fix(relay): enable Redis TLS for rediss:// (ElastiCache)

Cargo.toml

@@ -52,7 +52,7 @@ sqlx = { version = "0.9", features = [
 ] }
 
 # Redis
-redis        = { version = "1.0", features = ["tokio-comp", "connection-manager"] }
+redis        = { version = "1.0", features = ["tokio-comp", "connection-manager", "tokio-rustls-comp"] }
 deadpool-redis = { version = "0.23", features = ["rt_tokio_1"] }
 
 # Nostr

crates/buzz-admin/Cargo.toml

@@ -26,6 +26,11 @@ serde_json = { workspace = true }
 anyhow = { workspace = true }
 hex = { workspace = true }
 deadpool-redis = { workspace = true }
+# Redis TLS (rediss://, e.g. ElastiCache) uses rustls, which needs a process
+# CryptoProvider installed at startup. The workspace redis TLS feature compiles
+# both aws-lc-rs and ring in transitively, so rustls can't auto-select one — we
+# install ring explicitly in main(). Mirrors buzz-relay's setup.
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
 tracing = { workspace = true }
 sqlx = { workspace = true }
 url = { workspace = true }

crates/buzz-admin/src/main.rs

@@ -92,6 +92,14 @@ enum Command {
 
 #[tokio::main]
 async fn main() {
+    // Install the ring CryptoProvider for rustls. The workspace redis TLS
+    // feature compiles both aws-lc-rs and ring in transitively, so rustls can't
+    // auto-select a provider and would panic on the first rediss:// (ElastiCache)
+    // Redis TLS connection without this. Mirrors buzz-relay's main().
+    rustls::crypto::ring::default_provider()
+        .install_default()
+        .expect("failed to install rustls crypto provider");
+
     let cli = Cli::parse();
 
     let code = match run(cli).await {

crates/buzz-relay/Cargo.toml

@@ -44,6 +44,11 @@ dashmap = { workspace = true }
 futures-util = { workspace = true }
 deadpool-redis = { workspace = true }
 redis = { workspace = true }
+# Redis TLS (rediss://, e.g. ElastiCache) uses rustls, which needs a process
+# CryptoProvider installed at startup. Both aws-lc-rs and ring are compiled in
+# transitively, so rustls can't auto-select one — we install ring explicitly in
+# main(). Mirrors buzz-acp's rustls setup for wss://.
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
 sqlx = { workspace = true }
 base64 = "0.22"
 buzz-sdk = { workspace = true }

crates/buzz-relay/src/main.rs

@@ -27,6 +27,14 @@ fn buzz_auto_migrate_enabled(value: Option<&str>) -> bool {
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
+    // Install the ring CryptoProvider for rustls. Required before any rustls
+    // TLS connection (rediss:// to ElastiCache, wss://, S3 over TLS): both
+    // aws-lc-rs and ring are compiled in transitively, so rustls can't
+    // auto-select a provider and would panic at first use without this.
+    rustls::crypto::ring::default_provider()
+        .install_default()
+        .expect("failed to install rustls crypto provider");
+
     // JSON-only structured logs — simple, machine-parseable, CAKE-compatible.
     tracing_subscriber::registry()
         .with(fmt::layer().json().flatten_event(true))