From bd9ea76d6a287411f320f2c7fdee77211dc4cfa5 Mon Sep 17 00:00:00 2001
From: Paul Payne <paul@payne.io>
Date: Tue, 30 Jun 2026 21:38:24 -0700
Subject: [PATCH] Remove stale TLSMode/HttpPublic exposure vestige
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TLSMode (off/internal/letsencrypt) was only referenced by HttpPublic.tls,
and HttpPublic (the expose.http.public field, still carrying a path_prefix
and a tls defaulting to the deleted internal mode) was referenced by no
config, generator, deploy code, or test — a leftover from the pre-proxy:bool
exposure design. Drop the enum, the model, the public field, and both CLI
shim re-exports.
---
 cli/src/castle_cli/manifest.py   |  2 --
 core/src/castle_core/manifest.py | 13 -------------
 2 files changed, 15 deletions(-)

diff --git a/cli/src/castle_cli/manifest.py b/cli/src/castle_cli/manifest.py
index 194422b..ae3c3cb 100644
--- a/cli/src/castle_cli/manifest.py
+++ b/cli/src/castle_cli/manifest.py
@@ -10,7 +10,6 @@ from castle_core.manifest import (  # noqa: F401 — explicit re-exports for typ
     ExposeSpec,
     HttpExposeSpec,
     HttpInternal,
-    HttpPublic,
     JobSpec,
     ManageSpec,
     ProgramSpec,
@@ -26,5 +25,4 @@ from castle_core.manifest import (  # noqa: F401 — explicit re-exports for typ
     RunSpec,
     ServiceSpec,
     SystemdSpec,
-    TLSMode,
 )
diff --git a/core/src/castle_core/manifest.py b/core/src/castle_core/manifest.py
index 7e08098..71c39f0 100644
--- a/core/src/castle_core/manifest.py
+++ b/core/src/castle_core/manifest.py
@@ -16,12 +16,6 @@ class RestartPolicy(str, Enum):
     ALWAYS = "always"
 
 
-class TLSMode(str, Enum):
-    OFF = "off"
-    INTERNAL = "internal"
-    LETSENCRYPT = "letsencrypt"
-
-
 # ---------------------
 # Run specs (discriminated union)
 # ---------------------
@@ -129,15 +123,8 @@ class HttpInternal(BaseModel):
     unix_socket: str | None = None
 
 
-class HttpPublic(BaseModel):
-    hostnames: list[str] = Field(min_length=1)
-    path_prefix: str = "/"
-    tls: TLSMode = TLSMode.INTERNAL
-
-
 class HttpExposeSpec(BaseModel):
     internal: HttpInternal
-    public: HttpPublic | None = None
     health_path: str | None = None