internal/

Package cftunnel renders a cloudflared tunnel config.yml from a tunnel profile.

Package ddns publishes a node's public IP to DNS when it changes.

Package georouting renders a geo-aware CoreDNS zone that answers one apex hostname with the nearest healthy node by client location.

Package groups resolves fleet group membership.

Package logstore is the dedicated, bounded, append-only persistence layer for ingested node log lines.

Package netguard implements the design-13 security-group firewall plane.

Package notify delivers short operational messages (SSH login alerts, audit denials, task failures) to one or more user-configured channels.

Package oidc wraps go-oidc + x/oauth2 into the small surface the server needs for SSO login: build an auth-code+PKCE URL, then exchange the code and verify the returned ID token.

Package proxycore renders reviewed proxy-core artifacts from server-owned intent models.

Package ratelimit provides a small, dependency-free per-key token-bucket rate limiter suitable for guarding authentication and agent endpoints.

Package secret provides authenticated envelope encryption for sensitive values that the server persists at rest (TOTP secrets, Cloudflare API tokens, notification credentials, ...).

Package selfdns renders the reviewable artifacts for Lattice-owned DNS deployment intent.

Package websocketx adapts a gorilla *websocket.Conn into an io.ReadWriteCloser so two terminal WebSocket legs can be spliced with a plain io.Copy pair.

Package wireguard generates per-node WireGuard configuration for a cluster mesh.