Implementation:ArroyoSystems Arroyo Tls Config

Knowledge Sources	ArroyoSystems_Arroyo
Domains	Streaming, Security, TLS
Last Updated	2026-02-08 08:00 GMT

Overview

Provides TLS configuration factory functions for creating rustls-based server and client TLS configurations across all Arroyo transport layers: HTTP (Axum), gRPC (Tonic), and raw TCP.

Description

This module contains four factory functions that build TLS configurations from the Arroyo TlsConfig struct:

• create_http_tls_config -- creates an Axum/rustls HTTPS config supporting optional mTLS (mutual TLS) based on the API auth mode. When ApiAuthMode::Mtls is set, it configures WebPkiClientVerifier with the CA certificate. Returns None if TLS is not configured.
• create_grpc_server_tls_config -- creates a tonic ServerTlsConfig with server identity and optional client certificate verification for gRPC services.
• create_tcp_server_tls_config -- creates a raw rustls ServerConfig for TCP-level TLS (used by the data plane), with optional mTLS client verification using the AWS LC RS crypto provider.
• create_tcp_client_tls_config -- creates a rustls ClientConfig for TCP clients (workers connecting to nodes), loading root certificates from both webpki and the native certificate store. Supports mTLS by providing client certificates when the mTLS CA file is configured.

All functions are async because they call tls_config.load().await which may read certificates from the filesystem or remote sources.

Usage

Use these functions when configuring TLS for any Arroyo server or client connection. The TlsConfig is loaded from the Arroyo configuration system.

Code Reference

Source Location

• Repository: ArroyoSystems_Arroyo
• File: crates/arroyo-server-common/src/tls.rs

Signature

pub async fn create_http_tls_config(
    auth_mode: &ApiAuthMode,
    tls_config: &Option<TlsConfig>,
) -> Result<Option<RustlsConfig>>;

pub async fn create_grpc_server_tls_config(tls_config: &TlsConfig) -> Result<ServerTlsConfig>;

pub async fn create_tcp_server_tls_config(tls_config: &TlsConfig) -> Result<ServerConfig>;

pub async fn create_tcp_client_tls_config(tls_config: &TlsConfig) -> Result<Arc<ClientConfig>>;

Import

use arroyo_server_common::tls::{
    create_http_tls_config, create_grpc_server_tls_config,
    create_tcp_server_tls_config, create_tcp_client_tls_config,
};

I/O Contract

Inputs

Name	Type	Required	Description
tls_config	&TlsConfig	Yes	Certificate file, key file, and optional mTLS CA file paths
auth_mode	&ApiAuthMode	Yes (for HTTP)	Authentication mode: None, Mtls, or StaticApiKey

Outputs

Name	Type	Description
RustlsConfig	Option<RustlsConfig>	Axum-compatible TLS config, or None if TLS not configured
ServerTlsConfig	ServerTlsConfig	Tonic gRPC server TLS configuration
ServerConfig	ServerConfig	Raw rustls server configuration
Arc<ClientConfig>	Arc<ClientConfig>	Shared rustls client configuration

Usage Examples

use arroyo_server_common::tls::create_grpc_server_tls_config;
use arroyo_rpc::config::config;

let tls_config = config().controller.tls.as_ref().unwrap();
let server_tls = create_grpc_server_tls_config(tls_config).await?;

let server = Server::builder()
    .tls_config(server_tls)?
    .add_service(my_service)
    .serve(addr)
    .await?;

Related Pages

• Environment:ArroyoSystems_Arroyo_Rust_Runtime