Documentation
¶
Index ¶
- func AgentTLSConfig(agentCertPEM, agentKeyPEM, caCertPEM []byte) (*tls.Config, error)
- func CreateCACertificate(pub ed25519.PublicKey, priv ed25519.PrivateKey) ([]byte, error)
- func CreateSignedCertificate(agentPub ed25519.PublicKey, caCert *x509.Certificate, ...) ([]byte, error)
- func DashboardTLSConfig(ca *CA) (*tls.Config, error)
- func DecodeCertPEM(certPEM []byte) (*x509.Certificate, error)
- func DecodePrivateKeyPEM(keyPEM []byte) (ed25519.PrivateKey, error)
- func Decrypt(ciphertext, key []byte) ([]byte, error)
- func DeriveKey(masterSecret, salt, info []byte) ([]byte, error)
- func EncodeCertPEM(certDER []byte) []byte
- func EncodePrivateKeyPEM(priv ed25519.PrivateKey) ([]byte, error)
- func Encrypt(plaintext, key []byte) ([]byte, error)
- func GenerateEd25519KeyPair() (ed25519.PublicKey, ed25519.PrivateKey, error)
- type CA
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AgentTLSConfig ¶
AgentTLSConfig creates a TLS config for the agent client. It presents the agent's client certificate and verifies the dashboard's server cert.
func CreateCACertificate ¶
CreateCACertificate creates a self-signed CA certificate with the given key pair.
func CreateSignedCertificate ¶
func CreateSignedCertificate( agentPub ed25519.PublicKey, caCert *x509.Certificate, caPriv ed25519.PrivateKey, commonName string, ) ([]byte, error)
CreateSignedCertificate creates a certificate signed by the CA for an agent.
func DashboardTLSConfig ¶
DashboardTLSConfig creates a TLS config for the dashboard server. It requires client certificates signed by the CA (mTLS). The server cert uses ECDSA P-256 for broad browser compatibility, while still being signed by the Ed25519 CA.
func DecodeCertPEM ¶
func DecodeCertPEM(certPEM []byte) (*x509.Certificate, error)
DecodeCertPEM decodes a PEM-encoded certificate.
func DecodePrivateKeyPEM ¶
func DecodePrivateKeyPEM(keyPEM []byte) (ed25519.PrivateKey, error)
DecodePrivateKeyPEM decodes a PEM-encoded PKCS8 private key.
func Decrypt ¶
Decrypt decrypts ciphertext that was encrypted with Encrypt. Expects the nonce prepended to the ciphertext.
func EncodeCertPEM ¶
EncodeCertPEM encodes a DER certificate to PEM format.
func EncodePrivateKeyPEM ¶
func EncodePrivateKeyPEM(priv ed25519.PrivateKey) ([]byte, error)
EncodePrivateKeyPEM encodes an Ed25519 private key to PKCS8 PEM format.
func Encrypt ¶
Encrypt encrypts plaintext using AES-256-GCM with a random nonce. The nonce is prepended to the ciphertext.
func GenerateEd25519KeyPair ¶
func GenerateEd25519KeyPair() (ed25519.PublicKey, ed25519.PrivateKey, error)
GenerateEd25519KeyPair generates a new Ed25519 key pair.
Types ¶
type CA ¶
type CA struct {
Certificate *x509.Certificate
CertPEM []byte
PrivateKey ed25519.PrivateKey
}
CA represents the certificate authority for the dashboard.
func LoadCAFromDir ¶
LoadCAFromDir loads a CA from a directory with an encrypted private key.
func (*CA) IssueAgentCertificate ¶
func (ca *CA) IssueAgentCertificate(agentPub ed25519.PublicKey, agentName string) (certPEM []byte, err error)
IssueAgentCertificate creates and signs a certificate for an agent.
func (*CA) VerifyAgentCertificate ¶
func (ca *CA) VerifyAgentCertificate(certPEM []byte) (*x509.Certificate, error)
VerifyAgentCertificate verifies that an agent certificate was signed by this CA.
Source Files