Add TCP and TLS listening support to the cardano-rpc gRPC server

[carbolymer]

Context

The cardano-rpc gRPC server has so far only listened on a unix domain socket, requiring a proxy such as Envoy in front of it for any remote or non-local access (documented as the accepted architecture in ADR-018).
This PR adds native HTTP/2 listeners to the server, superseding that part of ADR-018.

The server can now listen on:

• a unix domain socket (existing behaviour, still the default), or
• HTTP/2 without TLS (h2c) on a configured IP address and port, or
• HTTP/2 over TLS on a configured IP address and port, with certificate, private key and optional chain certificate files.

The configuration surface for this (JSON keys RpcListenAddress/RpcListenPort/RpcTlsCertificateFile/RpcTlsPrivateKeyFile/RpcTlsChainCertificateFiles, and CLI flags --grpc-listen-address/--grpc-listen-port/--grpc-tls-certificate/--grpc-tls-private-key/--grpc-tls-chain-certificate) lives in cardano-node; this PR provides the underlying cardano-rpc library support it builds on.
The listen address defaults to 127.0.0.1 and accepts either an IPv4 or IPv6 address.
Configuring both a socket path and a listen port is rejected at configuration parsing time, since exactly one listener can be active.
TLS key logging follows grapesy's default behaviour, so it honours SSLKEYLOGFILE when set.

Breaking change

RpcConfigF's rpcSocketPath field is replaced by rpcEndpoint, of a new RpcEndpoint sum type:

data RpcEndpoint
  = RpcEndpointUnixSocket !SocketPath
  | RpcEndpointHttp !IP !PortNumber
  | RpcEndpointHttps !IP !PortNumber !RpcTlsFiles

RpcTlsFiles is a new record of File-typed certificate and key paths.
RpcEndpoint has a Pretty instance, and TraceRpc gained a new TraceRpcServerListening constructor, emitted when the server starts listening, that reports the active endpoint.

How to trust this PR

Two commits, one per listener type:

• Add TCP listening support to the gRPC server
• Add TLS listening support to the gRPC server

Reviewers can check cardano-rpc/src/Cardano/Rpc/Server/Config.hs for the RpcEndpoint/RpcTlsFiles types and defaults, and cardano-rpc/src/Cardano/Rpc/Server.hs for how each RpcEndpoint constructor maps onto grapesy's ServerConfig (InsecureConfig for h2c, SecureConfig for TLS).

Checklist

• Commit sequence broadly makes sense and commits have useful messages
• New tests are added if needed and existing tests are updated. See Running tests for more details
• Self-reviewed the diff
• Changelog fragment added in .changes/

[Copilot]

Pull request overview

This PR extends cardano-rpc’s server configuration to support listening on HTTP/2 endpoints (h2c and TLS) in addition to the existing unix-domain socket listener, and wires that into server startup and tracing. It introduces a breaking API change in the exposed Cardano.Rpc.Server.Config module by replacing rpcSocketPath with a new rpcEndpoint sum type.

Changes:

• Replace RpcConfigF’s unix-socket-only rpcSocketPath with rpcEndpoint :: RpcEndpoint (unix socket / h2c / h2 + TLS) and add TLS credential types.
• Update server startup to translate RpcEndpoint into the underlying grapesy ServerConfig, and emit a new lifecycle trace when starting.
• Add dependencies needed for IP/port representation (iproute, network) and add a changelog fragment marking the change as breaking.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
cardano-rpc/src/Cardano/Rpc/Server/Internal/Tracing.hs	Adds a new TraceRpc constructor and pretty-printing for server start/listen events.
cardano-rpc/src/Cardano/Rpc/Server/Config.hs	Introduces RpcEndpoint/TLS types and replaces rpcSocketPath with rpcEndpoint in the exposed config.
cardano-rpc/src/Cardano/Rpc/Server.hs	Maps RpcEndpoint to ServerConfig (unix/h2c/h2+TLS) and emits the new trace event on startup.
cardano-rpc/cardano-rpc.cabal	Adds iproute and network dependencies required by the new endpoint types.
.changes/20260828_cardano_rpc_grpc_tcp_listener.yml	Adds a changelog fragment describing the new endpoint support and marking it as breaking.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.