sequenceDiagram
    participant Main as main()
    participant Config as Configuration
    participant Rustls as rustls::crypto::ring
    participant HTTP as HTTP Server
    participant GRPC as gRPC Server
    participant TLS as TLS Module

    Main->>Config: Load config from CLI/env
    Config-->>Main: Return cfg

    Note over Main,Rustls: NEW: Install CryptoProvider early
    alt TLS enabled
        Main->>Rustls: default_provider().install_default()
        Rustls-->>Main: Provider installed
    end

    Main->>Main: Initialize backend jobs
    Main->>Main: Initialize search service
    
    alt HTTP TLS enabled
        Main->>HTTP: Start HTTP server
        HTTP->>TLS: http_tls_config()
        TLS->>Rustls: ServerConfig::builder()
        Note over Rustls: Uses already-installed provider
        Rustls-->>TLS: TLS config
        TLS-->>HTTP: ServerConfig
        HTTP->>HTTP: bind_rustls_0_23()
    else HTTP non-TLS
        Main->>HTTP: Start HTTP server
        HTTP->>HTTP: bind()
    end

    alt gRPC TLS enabled
        Main->>GRPC: Start gRPC server
        GRPC->>GRPC: Load cert/key
        GRPC->>GRPC: tls_config()
        Note over GRPC: Uses tonic TLS (also uses rustls internally)
    end