feat(cli): support replication target TLS options

README.md

@@ -216,6 +216,20 @@ rc replicate add local/my-bucket \
   --priority 1 \
   --replicate delete,delete-marker,existing-objects
 
+# Allow self-signed or otherwise untrusted target certificates for this
+# replication target only.
+rc replicate add local/my-bucket \
+  --remote-bucket remote/target-bucket \
+  --replicate delete,delete-marker,existing-objects \
+  --insecure
+
+# Upload a local PEM CA bundle so RustFS can trust a private CA when it
+# connects to the remote replication target.
+rc replicate add local/my-bucket \
+  --remote-bucket remote/target-bucket \
+  --replicate delete,delete-marker,existing-objects \
+  --ca-cert ./private-ca.pem
+
 # List replication rules
 rc replicate list local/my-bucket
 

crates/cli/src/commands/mod.rs

@@ -818,6 +818,35 @@ mod tests {
         }
     }
 
+    #[test]
+    fn cli_accepts_bucket_replication_add_tls_flags() {
+        let cli = Cli::try_parse_from([
+            "rc",
+            "bucket",
+            "replication",
+            "add",
+            "local/my-bucket",
+            "--remote-bucket",
+            "backup/archive",
+            "--insecure",
+        ])
+        .expect("parse bucket replication add with insecure");
+
+        match cli.command {
+            Commands::Bucket(args) => match args.command {
+                bucket::BucketCommands::Replication(replicate::ReplicateArgs {
+                    command: replicate::ReplicateCommands::Add(arg),
+                }) => {
+                    assert_eq!(arg.path, "local/my-bucket");
+                    assert_eq!(arg.remote_bucket, "backup/archive");
+                    assert!(arg.insecure);
+                }
+                other => panic!("expected bucket replication add command, got {:?}", other),
+            },
+            other => panic!("expected bucket command, got {:?}", other),
+        }
+    }
+
     #[test]
     fn cli_accepts_bucket_remove_subcommand() {
         let cli = Cli::try_parse_from(["rc", "bucket", "remove", "local/my-bucket"])