switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

Add v0.6.7 native mTLS to roadmap + design doc
All checks were successful
CI/CD / detect-changes (pull_request) Successful in 20s
Details
CI/CD / test-frontend (pull_request) Successful in 26s
Details
CI/CD / test-go-pg (pull_request) Successful in 2m43s
Details
CI/CD / test-sqlite (pull_request) Successful in 2m56s
Details
CI/CD / build-and-deploy (pull_request) Successful in 1m51s
Details

Browse Source 
v0.6.7 section: TLS_MODE config, MTLSNativeProvider (no header trust),
node-to-node mTLS, armature-ca.sh provisioning tooling, unit +
integration test plan. No schema changes — reuses auth_source/external_id.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Jeffrey Smith
2026-03-31 16:33:50 +00:00
parent 2adaabe5fa
commit f6a7f11db5
2 changed files with 320 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
ROADMAP.md
View File

@@ -125,6 +125,20 @@ Most complex sub-version. Lifts block rendering to a kernel SDK primitive so all
| Surface alias decision | ✅ | Migrated SDK + ICD runner to `/admin/packages/`; aliases removed from main.go. |
| `CONTRIBUTING.md` + tutorial | ✅ | CONTRIBUTING.md at repo root + docs/TUTORIAL-FIRST-EXTENSION.md walkthrough. |
### v0.6.7 — Native mTLS
End-to-end mutual TLS without a reverse proxy. Targets systemd+podman deployments where every connection (client→server, node→node) is mTLS. Design: `docs/DESIGN-native-mtls.md`.
| Step | Status | Description |
|------|--------|-------------|
| `TLS_MODE` config | ☐ | Three values: `none` (default, plain HTTP) · `server` (TLS, no client cert) · `mtls` (mutual TLS, client cert required). Independent of `AUTH_MODE`. |
| TLS server mode | ☐ | Go binary calls `ListenAndServeTLS` directly. `TLS_CERT`, `TLS_KEY`, `TLS_CA` path config. TLS 1.3 minimum, no fallback. `server/config/tls.go` loader + validation. |
| `MTLSNativeProvider` | ☐ | Reads `r.TLS.PeerCertificates[0]` — no header trust. `Subject.CommonName` → username. `sha256(Raw)` → `external_id`. Auto-provisions `auth_source=mtls`. Rename existing `mtls.go` → `mtls_proxy.go`. Extract shared helpers to `mtls_helpers.go`. |
| Node-to-node mTLS | ☐ | Cluster heartbeat over mTLS. Node presents its cert when dialing peers. Single cert per node (ServerAuth + ClientAuth EKU). SAN includes hostname + IP. Peer verification against cluster CA pool. |
| `armature-ca.sh` | ☐ | Shell wrapper around openssl. Three commands: `init` (CA keypair) · `issue-node --name <n> --san <addrs>` (365d) · `issue-user --cn <name>` (90d). All output PEM. |
| Unit tests | ☐ | Ephemeral CA via `crypto/x509`. Fabricated `PeerCertificates`. Valid cert → user provisioned · no TLS → `ErrNoCert` · empty certs → `ErrNoCert` · same fingerprint → idempotent. |
| Integration tests | ☐ | Real TLS listener on localhost. No cert / wrong CA / expired → TLS handshake rejected. Valid cert → 200, user created. Node-to-node: two in-process servers, distinct certs, same CA. Wrong-CA node rejected. |
### v0.6.6 — Final Hardening
Final pass before public release. Security, correctness, and developer experience.