Struct TlsReloader 

pub struct TlsReloader { /* private fields */ }

Holds the live [rustls::ServerConfig] and swaps it when the files change.

The accept loop reads TlsReloader::current once per connection, so a swap affects new connections only — established ones finish under the certificate they started with, which is what makes rotation non-disruptive.

Failure behaviour

A reload that cannot be built is a non-event: the error is logged and the existing configuration keeps serving. This is deliberate and differs from startup, where bad TLS material is fatal. At startup, continuing would mean silently serving plaintext; here there is already a working configuration in memory, so retaining it is strictly safer than either failing or downgrading.

It also makes non-atomic renewals safe. A poll can easily observe a new certificate alongside a not-yet-replaced key; that pair does not build, the swap is skipped, and the next poll picks up the completed write.

Implementations

impl TlsReloader

pub fn new(settings: TlsSettings) -> Result<Self, TlsError>

Build the initial configuration and capture its fingerprint.

Arguments

• settings - resolved TLS settings

Errors

Propagates any TlsError from build_server_config. Unlike a later reload, a failure here is fatal: there is no known-good config to fall back to.

pub fn current(&self) -> Arc<ServerConfig>

The configuration new connections should use.

Cheap: clones an Arc while holding the read lock only for that clone, never across an await.

pub fn reloading_enabled(interval_secs: u64) -> bool

Whether a reload interval enables reloading at all.

Zero restores the startup-only behaviour of earlier releases.

pub fn reload_if_changed(&self) -> bool

Re-read the files and swap the live config if they changed and still build.

Returns

true only when a new configuration was actually installed. An unchanged fingerprint, an unreadable file and a material that fails to build all return false and leave the current configuration serving.

Trait Implementations

impl Debug for TlsReloader

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.