Upgrade iroh to 1.0.0-rc.0 across app, iroh-gateway, and infra

[drewr]

Summary

iroh released its first 1.0.0 release candidate (v1.0.0-rc.0, May 11 2026). This is a milestone API-stabilization release with intentional breaking changes. Three repos need work:

Repo	What changes
datum-cloud/iroh-gateway	Rust crate bump + API migration + Dockerfile MSRV bump
datum-cloud/app	Rust workspace crate bumps + API migration
datum-cloud/infra	n0computer/iroh-relay Docker image v0.97.0 → v1.0.0-rc.0

Note: datum-cloud/network-services-operator has no Rust iroh code — iroh resources are managed via Kubernetes manifests in datum-cloud/infra. This issue tracks the overall upgrade; child issues will be filed in each affected repo.

---

Dependency Map: Current → Target

Crate / Image	Used In	Current	Target
iroh	app, iroh-gateway	0.97.0	1.0.0-rc.0
iroh-base	app, iroh-gateway	0.97.0	0.98.0
iroh-relay (Rust crate)	app, iroh-gateway	0.97.0	0.98.0
iroh-metrics	app, iroh-gateway	0.38.3	verify latest
iroh-blobs	app/lib	0.99.0	verify latest
iroh-proxy-utils	app, iroh-gateway	0.1.0	verify latest on crates.io
iroh-services	app (0.12), iroh-gateway (0.13)	0.12/0.13	verify latest
iroh-n0des	app/n0des-local	0.10	verify latest
irpc-iroh	app/n0des-local	0.13	verify latest
n0computer/iroh-relay (Docker)	infra	v0.97.0	v1.0.0-rc.0 ✅ image published
Rust base image	iroh-gateway Dockerfile	rust:1.89-bookworm	rust:1.91-bookworm (MSRV bump)

---

Breaking API Changes (iroh 0.97 → 1.0.0-rc.0)

Old API	New API	Files likely affected
PathWatcher	Connection::paths() (snapshot) + Connection::path_events() → PathEventStream	app/lib/src/node.rs
Connection::to_info() → ConnectionInfo	Connection::weak_handle()	app/lib/src/node.rs
Incoming::local_ip	Incoming::local_addr (returns IncomingLocalAddr)	iroh-gateway/src/endpoint.rs
Source type	removed	node.rs, endpoint.rs
CertConfig::Reloading	AcmeConfig builder	endpoint.rs, node.rs (relay config)
iroh_relay::dns::* modules	now private	iroh-gateway/src/endpoint.rs
Exhaustive enum/struct patterns	many types now #[non_exhaustive] — add _ => arms	all pattern-match sites

MSRV increases from 1.87 → Rust 1.91.

---

Implementation Sequence

Step 0 — Pre-flight (blocking check before any edits)

Verify that these n0computer companion crates have published versions compatible with iroh 1.0.0-rc.0:

• iroh-proxy-utils (currently 0.1.0, from github.com/n0-computer/iroh-proxy-utils)
• iroh-services (currently 0.12/0.13)
• iroh-metrics latest version
• iroh-n0des, irpc-iroh latest versions

⚠️ If iroh-proxy-utils or iroh-services haven't published compatible releases, the Rust work in Steps 1–2 is blocked. A local [patch] override (already scaffolded but commented out in app/Cargo.toml) is the escape hatch.

Also verify relay.toml config format is unchanged for iroh-relay:v1.0.0-rc.0 (current config uses manual TLS cert paths, not ACME — likely fine, but confirm).

Step 1 — datum-cloud/iroh-gateway (do first — simpler, unblocks infra rollout)

• Bump Cargo.toml: iroh = "1.0.0-rc.0", iroh-base = "0.98", iroh-relay = "0.98", and companion crates to latest compatible
• Update Dockerfile: rust:1.89-bookworm → rust:1.91-bookworm
• Fix source breakages (compile-driven):
  • src/endpoint.rs: iroh_relay::dns::* import paths, Incoming::local_ip → local_addr
  • src/gateway.rs, src/gateway/metrics.rs, src/diagnostics.rs: verify API surface
• cargo build && cargo clippy && cargo test clean
• Cut a tagged release → triggers publish-docker.yml → FluxCD auto-rolls iroh-gateway in staging/edge

Tracked in: datum-cloud/iroh-gateway#TBD

Step 2 — datum-cloud/app

• Bump workspace Cargo.toml: iroh, iroh-base, iroh-relay, iroh-metrics, iroh-proxy-utils, iroh-services
• app/lib/Cargo.toml: update iroh-blobs
• app/n0des-local/Cargo.toml: update iroh-n0des, irpc-iroh
• Fix source breakages (most impact in app/lib/src/node.rs):
  • PathWatcher → Connection::paths() / Connection::path_events()
  • conn.to_info() → conn.weak_handle()
  • ACME relay config if used
  • Exhaustive pattern matches on now-#[non_exhaustive] types
• cargo build --workspace && cargo test --workspace clean
• Align iroh-services version between app (0.12) and iroh-gateway (0.13) during this upgrade

Tracked in: datum-cloud/app#TBD

Step 3 — datum-cloud/infra

• apps/network-services-operator/downstream/base/iroh-relay/deployment.yaml: v0.97.0 → v1.0.0-rc.0
• Review relay.toml ConfigMap for any format changes
• iroh-gateway image updates are handled automatically by FluxCD ImageUpdateAutomation once Step 1 releases

Tracked in: datum-cloud/infra#TBD

Step 4 — Verification

• CI green in all three repos
• iroh-relay pod starts cleanly with new image (check TLS handshake in logs)
• iroh-gateway DaemonSet rolls out on edge; confirm endpoint bind + DNS discovery in logs
• End-to-end tunnel connectivity smoke test in staging before edge
• Prometheus scrapes healthy on port 9090 for both iroh-relay and iroh-gateway

---

Risks

Risk	Mitigation
iroh-proxy-utils not yet updated for 1.0.0-rc.0	Local [patch] override (already scaffolded in app/Cargo.toml) or wait for n0computer release
relay.toml format changed	Test staging first; keep v0.97.0 manifest on a branch as rollback
#[non_exhaustive] compile failures in match blocks	cargo check first; fix exhaustive patterns systematically
MSRV bump breaks CI	Pin GitHub Actions Rust toolchain to ≥1.91
Version skew: iroh-services 0.12 (app) vs 0.13 (iroh-gateway)	Align to same version during this upgrade

[drewr]

Child issues filed:

• Upgrade iroh to 1.0.0-rc.0 iroh-gateway#11 — Rust crate upgrades + Dockerfile MSRV bump
• Upgrade iroh to 1.0.0-rc.0 app#161 — Rust workspace crate upgrades + API migration
• datum-cloud/infra#2563 — iroh-relay Docker image bump to v1.0.0-rc.0