mode (typos, invalid enum values, empty file).
• 6 end-to-end tests in tests/config_file.rs spawn the actual binary and verify the file drives it (including CLI override of file values).
• Annotated reference at examples/rusnel.toml.

2. Release + adoption infrastructure

• .github/workflows/release.yml: on v* tag push, builds prebuilt binaries for x86_64/aarch64 Linux (gnu + musl), macOS (Intel + Apple Silicon), Windows x86_64, attaches sha256 checksums to a GitHub Release, and pushes a multi-arch (amd64 + arm64) Docker image to GHCR tagged :vX.Y.Z, :X.Y, :latest.
• Dockerfile (multi-stage musl builder → distroless runtime, ~10 MB image, runs as non-root) + .dockerignore.
• README rewrite: tagline, "Why Rusnel?" comparison table vs chisel / frp / ssh -L, concrete benchmark numbers near the top (2.07x throughput vs chisel, 4.3x better p99 latency, pulled from existing benchmark/iperf/results/loopback/results.json), 60-second quickstart, expanded Features list surfacing previously-hidden bits (stdio:, RUSNEL_EMBED_*, rusnel ctl, JSON logs, Happy Eyeballs), Configuration-file section, Docker subsection.
• ROADMAP.md: extracted from the old README ## TODO so the README stays focused.
• CONTRIBUTING.md + SECURITY.md: project hygiene that infosec users specifically look for.
• .github/ISSUE_TEMPLATE/{bug_report,feature_request,config}.yml + .github/PULL_REQUEST_TEMPLATE.md: structured reporting that routes security issues to private disclosure and the version-bump checklist into the PR form.
• docs/launch-post.md: drafts for HN / r/rust / r/selfhosted / lobste.rs and an awesome-list submission checklist (private to the repo, not user-visible from the README).

Notable design choices

• The TOML schema is a private module (mod config_file in main.rs-only, not exported from the library) because it's tightly coupled to the CLI shape, not to any library API. tests/config_file.rs exercises it through the real binary instead of through library symbols.
• Switched from Args::parse_from(...) to try_get_matches_from + from_arg_matches so we can read value_source for the merge logic. Same struct, same parser, just one more layer of indirection.
• The atomic TLS-mode merge rule was the trickiest call. The alternative — applying file values field-by-field — produces silently surprising results (file says tls_self_signed = true, you pass --tls-cert to override, but resolve_server_tls picks self-signed first and ignores your cert). The atomic rule means the CLI's TLS choice is total whenever it's specified.

Stats

• 150 tests passing (was 138), cargo fmt --all -- --check clean, cargo clippy --all -- -D warnings clean.
• Version bumped 0.9.1 -> 0.10.0 (minor — new flag, no breaking changes).

Made with Cursor