clean project structure

deny.toml

@@ -0,0 +1,53 @@
+# cargo-deny configuration: https://embarkstudios.github.io/cargo-deny/
+# Run locally with `cargo deny check`.
+
+[graph]
+all-features = true
+
+[advisories]
+# A vulnerable, unmaintained or yanked dependency fails the build.
+version = 2
+yanked = "deny"
+ignore = [
+    # Unmaintained, but only a thin wrapper around `rustls-pki-types`, and pulled by
+    # `toasty-driver-postgresql`: it can only go away with a toasty release.
+    { id = "RUSTSEC-2025-0134", reason = "transitive dependency of toasty, no vulnerability" },
+]
+
+[licenses]
+version = 2
+# The workspace crates are not published, and have no license of their own.
+private = { ignore = true }
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "BSL-1.0",
+    "CC0-1.0",
+    "CDLA-Permissive-2.0",
+    "ISC",
+    "MIT",
+    "MIT-0",
+    "MPL-2.0",
+    "OpenSSL",
+    "Unicode-3.0",
+    "Zlib",
+]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+# `path` dependencies between the (unpublished) workspace crates carry no version.
+allow-wildcard-paths = true
+# TLS goes through rustls: linking libssl would be a regression of the image
+# (it would need `libssl` installed again).
+deny = [
+    { crate = "openssl-sys", reason = "TLS is rustls only, so that the image needs no libssl" },
+    { crate = "native-tls", reason = "TLS is rustls only, so that the image needs no libssl" },
+]
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]