[ChristianPavilonis]

Summary

• Expose the pinned EdgeZero local GeoLite provider through Trusted Server's native boot profile, with an explicit default-off geo-maxmind feature.
• Reuse checked reader-IP resolution and trusted-proxy configuration. No CloudFront/ALB dependency, Fly-specific parser, downloader, or remote lookup.
• Add Docker feature forwarding, startup coverage, CI feature combinations, and operator guidance.

This is stacked on rc/edgezero-431-demo, the release candidate in #1424, to keep the diff limited to MaxMind support. EdgeZero remains pinned to fda87556f5aab160711eb5244c1d1065a6bb48d6.

Changes

File	Change
Axum adapter Cargo.toml and Cargo.lock	Forward the optional provider feature and resolve its dependencies
crates/trusted-server-adapter-axum/src/native_geo.rs	Parse maxmind, the database path, and explicit reader-IP expectation
Adapter startup tests and synthetic GeoIP fixtures	Cover feature availability, startup rejection, checked proxy chains, spoof rejection, IPv4/IPv6 and snapshot lifetime; add an ignored operator-dataset test
Dockerfile and .github/workflows/test.yml	Accept the build feature and test MaxMind-only and combined-provider configurations
docs/guide/native-rc-demo.md and native-rc-validation.md	Document configuration, dataset lifecycle, Fly caveats and executed checks

Related issues

No Trusted Server issue is linked yet. Upstream follow-up: IABTechLab/edgezero#438. This PR does not close it.

Spec

No separate agent-reviewed feature spec is linked yet. The implementation and operator contract are documented in docs/guide/native-rc-demo.md; this is not a substitute for the required spec. Keep this PR in draft pending the issue/spec requirements and review readiness.

Test plan

The following checks passed on the implementation before this commit. Before publishing, the current Rust/build inputs and synthetic fixtures were verified against the recorded SHA-256 manifest; no tested inputs changed. Tests were not rerun solely for committing.

• Default Axum suite: 96 passed, 2 ignored
• Axum with geo-maxmind: 101 passed, 3 ignored
• Axum with geo-maxmind,geo-cloudfront: 103 passed, 3 ignored
• Combined-provider Clippy with all targets and -D warnings, plus rustdoc
• Rust formatting, changed Markdown formatting, and git diff --check
• Opt-in production-binary test with an operator-provided GeoLite snapshot: country-only IPv4, GB/ENG and country-only IPv6
• Release Docker build and default-Off container smoke
• Read-only non-root release container with the operator snapshot: checked IPv4/IPv6 proxy chains, spoof rejection, unavailable Geo without forwarding, auth-error headers and SIGTERM drain
• Dependency isolation: default graph has no MaxMind or AWS SDK; MaxMind selection does not add AWS SDK dependencies
• Full cross-adapter CI, WASM suites and arm64 build
• Live Fly deployment and ingress peer/chain verification

Detailed results and remaining limits are in docs/guide/native-rc-validation.md. The operator dataset stayed outside the repository and Docker build context. Local release readiness was about 2.6 seconds; peak startup RSS was not measured. Upstream's documented unused-metadata validation limitation remains.

Checklist

• Feature issue and spec with two or more agent-review rounds linked
• New code has tests
• No production dataset, secrets or credentials committed
• Default-Off and existing CloudFront behavior retained
• Operator-owned dataset download/update and proxy trust configuration documented