TLS guardrails (insecure http refusal, custom CAs) and deployment guide

src/main.rs

@@ -39,6 +39,10 @@ enum Command {
         registry: Option<String>,
         #[arg(long)]
         ma_key: Option<String>,
+        #[arg(long)]
+        ca_cert: Option<String>,
+        #[arg(long)]
+        allow_insecure: bool,
     },
     Add {
         path: PathBuf,
@@ -78,6 +82,10 @@ enum Command {
         registry: Option<String>,
         #[arg(long)]
         ma_key: Option<String>,
+        #[arg(long)]
+        ca_cert: Option<String>,
+        #[arg(long)]
+        allow_insecure: bool,
         #[arg(long, default_value_t = 3)]
         max_hops: usize,
     },
@@ -194,6 +202,8 @@ async fn main() -> Result<()> {
             id,
             registry,
             ma_key,
+            ca_cert,
+            allow_insecure,
         } => {
             if cli.config.exists() && !force {
                 bail!(
@@ -208,6 +218,8 @@ async fn main() -> Result<()> {
             config.node.id = id;
             config.node.registry = registry;
             config.node.ma_key = ma_key;
+            config.node.ca_cert = ca_cert;
+            config.node.allow_insecure = allow_insecure;
             if config.node.registry.is_none() {
                 config.node.dev_bootstrap = true;
                 println!(
@@ -262,6 +274,8 @@ async fn main() -> Result<()> {
             url,
             registry,
             ma_key,
+            ca_cert,
+            allow_insecure,
             max_hops,
         } => {
             let options = relay::RelayOptions {
@@ -270,6 +284,8 @@ async fn main() -> Result<()> {
                 url,
                 registry,
                 ma_key,
+                ca_cert,
+                allow_insecure,
                 max_hops,
             };
             let (listener, addr) = relay::bind(&listen).await?;