internal/

Package ca is lockhttp's local certificate authority: one per installation (P-256, pathlen 0, 90 days), trusted only inside lea's containers, and the 24-hour leaf certificates the signer issues for the gate's MITM.

Package decide is lockhttp's decision engine: one request (a CONNECT seen at the domain, or a decrypted or plain HTTP request) and the approved policy in, a verdict out: FREE, ASK or DENY.

Package gate is lockhttp's data plane: the HTTP(S) proxy every request of the agents goes through.

Package httpconsole is lockhttp's console backend for lockkit: the methods the gate calls (http.approve, policy.get) and the policy read from the console account's config file.

Package policy is lockhttp's policy: the profile the human writes in the console account's config file, in canonical form.

Package product declares lockhttp's names for lockkit and its refusal codes.

Package signer keeps the CA key away from the gate (decision D3): the signer process alone reads the key and issues leaf certificates over a Unix socket to the uids it allows; the gate asks it for each host it decrypts.

Package wire is the protocol between the gate (a lockkit client) and the console: the methods, their parameters and results, and the audit record both sides write.