TLS guardrails (insecure http refusal, custom CAs) and deployment guide

tests/cli.rs

@@ -324,6 +324,40 @@ fn cli_key_rotation() {
     assert!(data.join("key.hex.bak").exists());
 }
 
+#[test]
+fn cli_relay_refuses_plain_http_off_loopback() {
+    let output = frxd()
+        .args([
+            "relay",
+            "--listen",
+            "127.0.0.1:0",
+            "--url",
+            "http://10.0.0.1:1",
+            "--peer",
+            "http://10.0.0.1:2",
+        ])
+        .output()
+        .unwrap();
+    assert!(!output.status.success());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(stderr.contains("allow-insecure"), "{stderr}");
+
+    let port = common::free_port();
+    let _service = spawn_service(
+        &[
+            "relay".to_string(),
+            "--listen".to_string(),
+            format!("127.0.0.1:{port}"),
+            "--url".to_string(),
+            "http://10.0.0.1:1".to_string(),
+            "--peer".to_string(),
+            "http://10.0.0.1:2".to_string(),
+            "--allow-insecure".to_string(),
+        ],
+        "relay listening",
+    );
+}
+
 #[test]
 fn cli_full_network_pipeline() {
     let root = tempfile::tempdir().unwrap();

tests/common/mod.rs

@@ -18,6 +18,8 @@ pub fn config_for(dir: &Path, name: &str, relay_url: &str) -> Config {
             relays: vec![relay_url.to_string()],
             registry: None,
             ma_key: None,
+            ca_cert: None,
+            allow_insecure: false,
             dev_bootstrap: true,
             responder: true,
         },

tests/conformance.rs

@@ -448,6 +448,33 @@ async fn rotated_keys_are_accepted_through_previous_listing() {
     assert!(revoked.is_empty(), "revoked key was still accepted");
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn plain_http_transport_is_refused_off_loopback() {
+    let root = tempfile::tempdir().unwrap();
+    let mut config = config_for(&root.path().join("alice"), "alice", "http://10.0.0.1:1");
+    let refused = Node::start(config.clone()).await;
+    assert!(
+        refused.is_err(),
+        "plain http to a non-loopback relay must be refused"
+    );
+
+    config.node.allow_insecure = true;
+    let node = Node::start(config).await.unwrap();
+    let outcome = frxd::node::control_query(
+        &format!("http://{}", node.addr),
+        "rust",
+        Some(5),
+        Some(100),
+        false,
+    )
+    .await
+    .unwrap();
+    assert_eq!(
+        outcome.pointer("/local/total").and_then(Value::as_u64),
+        Some(0)
+    );
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn stale_envelopes_are_rejected() {
     let relay_url = spawn_relay().await;