fix(tranquil-config): reject unknown keys in TlsConfig, bump rust 1.96

Lewis: May this revision serve well! <lu5a@proton.me>

Dockerfile

@@ -6,7 +6,7 @@ RUN pnpm install --frozen-lockfile
 COPY frontend/ ./
 RUN pnpm build
 
-FROM rust:1.92-alpine AS builder
+FROM rust:1.96-alpine AS builder
 RUN apk add --no-cache ca-certificates musl-dev pkgconfig openssl-dev openssl-libs-static mold clang protoc
 ENV RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=mold"
 WORKDIR /app

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM rust:1.92-alpine
+FROM rust:1.96-alpine
 
 RUN apk add --no-cache \
     ca-certificates \

crates/tranquil-config/src/lib.rs

@@ -502,6 +502,7 @@ pub struct ServerConfig {
 }
 
 #[derive(Debug, Config)]
+#[config(layer_attr(serde(deny_unknown_fields)))]
 pub struct TlsConfig {
     /// The path to the TLS cert chain.
     /// If you set both this and `key_path`, the server terminates TLS itself rather than expecting
@@ -1638,10 +1639,8 @@ not_a_real_field = "oops"
 
     #[test]
     fn load_accepts_known_keys() {
-        let dir = std::env::temp_dir().join(format!(
-            "tranquil-config-known-keys-{}",
-            std::process::id()
-        ));
+        let dir =
+            std::env::temp_dir().join(format!("tranquil-config-known-keys-{}", std::process::id()));
         std::fs::create_dir_all(&dir).expect("mkdir tempdir");
         let path = dir.join("config.toml");
         std::fs::write(

rust-toolchain.toml

@@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.96.0"
+components = ["rustfmt", "clippy"]
+profile = "minimal"