core/server/auth/mtls_proxy.go at 1b095d50be53514f613c7d9a2ad93fb00b56fcf7

Archived

This repository has been archived on 2026-04-03. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

Jeffrey Smith 1b095d50be

CI/CD / detect-changes (pull_request) Successful in 4s

Details

CI/CD / test-frontend (pull_request) Successful in 6s

Details

CI/CD / test-go-pg (pull_request) Successful in 2m44s

Details

CI/CD / test-sqlite (pull_request) Successful in 2m50s

Details

CI/CD / build-and-deploy (pull_request) Successful in 1m4s

Details

Feat v0.6.7 native mTLS (#42 )

End-to-end mutual TLS without a reverse proxy. Go binary terminates
TLS itself via ListenAndServeTLS. TLS_MODE config (none/server/mtls)
is independent of AUTH_MODE.

- MTLSNativeProvider reads PeerCertificates directly (no header trust)
- Shared helpers extracted to mtls_helpers.go (ParseDN, FingerprintCert)
- MTLSProvider renamed to MTLSProxyProvider for clarity
- BuildPeerTLSConfig for future node-to-node mTLS
- switchboard-ca.sh: CA init, issue-node, issue-user (ECDSA P-256)
- 12 new tests (unit + TLS integration)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-31 18:18:24 +00:00

3.2 KiB

Raw Blame History

View Raw

3.2 KiB Raw Blame History

3.2 KiB

Raw Blame History