crates/installer/nordisk-twin/Cargo.toml
[package]
name = "nordisk-twin"
# 0.1.0 (2026-09-27): born from gunnar's twin (gunnar-core `issuer.rs`,
# gunnar-server `twin_tls.rs`, gunnar-pairing-door `certify.rs`, gunnar-grpc's
# TLS-1.3-only provider and `pick_replication_dial`) with NO product type in it,
# so holger and gunnar certify, pin and dial their twins with one piece of code.
# holger is the first consumer (holger branch `holger-twin-mtls`); gunnar adopts it
# itself, later.
# 0.1.1 (2026-10-21, lane G8, A7 rows 4, 20, 26): Gunnar's lessons shared —
# `fence::fence_gate` (fence before recharge, not_fenced), one holder per principal
# (`pki::Issuer::issue_superseding` + `tls::server_config_current`, `superseded`),
# and `certify::run_while` (a loop whose pair the front no longer wants stops).
# 0.1.2 (2026-10-21, lane G11): `recharge` — the recharge lane (four refusals, certify,
# pull, re-point), moved from holger's server so the box and the front run ONE lane; a
# pull that lost the race to another caller reads the main again (AlreadyRecharged).
version = "0.1.2"
edition = "2021"
description = "A box's twin over mutual TLS 1.3: the primary's own persistent replication issuer, a client certificate issued from the twin's own request (proof of possession, CN forced, clientAuth only), the replication door's server identity, the twin's side (request, install with the four checks and the CA pinned, load), TLS-1.3-only rustls configs on ring, the first-answering replication host, and the certify state machine the front drives. Shared by holger and gunnar; no product type in it."
license = "MIT OR Apache-2.0"
repository = "https://git.gunnar.rs/nordisk/Skidbladnir"
keywords = ["twin", "replication", "mtls", "estate", "pki"]
categories = ["network-programming", "cryptography"]
exclude = ["/.nornir/"]
[dependencies]
# The PKI: an ECDSA P-256 CA, leaves from requests, requests from keys. The same
# rcgen shape nordisk-pairing's installer CA uses, so one lock carries both.
rcgen = { version = "0.14", default-features = false, features = ["crypto", "pem", "ring", "x509-parser"] }
rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
x509-parser = "0.18"
time = "0.3"
# **The async half** (feature `tokio`): the replication door's accept loop and
# the twin's dialler as a tower `Service<Uri>`, which is what tonic's
# `serve_with_incoming` and `connect_with_connector` take. Off by default: an
# OS-less PID 1 or a laptop tool mints and pins with the blocking half alone.
tokio = { version = "1", default-features = false, features = ["net", "time", "rt", "sync", "macros"], optional = true }
tokio-rustls = { version = "0.26", default-features = false, features = ["ring"], optional = true }
tokio-stream = { version = "0.1", default-features = false, optional = true }
hyper-util = { version = "0.1", default-features = false, features = ["tokio"], optional = true }
tower-service = { version = "0.3", optional = true }
http = { version = "1", optional = true }
[features]
default = []
tokio = ["dep:tokio", "dep:tokio-rustls", "dep:tokio-stream", "dep:hyper-util", "dep:tower-service", "dep:http"]
[dev-dependencies]
tokio = { version = "1", features = ["macros", "rt-multi-thread", "net", "time", "io-util"] }