From 87440d5a23f0fd894d949295a7c1ff85043550fc Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Wed, 28 Oct 2026 22:55:51 +0100
Subject: v0.4.0: add first-time TLS setup and server help

---
 src/bin/server/tls.rs | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

(limited to 'src/bin/server/tls.rs')

diff --git a/src/bin/server/tls.rs b/src/bin/server/tls.rs
index 62a25db..292ebf7 100644
--- a/src/bin/server/tls.rs
+++ b/src/bin/server/tls.rs
@@ -9,25 +9,25 @@ pub struct TlsServer {
 }
 
 impl TlsServer {
-    pub fn new(
-        cert_path: &str,
-        _key_path: &str,
-        unsafe_mode: bool,
-    ) -> Result<Self, Box<dyn std::error::Error>> {
-        let cert_data = if unsafe_mode {
-            if std::path::Path::new(cert_path).exists() {
-                std::fs::read(cert_path)?
-            } else {
+    pub fn new(cert_path: &str) -> Result<Self, Box<dyn std::error::Error>> {
+        let cert_data = match std::fs::read(cert_path) {
+            Ok(data) => data,
+            Err(error) => {
                 return Err(format!(
-                    "Certificate file '{}' not found. In --unsafe mode, you must provide a valid PKCS12 certificate file.\n\
-                     You can generate one with:\n\
-                     openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes\n\
-                     openssl pkcs12 -export -out identity.p12 -inkey key.pem -in cert.pem",
-                    cert_path
-                ).into());
+                    "Could not read TLS identity '{}': {}\n\
+                     \n\
+                     First-time setup:\n\
+                     \x20 cargo run --bin server -- --init\n\
+                     \n\
+                     Or generate it manually:\n\
+                     \x20 openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem \\\n\
+                     \x20   -days 3650 -nodes -subj \"/CN=localhost\"\n\
+                     \x20 openssl pkcs12 -export -out identity.p12 -inkey key.pem -in cert.pem \\\n\
+                     \x20   -passout pass:",
+                    cert_path, error
+                )
+                .into());
             }
-        } else {
-            std::fs::read(cert_path)?
         };
 
         let identity = native_tls::Identity::from_pkcs12(&cert_data, "")?;
-- 
cgit v1.2.3