Mixed SSL requirements and config praser error

[PureOxygen-Dev]

Hi Dave

Found maybe a logic bug, what I expected

I expected rustguac to:

stay on HTTP for its own web server
use TLS only for the outbound connection to guacd. I had to make this change also as guacd is by default running on HTTPS so the config needs to be there or the frontend fails to connect to guard.

What actually happens
If [tls] is present with only guacd_cert_path, config parsing fails and rustguac falls back to defaults with no logging of why it failed

From the source:

TlsConfig requires:
cert_path
key_path
guacd_cert_path is optional
So as soon as [tls] exists, cert_path and key_path become mandatory, even if I only want guacd TLS.

Also, config.tls.is_some() is later used to decide whether the server itself should bind with HTTPS.

Why this seems like a bug
guacd_cert_path and server HTTPS are two separate concerns:

inbound TLS for the rustguac web server
outbound TLS for the rustguac -> guacd connection

Right now they are coupled into one section, so there is no way to configure:

Traefik -> HTTPS termination externally
rustguac web server on HTTP internally
rustguac -> guacd over TLS
unless I also provide cert_path and key_path for the rustguac web server, even though I do not want rustguac itself to serve HTTPS directly.

Suggested fix
One of these would solve it cleanly:

Split server TLS and guacd TLS into separate config sections, for example:

[server_tls]
[guacd_tls]
Or make cert_path and key_path optional, and only require them when rustguac is actually configured to serve HTTPS itself.

Or move guacd_cert_path outside [tls] entirely.

Workaround
My current workaround is to make Traefik use HTTPS to rustguac as well, and provide cert_path + key_path, but that should not be required just to enable guacd TLS.

Thanks.

Simon

[davekempe]

Fixed — cert_path and key_path are now optional in the [tls] section. The two concerns are fully decoupled:

• Server HTTPS: only enabled when both cert_path and key_path are present
• guacd TLS: enabled when guacd_cert_path is present, independent of server HTTPS

So your use case (Traefik terminates HTTPS → rustguac on HTTP → guacd over TLS) now works:

[tls]
guacd_cert_path = "/opt/rustguac/tls/guacd-cert.pem"

If only one of cert_path/key_path is set, rustguac logs a warning and starts in HTTP mode. Existing configs with all three fields continue to work unchanged.

Fix is in the upcoming v0.6.2 release. Docs updated to reflect the new behaviour.

[davekempe]

Additional note: there is no enabled boolean toggle in the [tls] section — the presence of the fields themselves controls behaviour. Provide cert_path + key_path to get HTTPS, provide guacd_cert_path to get guacd TLS, or both. Any combination works.

The v0.6.2 release has the code fix. A docs update with clearer examples for all the TLS combinations is landing in the next release.