[DB-1677] Draft: Reinstate DisableExternalTcpTls option

docs/server/quick-start/upgrade-guide.md

@@ -397,7 +397,7 @@ KurrentDB 25.0 includes [a plugin](../configuration/networking.md#external-tcp)
 A number of configuration options have been removed as part of this. KurrentDB will not start by default if any of the following options are present in the database configuration:
 
 - `AdvertiseTcpPortToClientAs`
-- `DisableExternalTcpTls`
+- `DisableExternalTcpTls` — this option is now available again under the [TCP plugin](../configuration/networking.md#external-tcp) configuration section as `TcpPlugin:DisableExternalTcpTls`
 - `EnableExternalTcp`
 - `ExtHostAdvertiseAs`
 - `ExtTcpHeartbeatInterval`

src/KurrentDB.Core/ClusterVNode.cs

@@ -294,11 +294,15 @@ public ClusterVNode(ClusterVNodeOptions options,
 		OptionsFormatter.LogConfig("Archive", archiveOptions);
 		archiveOptions.Validate();
 
-		var disableInternalTcpTls = options.Application.Insecure;
-		var disableExternalTcpTls = options.Application.Insecure;
 		var nodeTcpOptions = GetOptions<NodeTcpOptions>("TcpPlugin");
+		var disableInternalTcpTls = options.Application.Insecure;
+		var disableExternalTcpTls = options.Application.Insecure || nodeTcpOptions.DisableExternalTcpTls;
 		var enableExternalTcp = nodeTcpOptions.EnableExternalTcp;
 
+		if (nodeTcpOptions.DisableExternalTcpTls && !options.Application.Insecure)
+			Log.Warning("TLS is disabled for external TCP connections via the DisableExternalTcpTls option. " +
+			            "This is not recommended for production environments.");
+
 		var httpEndPoint = new IPEndPoint(options.Interface.NodeIp, options.Interface.NodePort);
 
 		var intTcp = disableInternalTcpTls

src/KurrentDB.Core/NodeTcpOptions.cs

@@ -7,5 +7,6 @@ namespace KurrentDB.Core;
 public class NodeTcpOptions {
 	public int NodeTcpPort { get; init; } = 1113;
 	public bool EnableExternalTcp { get; init; }
+	public bool DisableExternalTcpTls { get; init; }
 	public int? NodeTcpPortAdvertiseAs { get; init; }
 }

src/KurrentDB.TcpPlugin.Tests/EventStoreOptionsTests.cs

@@ -49,6 +49,19 @@ public void can_be_insecure() {
 		Assert.True(sut.Insecure);
 	}
 
+	[Fact]
+	public void disable_external_tcp_tls_defaults_to_false() {
+		var sut = CreateSut();
+		Assert.False(sut.TcpPlugin.DisableExternalTcpTls);
+	}
+
+	[Fact]
+	public void can_disable_external_tcp_tls() {
+		var sut = CreateSut(
+			($"{KurrentConfigurationKeys.Prefix}:TcpPlugin:DisableExternalTcpTls", "true"));
+		Assert.True(sut.TcpPlugin.DisableExternalTcpTls);
+	}
+
 	[Fact]
 	public void can_set_ip() {
 		var sut = CreateSut(

src/KurrentDB.TcpPlugin/tcp-plugin-example.json

@@ -2,6 +2,7 @@
   "KurrentDB": {
     "TcpPlugin": {
       "EnableExternalTcp": true,
+      "DisableExternalTcpTls": false,
       "NodeTcpPort": 1113,
       "NodeTcpPortAdvertiseAs": 1113,
       "NodeHeartbeatInterval": 2000,

src/KurrentDB.TcpPlugin/tcp-plugin-example.yaml

@@ -1,5 +1,6 @@
 TcpPlugin:
   EnableExternalTcp: true
+  DisableExternalTcpTls: false
   NodeTcpPort: 1113
   NodeTcpPortAdvertiseAs: 1113
   NodeHeartbeatInterval: 2000