From 7a54ccf6a38a748e9a63c9d7c8bfe201aeefeeec Mon Sep 17 00:00:00 2001
From: Lewis <lu5a@proton.me>
Date: Fri, 29 May 2026 09:24:06 +0300
Subject: [PATCH] fix(tranquil-config): reject unknown keys in TlsConfig, bump
 rust 1.96

Lewis: May this revision serve well! <lu5a@proton.me>
---
 Dockerfile                        | 2 +-
 Dockerfile.dev                    | 2 +-
 crates/tranquil-config/src/lib.rs | 7 +++----
 rust-toolchain.toml               | 4 ++++
 4 files changed, 9 insertions(+), 6 deletions(-)
 create mode 100644 rust-toolchain.toml

diff --git a/Dockerfile b/Dockerfile
index 12e1c9e..2cb4186 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,7 +6,7 @@ RUN pnpm install --frozen-lockfile
 COPY frontend/ ./
 RUN pnpm build
 
-FROM rust:1.92-alpine AS builder
+FROM rust:1.96-alpine AS builder
 RUN apk add --no-cache ca-certificates musl-dev pkgconfig openssl-dev openssl-libs-static mold clang protoc
 ENV RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=mold"
 WORKDIR /app
diff --git a/Dockerfile.dev b/Dockerfile.dev
index 9a50b5e..7bd2520 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -1,4 +1,4 @@
-FROM rust:1.92-alpine
+FROM rust:1.96-alpine
 
 RUN apk add --no-cache \
     ca-certificates \
diff --git a/crates/tranquil-config/src/lib.rs b/crates/tranquil-config/src/lib.rs
index 6b21d5b..a5ea497 100644
--- a/crates/tranquil-config/src/lib.rs
+++ b/crates/tranquil-config/src/lib.rs
@@ -502,6 +502,7 @@ pub struct ServerConfig {
 }
 
 #[derive(Debug, Config)]
+#[config(layer_attr(serde(deny_unknown_fields)))]
 pub struct TlsConfig {
     /// The path to the TLS cert chain.
     /// If you set both this and `key_path`, the server terminates TLS itself rather than expecting
@@ -1638,10 +1639,8 @@ not_a_real_field = "oops"
 
     #[test]
     fn load_accepts_known_keys() {
-        let dir = std::env::temp_dir().join(format!(
-            "tranquil-config-known-keys-{}",
-            std::process::id()
-        ));
+        let dir =
+            std::env::temp_dir().join(format!("tranquil-config-known-keys-{}", std::process::id()));
         std::fs::create_dir_all(&dir).expect("mkdir tempdir");
         let path = dir.join("config.toml");
         std::fs::write(
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..0e9dcbc
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.96.0"
+components = ["rustfmt", "clippy"]
+profile = "minimal"