feat(core): add TLS/mTLS support with multi-listener and SNI #3

2026-08-09T22:23:46Z

Relism commented

2026-08-09 22:23:46 +00:00

Flash can now serve HTTPS and WSS, on one or many listeners per app:

FlashConfiguration gains an optional tls field for the single default
listener, and a listeners list for apps that bind multiple ports (each
independently plain or TLS).
New dev.relism.flash.tls package: TlsConfig.keystore(path, password) builds
an SSLContext from a PKCS12/JKS keystore, with SNI-based certificate
selection for free when the keystore holds more than one alias (matched by
SAN/CN, pure JDK APIs). TlsConfig.ofContext(sslContext) is a full escape
hatch — Flash never calls setSSLParameters on that path, so caller-set
protocols/cipher suites/ALPN survive untouched. TlsConfig.clientAuth(...)
adds optional/required mTLS on either path.
HttpServer moves from a single ServerSocket to a list of bound listeners;
the per-request hot path (RequestParser, routing, response writing) is
untouched — TLS only changes which bytes come out of accept(), so WSS needs
no separate code path from WS.
process()'s catch is widened to log non-IOException failures (e.g. a
misbehaving custom KeyManager/TrustManager on the ofContext path) instead
of swallowing them silently; the failure was already isolated to the one
connection via the existing try-with-resources/executor-submission
boundary — this only fixes the missing log line.
Fixes a pre-existing gap where FlashConfiguration#host was accepted but
never used to bind (listeners always bound to the wildcard address).

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

Flash can now serve HTTPS and WSS, on one or many listeners per app: - FlashConfiguration gains an optional `tls` field for the single default listener, and a `listeners` list for apps that bind multiple ports (each independently plain or TLS). - New dev.relism.flash.tls package: TlsConfig.keystore(path, password) builds an SSLContext from a PKCS12/JKS keystore, with SNI-based certificate selection for free when the keystore holds more than one alias (matched by SAN/CN, pure JDK APIs). TlsConfig.ofContext(sslContext) is a full escape hatch — Flash never calls setSSLParameters on that path, so caller-set protocols/cipher suites/ALPN survive untouched. TlsConfig.clientAuth(...) adds optional/required mTLS on either path. - HttpServer moves from a single ServerSocket to a list of bound listeners; the per-request hot path (RequestParser, routing, response writing) is untouched — TLS only changes which bytes come out of accept(), so WSS needs no separate code path from WS. - process()'s catch is widened to log non-IOException failures (e.g. a misbehaving custom KeyManager/TrustManager on the ofContext path) instead of swallowing them silently; the failure was already isolated to the one connection via the existing try-with-resources/executor-submission boundary — this only fixes the missing log line. - Fixes a pre-existing gap where FlashConfiguration#host was accepted but never used to bind (listeners always bound to the wildcard address). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Relism added 1 commit 2026-08-09 22:23:47 +00:00

feat(core): add TLS/mTLS support with multi-listener and SNI

CI / Build & Test (pull_request) Failing after 4m54s

Details

CI / Build & Test (push) Failing after 4m54s

Details

9f6808e90c

Flash can now serve HTTPS and WSS, on one or many listeners per app:

- FlashConfiguration gains an optional `tls` field for the single default
  listener, and a `listeners` list for apps that bind multiple ports (each
  independently plain or TLS).
- New dev.relism.flash.tls package: TlsConfig.keystore(path, password) builds
  an SSLContext from a PKCS12/JKS keystore, with SNI-based certificate
  selection for free when the keystore holds more than one alias (matched by
  SAN/CN, pure JDK APIs). TlsConfig.ofContext(sslContext) is a full escape
  hatch — Flash never calls setSSLParameters on that path, so caller-set
  protocols/cipher suites/ALPN survive untouched. TlsConfig.clientAuth(...)
  adds optional/required mTLS on either path.
- HttpServer moves from a single ServerSocket to a list of bound listeners;
  the per-request hot path (RequestParser, routing, response writing) is
  untouched — TLS only changes which bytes come out of accept(), so WSS needs
  no separate code path from WS.
- process()'s catch is widened to log non-IOException failures (e.g. a
  misbehaving custom KeyManager/TrustManager on the ofContext path) instead
  of swallowing them silently; the failure was already isolated to the one
  connection via the existing try-with-resources/executor-submission
  boundary — this only fixes the missing log line.
- Fixes a pre-existing gap where FlashConfiguration#host was accepted but
  never used to bind (listeners always bound to the wildcard address).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Relism merged commit 7cd8b3869c into master

2026-08-09 22:23:53 +00:00

Relism deleted branch feature/core/tls-support

2026-08-09 22:23:53 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Relism/Flash5#3