From 75bb1478fbb1c9cb6f25635023ea270f07259766 Mon Sep 17 00:00:00 2001
From: Ellie Huxtable <ellie@atuin.sh>
Date: Thu, 22 Jan 2026 16:12:12 -0800
Subject: chore(deps)!: update tls deps, remove built-in tls server support
 (#3091)

Update reqwest from 0.12 to 0.13 and remove the built-in TLS termination
from atuin-server. Users should use a reverse proxy (nginx, caddy,
traefik) for TLS/HTTPS support instead.

This removes:
- axum-server and rustls dependencies
- The [tls] configuration section
- The launch_with_tls function

Also updates metrics-exporter-prometheus from 0.17 to 0.18.

The reverse proxy approach is standard and provides better flexibility
for certificate management. I'd rather keep our server stack as minimal
as possible.

<!-- Thank you for making a PR! Bug fixes are always welcome, but if
you're adding a new feature or changing an existing one, we'd really
appreciate if you open an issue, post on the forum, or drop in on
Discord -->

## Checks
- [ ] I am happy for maintainers to push small adjustments to this PR,
to speed up the review cycle
- [ ] I have checked that there are no existing pull requests for the
same thing
---
 crates/atuin-server/src/settings.rs | 13 -------------
 1 file changed, 13 deletions(-)

(limited to 'crates/atuin-server/src/settings.rs')

diff --git a/crates/atuin-server/src/settings.rs b/crates/atuin-server/src/settings.rs
index 2c02bcbe..98d1d69f 100644
--- a/crates/atuin-server/src/settings.rs
+++ b/crates/atuin-server/src/settings.rs
@@ -65,7 +65,6 @@ pub struct Settings {
     pub register_webhook_url: Option<String>,
     pub register_webhook_username: String,
     pub metrics: Metrics,
-    pub tls: Tls,
     pub mail: Mail,
 
     /// Enable legacy sync v1 routes (history-based sync)
@@ -110,9 +109,6 @@ impl Settings {
             .set_default("metrics.host", "127.0.0.1")?
             .set_default("metrics.port", 9001)?
             .set_default("mail.enable", false)?
-            .set_default("tls.enable", false)?
-            .set_default("tls.cert_path", "")?
-            .set_default("tls.pkey_path", "")?
             .set_default("sync_v1_enabled", true)?
             .add_source(
                 Environment::with_prefix("atuin")
@@ -144,12 +140,3 @@ impl Settings {
 pub fn example_config() -> &'static str {
     EXAMPLE_CONFIG
 }
-
-#[derive(Clone, Debug, Default, Deserialize, Serialize)]
-pub struct Tls {
-    #[serde(alias = "enabled")]
-    pub enable: bool,
-
-    pub cert_path: PathBuf,
-    pub pkey_path: PathBuf,
-}
-- 
cgit v1.3.1