TLS guardrails (insecure http refusal, custom CAs) and deployment guide

tests/conformance.rs

@@ -448,6 +448,33 @@ async fn rotated_keys_are_accepted_through_previous_listing() {
     assert!(revoked.is_empty(), "revoked key was still accepted");
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn plain_http_transport_is_refused_off_loopback() {
+    let root = tempfile::tempdir().unwrap();
+    let mut config = config_for(&root.path().join("alice"), "alice", "http://10.0.0.1:1");
+    let refused = Node::start(config.clone()).await;
+    assert!(
+        refused.is_err(),
+        "plain http to a non-loopback relay must be refused"
+    );
+
+    config.node.allow_insecure = true;
+    let node = Node::start(config).await.unwrap();
+    let outcome = frxd::node::control_query(
+        &format!("http://{}", node.addr),
+        "rust",
+        Some(5),
+        Some(100),
+        false,
+    )
+    .await
+    .unwrap();
+    assert_eq!(
+        outcome.pointer("/local/total").and_then(Value::as_u64),
+        Some(0)
+    );
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn stale_envelopes_are_rejected() {
     let relay_url = spawn_relay().await;