TLS guardrails (insecure http refusal, custom CAs) and deployment guide

src/node.rs

@@ -119,10 +119,19 @@ impl Node {
         let members_mtime = fs::metadata(&members_path)
             .and_then(|metadata| metadata.modified())
             .ok();
-        let client = reqwest::Client::builder()
-            .timeout(Duration::from_secs(15))
-            .build()
-            .context("building http client")?;
+        if !config.node.allow_insecure {
+            let insecure = config.insecure_endpoints();
+            if !insecure.is_empty() {
+                return Err(anyhow!(
+                    "refusing plain http endpoints (use https, configure ca_cert, or set allow_insecure for private networks): {}",
+                    insecure.join(", ")
+                ));
+            }
+        }
+        let client = crate::net::build_client(
+            config.node.ca_cert.as_deref().map(std::path::Path::new),
+            Duration::from_secs(15),
+        )?;
         let registry = match (
             config.node.registry.as_deref(),
             config.node.ma_key.as_deref(),