clean project structure

Cargo.toml

@@ -6,14 +6,31 @@ members = [
 resolver = "3"
 
 [workspace.dependencies]
-reqwest = { version = "0.13", default-features = false, features = ["json", "native-tls", "stream"] }
+# TLS is pure Rust (rustls + ring): no libssl is needed at build or run time.
+# `rustls-no-provider` leaves the crypto provider to the binary, which installs
+# `ring` at startup (see `main`), so that a single provider is ever compiled in.
+reqwest = { version = "0.13", default-features = false, features = ["json", "rustls-no-provider", "stream"] }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
 tokio = { version = "1.53", features = ["full"] }
 tokio-stream = "0.1"
 tokio-util = "0.7"
 futures-util = "0.3"
 serde_json = "1.0"
 serde = { version = "1.0", features = ["derive"] }
-sentry = { version = "0.49", features = ["tower-axum-matched-path"] }
+# Sentry's default `transport` feature pulls `native-tls`; the same set of features
+# is spelled out here with rustls instead.
+sentry = { version = "0.49", default-features = false, features = [
+    "backtrace",
+    "contexts",
+    "debug-images",
+    "logs",
+    "metrics",
+    "panic",
+    "release-health",
+    "reqwest",
+    "rustls-no-provider",
+    "tower-axum-matched-path",
+] }
 sentry-anyhow = { version = "0.49", features = ["backtrace"] }
 dotenvy = "0.15"
 tower = "0.5"
@@ -31,6 +48,9 @@ metrics-exporter-prometheus = { version = "0.18", default-features = false, feat
 toasty = { version = "0.11", features = ["postgresql", "serde", "jiff"] }
 toasty-cli = "0.11"
 jiff = { version = "0.2", features = ["serde"] }
+tempfile = "3"
+bollard = "0.21"
+tar = "0.4"
 
 [profile.release]
 debug = 1