Function fetch_creds_via_bootstrap

nodedb/src/control/cluster/tls.rs:266–311

L.4 joiner-side helper: connect to `seed`'s bootstrap listener with `token`, receive `(ca_cert, node_cert, node_key, cluster_secret)`, write the files to `tls_dir/`, and return the loaded credentials. Blocks the calling thread on a short-lived tokio runtime so the helper composes with the synchronous resolve path.

(
    settings: &ClusterSettings,
    tls_dir: &Path,
    token_hex: &str,
    seed: std::net::SocketAddr,
)

/// Blocks the calling thread on a short-lived tokio runtime so the
/// helper composes with the synchronous resolve path.
fn fetch_creds_via_bootstrap(
    settings: &ClusterSettings,
    tls_dir: &Path,
    token_hex: &str,
    seed: std::net::SocketAddr,
) -> crate::Result<TlsCredentials> {
    fs::create_dir_all(tls_dir).map_err(|e| crate::Error::Config {
        detail: format!("create tls dir {}: {e}", tls_dir.display()),
    })?;

    let rt = tokio::runtime::Builder::new_current_thread()
        .enable_all()
        .build()
        .map_err(|e| crate::Error::Config {
            detail: format!("build bootstrap runtime: {e}"),
        })?;
    let resp = rt
        .block_on(nodedb_cluster::bootstrap_listener::fetch_creds(
            seed,
            token_hex,
            settings.node_id,
            std::time::Duration::from_secs(30),
        ))
        .map_err(|e| crate::Error::Config {
            detail: format!("bootstrap fetch_creds: {e}"),
        })?;

    // Persist to disk so a restart takes the normal data-dir path
    // without needing the token a second time.
    write_pem_cert(&tls_dir.join(CA_CERT_FILE), &resp.ca_cert_der)?;
    write_pem_cert(&tls_dir.join(NODE_CERT_FILE), &resp.node_cert_der)?;
    write_pem_private_key(&tls_dir.join(NODE_KEY_FILE), &resp.node_key_der)?;
    if resp.cluster_secret.len() != CLUSTER_SECRET_LEN {
        return Err(crate::Error::Config {
            detail: format!(
                "bootstrap response cluster_secret has {} bytes, expected {CLUSTER_SECRET_LEN}",
                resp.cluster_secret.len()
            ),
        });
    }
    let mut secret = [0u8; CLUSTER_SECRET_LEN];
    secret.copy_from_slice(&resp.cluster_secret);
    write_cluster_secret(&tls_dir.join(CLUSTER_SECRET_FILE), &secret)?;

    load_from_data_dir(tls_dir)
}

fn bootstrap_credentials(
    settings: &ClusterSettings,