server/src/healthcheck.rs (2)

129-150: LDAPS: fix IPv6 connect and robust SNI for IP addresses

• Connecting via format!("{address}:{port}") breaks for IPv6. Use tuple form.
• rustls::ServerName::try_from(address) may not accept IPs as strings. Prefer IpAddr when address is an IP.

-#[instrument(skip_all, level = "info", err, fields(address = %address, port = %ldaps_options.port))]
+#[instrument(skip_all, level = "info", err, fields(address = %address, port = %ldaps_options.port))]
 pub async fn check_ldaps(address: &str, ldaps_options: &LdapsOptions) -> Result<()> {
@@
-    let url = format!("{address}:{}", ldaps_options.port);
+    // Use tuple for IPv4/IPv6-safe connect
@@
-            .connect(
-                rustls::ServerName::try_from(address).context("while parsing the server name")?,
-                TcpStream::connect(&url)
+            .connect(
+                {
+                    if let Ok(ip) = address.parse::<std::net::IpAddr>() {
+                        rustls::ServerName::IpAddress(ip)
+                    } else {
+                        rustls::ServerName::try_from(address)
+                            .context("while parsing the server name")?
+                    }
+                },
+                TcpStream::connect((address, ldaps_options.port))
                     .await
                     .context("while connecting TCP")?,
             )

---

153-159: HTTP health URL fails for IPv6 literals

http://{address}:{port}/health needs brackets for IPv6. Build the URL accordingly.

-pub async fn check_api(address: &str, port: u16) -> Result<()> {
-    reqwest::get(format!("http://{address}:{port}/health"))
+pub async fn check_api(address: &str, port: u16) -> Result<()> {
+    let url = if address.parse::<std::net::IpAddr>().map(|ip| ip.is_ipv6()).unwrap_or(false) {
+        format!("http://[{address}]:{port}/health")
+    } else {
+        format!("http://{address}:{port}/health")
+    };
+    reqwest::get(url)
         .await?
         .error_for_status()?;
     info!("Success");
     Ok(())
 }

server/src/healthcheck.rs (1)

140-150: ServerName should not use bracketed IPv6.

Line 145 constructs ServerName from safe_address which includes brackets for IPv6 (e.g., [2001:db8::42]). TLS SNI expects a hostname or raw IP address, not URL-formatted brackets. This likely causes TLS connection failures for IPv6 addresses.

Apply this diff:

-    let safe_address = get_ipv6_safe_address(address);
-    let url = format!("{}:{}", safe_address, ldaps_options.port);
     check_ldap_endpoint(
         tls_connector
             .connect(
-                rustls::ServerName::try_from(safe_address.as_str())
+                rustls::ServerName::try_from(address)
                     .context("while parsing the server name")?,
-                TcpStream::connect(&url)
+                TcpStream::connect((address, ldaps_options.port))
                     .await
                     .context("while connecting TCP")?,
             )

This also switches TCP connect to tuple form (per the check_ldap discussion).

server/src/healthcheck.rs (1)

140-149: Simplify TCP connect and support IPv6 in ServerName

• Use TcpStream::connect((address, ldaps_options.port)) instead of get_ipv6_url_safe_address + URL formatting.
• Parse address as IpAddr and construct ServerName::IpAddress(ip) for literals, falling back to DNS names via ServerName::try_from.

Example diff:

-    let safe_address = get_ipv6_url_safe_address(address);
-    let url = format!("{}:{}", safe_address, ldaps_options.port);
-    check_ldap_endpoint(
-        tls_connector
-            .connect(
-                rustls::ServerName::try_from(address)
-                    .context("while parsing the server name")?,
-                TcpStream::connect(&url)
+    let server_name = match address.parse::<std::net::IpAddr>() {
+        Ok(ip) => rustls::ServerName::IpAddress(ip),
+        Err(_) => rustls::ServerName::try_from(address)
+            .context("while parsing the server name")?,
+    };
+    check_ldap_endpoint(
+        tls_connector
+            .connect(
+                server_name,
+                TcpStream::connect((address, ldaps_options.port))
     )
     .await
     .context("while connecting TLS")?,
 )
 .await