style: fix cargo fmt formatting issues

src/config/loader.rs

@@ -175,18 +175,11 @@ pub enum CertStatus {
     /// All certificates are valid and not expiring soon.
     Valid,
     /// Certificates are valid but expiring within the threshold.
-    ExpiringSoon {
+    ExpiringSoon { not_after: OffsetDateTime },
-        not_after: OffsetDateTime,
-    },
     /// One or more certificate files are missing.
-    Missing {
+    Missing { paths: Vec<PathBuf> },
-        paths: Vec<PathBuf>,
-    },
     /// A certificate file exists but cannot be parsed as valid PEM.
-    Corrupt {
+    Corrupt { path: PathBuf, error: String },
-        path: PathBuf,
-        error: String,
-    },
     /// A certificate has expired (not_after is in the past).
     Expired {
         path: PathBuf,
@@ -312,9 +305,7 @@ pub fn validate_certs(config: &AppConfig) -> Result<CertStatus> {
     let threshold = time::Duration::days(i64::from(threshold_days));
 
     // Check CA cert expiry
-    let ca_der = ca_certs
+    let ca_der = ca_certs.first().expect("ca_certs verified non-empty above");
-        .first()
-        .expect("ca_certs verified non-empty above");
     match x509_parser::parse_x509_certificate(ca_der.as_ref()) {
         Ok((_, ca_cert)) => {
             let ca_not_after = ca_cert.validity().not_after.to_datetime();
@@ -337,24 +328,25 @@ pub fn validate_certs(config: &AppConfig) -> Result<CertStatus> {
     let server_der = server_certs
         .first()
         .expect("server_certs verified non-empty above");
-    let server_not_after: OffsetDateTime = match x509_parser::parse_x509_certificate(server_der.as_ref()) {
+    let server_not_after: OffsetDateTime =
-        Ok((_, cert)) => {
+        match x509_parser::parse_x509_certificate(server_der.as_ref()) {
-            let not_after = cert.validity().not_after.to_datetime();
+            Ok((_, cert)) => {
-            if not_after < now {
+                let not_after = cert.validity().not_after.to_datetime();
-                return Ok(CertStatus::Expired {
+                if not_after < now {
-                    path: cert_path.clone(),
+                    return Ok(CertStatus::Expired {
-                    not_after,
+                        path: cert_path.clone(),
-                });
+                        not_after,
+                    });
+                }
+                not_after
             }
-            not_after
+            Err(e) => {
-        }
+                return Ok(CertStatus::Corrupt {
-        Err(e) => {
+                    path: cert_path,
-            return Ok(CertStatus::Corrupt {
+                    error: format!("Failed to parse server certificate DER: {}", e),
-                path: cert_path,
+                })
-                error: format!("Failed to parse server certificate DER: {}", e),
+            }
-            })
+        };
-        }
-    };
 
     // Check if expiring soon
     let expires_soon = server_not_after < now + threshold;
@@ -613,7 +605,10 @@ cert_renewal_threshold_days: 14
         assert!(config.effective_manager_url().is_none());
 
         config.manager_url = Some("https://manager.example.com".to_string());
-        assert_eq!(config.effective_manager_url(), Some("https://manager.example.com"));
+        assert_eq!(
+            config.effective_manager_url(),
+            Some("https://manager.example.com")
+        );
 
         config.manager_url = Some("".to_string());
         assert!(config.effective_manager_url().is_none());

src/config/mod.rs

@@ -6,6 +6,6 @@
 //! - Auto-reload on file change via notify watcher
 
 pub mod loader;
-pub use loader::{AppConfig, CertStatus, EnrollmentConfig, validate_certs};
+pub use loader::{validate_certs, AppConfig, CertStatus, EnrollmentConfig};
 pub mod validator;
 pub mod watcher;

src/main.rs

@@ -150,7 +150,9 @@ async fn main() -> Result<()> {
 
         match enroll::run_enrollment(&manager_url, &mut config, &args.config).await {
             Ok(()) => {
-                info!("Certificate renewal complete. Start service: systemctl start linux-patch-api");
+                info!(
+                    "Certificate renewal complete. Start service: systemctl start linux-patch-api"
+                );
                 std::process::exit(ExitCode::Clean as i32);
             }
             Err(e) => {
@@ -208,7 +210,8 @@ async fn main() -> Result<()> {
                             status,
                             manager_url
                         );
-                        match enroll::run_enrollment(&manager_url, &mut config, &args.config).await {
+                        match enroll::run_enrollment(&manager_url, &mut config, &args.config).await
+                        {
                             Ok(()) => {
                                 info!("Auto-enrollment complete - continuing to server startup");
                                 // Re-load config to pick up any changes from enrollment
@@ -374,9 +377,9 @@ async fn main() -> Result<()> {
                     .set_reuse_address(true)
                     .map_err(|e| anyhow::anyhow!("Failed to set SO_REUSEADDR: {}", e))?;
 
-                let bind_addr: std::net::SocketAddr = bind_address
+                let bind_addr: std::net::SocketAddr = bind_address.parse().map_err(|e| {
-                    .parse()
+                    anyhow::anyhow!("Invalid bind address '{}': {}", bind_address, e)
-                    .map_err(|e| anyhow::anyhow!("Invalid bind address '{}': {}", bind_address, e))?;
+                })?;
 
                 socket
                     .bind(&socket2::SockAddr::from(bind_addr))