fix(relay): enable Redis TLS for rediss:// (ElastiCache) (#1417)

Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co>
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>

Cargo.lock

@@ -765,6 +765,7 @@ dependencies = [
  "deadpool-redis",
  "hex",
  "nostr",
+ "rustls",
  "serde_json",
  "sqlx",
  "tokio",
@@ -1061,6 +1062,7 @@ dependencies = [
  "redis",
  "reqwest 0.13.3",
  "rust-s3",
+ "rustls",
  "serde",
  "serde_json",
  "serde_yaml",
@@ -6345,10 +6347,13 @@ dependencies = [
  "num-bigint",
  "percent-encoding",
  "pin-project-lite",
+ "rustls",
+ "rustls-native-certs",
  "ryu",
  "sha1_smol",
  "socket2",
  "tokio",
+ "tokio-rustls",
  "tokio-util",
  "url",
  "xxhash-rust",

Cargo.toml

@@ -52,7 +52,7 @@ sqlx = { version = "0.9", features = [
 ] }
 
 # Redis
-redis        = { version = "1.0", features = ["tokio-comp", "connection-manager"] }
+redis        = { version = "1.0", features = ["tokio-comp", "connection-manager", "tokio-rustls-comp"] }
 deadpool-redis = { version = "0.23", features = ["rt_tokio_1"] }
 
 # Nostr

crates/buzz-admin/Cargo.toml

@@ -26,6 +26,11 @@ serde_json = { workspace = true }
 anyhow = { workspace = true }
 hex = { workspace = true }
 deadpool-redis = { workspace = true }
+# Redis TLS (rediss://, e.g. ElastiCache) uses rustls, which needs a process
+# CryptoProvider installed at startup. The workspace redis TLS feature compiles
+# both aws-lc-rs and ring in transitively, so rustls can't auto-select one — we
+# install ring explicitly in main(). Mirrors buzz-relay's setup.
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
 tracing = { workspace = true }
 sqlx = { workspace = true }
 url = { workspace = true }

crates/buzz-admin/src/main.rs

@@ -92,6 +92,14 @@ enum Command {
 
 #[tokio::main]
 async fn main() {
+    // Install the ring CryptoProvider for rustls. The workspace redis TLS
+    // feature compiles both aws-lc-rs and ring in transitively, so rustls can't
+    // auto-select a provider and would panic on the first rediss:// (ElastiCache)
+    // Redis TLS connection without this. Mirrors buzz-relay's main().
+    rustls::crypto::ring::default_provider()
+        .install_default()
+        .expect("failed to install rustls crypto provider");
+
     let cli = Cli::parse();
 
     let code = match run(cli).await {

crates/buzz-relay/Cargo.toml

@@ -44,6 +44,11 @@ dashmap = { workspace = true }
 futures-util = { workspace = true }
 deadpool-redis = { workspace = true }
 redis = { workspace = true }
+# Redis TLS (rediss://, e.g. ElastiCache) uses rustls, which needs a process
+# CryptoProvider installed at startup. Both aws-lc-rs and ring are compiled in
+# transitively, so rustls can't auto-select one — we install ring explicitly in
+# main(). Mirrors buzz-acp's rustls setup for wss://.
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
 sqlx = { workspace = true }
 base64 = "0.22"
 buzz-sdk = { workspace = true }

crates/buzz-relay/src/main.rs

@@ -27,6 +27,14 @@ fn buzz_auto_migrate_enabled(value: Option<&str>) -> bool {
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
+    // Install the ring CryptoProvider for rustls. Required before any rustls
+    // TLS connection (rediss:// to ElastiCache, wss://, S3 over TLS): both
+    // aws-lc-rs and ring are compiled in transitively, so rustls can't
+    // auto-select a provider and would panic at first use without this.
+    rustls::crypto::ring::default_provider()
+        .install_default()
+        .expect("failed to install rustls crypto provider");
+
     // JSON-only structured logs — simple, machine-parseable, CAKE-compatible.
     tracing_subscriber::registry()
         .with(fmt::layer().json().flatten_event(true))