v0.28.1

src/backup/snapshot.rs

@@ -259,8 +259,16 @@ fn validate_snapshot_config(
 ) -> Result<()> {
     let cert_dir = snapshot_root.join("certs");
     for certificate in &envelope.config.tls.certificates {
+        if crate::tls::certificate_files_are_external(
+            &certificate.cert_file,
+            &certificate.key_file,
+        )? {
+            // External certificate material is intentionally outside the RustProxy
+            // data tree and is therefore referenced by configuration, not copied
+            // into a RustProxy backup. The operator must restore/mount it separately.
+            continue;
+        }
         for name in [&certificate.cert_file, &certificate.key_file] {
-            crate::tls::safe_name(name)?;
             let path = cert_dir.join(name);
             let meta = fs::symlink_metadata(&path).with_context(|| {
                 format!("configured certificate file changed during backup: {name}")