Docker image improvements

crates/common/src/config/network.rs

@@ -208,10 +208,6 @@ impl Network {
                     if hostname != http_host {
                         http_host = hostname.to_string();
                     }
-                    pacc.authentication.as_mut().unwrap().oauth_public = OAuthPublic {
-                        issuer: format!("https://{hostname}/",),
-                    }
-                    .into();
                     pacc.protocols.jmap = HttpServer {
                         url: format!("https://{hostname}/jmap/session",),
                     }

crates/common/src/manager/defaults.rs

@@ -51,9 +51,10 @@ async fn insert_safe_defaults(bp: &mut Bootstrap) -> trc::Result<()> {
     let is_bootstrap_mode = bp.registry.is_bootstrap_mode();
 
     #[cfg(not(feature = "test_mode"))]
-    if !is_recovery_mode || is_bootstrap_mode {
-        if bp.registry.count_object(ObjectType::Application).await? == 0 {
-            bp.registry
+    if (!is_recovery_mode || is_bootstrap_mode)
+        && bp.registry.count_object(ObjectType::Application).await? == 0
+    {
+        bp.registry
             .write(RegistryWrite::insert(
                 &Application {
                     auto_update_frequency: Duration::from_millis(30 * 24 * 60 * 60 * 1000),
@@ -71,7 +72,6 @@ async fn insert_safe_defaults(bp: &mut Bootstrap) -> trc::Result<()> {
                 .into(),
             ))
             .await?;
-        }
     }
 
     if is_bootstrap_mode {

crates/common/src/network/dns/records.rs

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
  */
 
-use crate::{Server, network::dkim::generate_dkim_dns_record};
+use crate::{Server, config::network::Pacc, network::dkim::generate_dkim_dns_record};
 use ahash::{AHashMap, AHashSet};
 use base64::{Engine, engine::general_purpose};
 use dns_update::{
@@ -388,13 +388,30 @@ impl Server {
                     .and_then(|directory| {
                         directory
                             .oidc_discovery_document()
-                            .map(|doc| doc.url.to_string())
+                            .map(|doc| self.core.network.info.pacc.build(&doc.url))
+                    })
+                    .unwrap_or_else(|| {
+                        self.core
+                            .network
+                            .info
+                            .pacc
+                            .build(&self.core.network.http.url_https)
                     })
-                    .unwrap_or_else(|| self.core.network.http.url_https.clone())
             })
     }
 }
 
+impl Pacc {
+    pub fn build(&self, endpoint: &str) -> String {
+        let mut response =
+            String::with_capacity(self.prefix.len() + self.suffix.len() + endpoint.len());
+        response.push_str(&self.prefix);
+        response.push_str(endpoint);
+        response.push_str(&self.suffix);
+        response
+    }
+}
+
 #[inline(always)]
 #[allow(unused)]
 fn provider_domain(url: &Url) -> Option<&str> {

crates/main/Cargo.toml

@@ -38,6 +38,7 @@ registry = { path = "../registry" }
 http_proto = { path = "../http-proto" }
 migration = { path = "../migration" }
 tokio = { version = "1.47", features = ["full"] }
+rustls = { version = "0.23.5", default-features = false, features = ["std", "aws_lc_rs", "tls12"] }
 
 [target.'cfg(not(target_env = "msvc"))'.dependencies]
 jemallocator = "0.5.0"

crates/main/src/main.rs

@@ -32,6 +32,11 @@ static GLOBAL: Jemalloc = Jemalloc;
 
 #[tokio::main]
 async fn main() -> std::io::Result<()> {
+    // Install AWS-LC-RS as the default Rustls crypto provider
+    rustls::crypto::aws_lc_rs::default_provider()
+        .install_default()
+        .expect("failed to install aws-lc-rs as the default rustls crypto provider");
+
     // Load config and apply macros
     let mut init = Box::pin(BootManager::init()).await;