api

Jul 16, 2026

Changes in this version

type Server

+ func (s *Server) WithCAImportLimits(limits caimport.Limits)

+ func (s *Server) WithCAImporter(importer caimport.Importer)

+ func (s *Server) WithSecretIngressPolicy(policy secretingress.Policy)

Jun 23, 2026 GO-2026-5985

  GO-2026-5985: Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` in github.com/forgekeep/nebula-mesh

Jun 15, 2026 GO-2026-5985 +1 more

  GO-2026-5985: Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` in github.com/forgekeep/nebula-mesh

  GO-2026-5986: nebula-mesh: Certificate revocation is never enforced at the mesh in github.com/forgekeep/nebula-mesh

Jun 13, 2026 GO-2026-5985 +1 more

  GO-2026-5985: Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` in github.com/forgekeep/nebula-mesh

  GO-2026-5986: nebula-mesh: Certificate revocation is never enforced at the mesh in github.com/forgekeep/nebula-mesh

Changes in this version

+ type EventEmitter interface

+ Emit func(eventType string, data map[string]any)

type Server

+ func (s *Server) WithEventEmitter(e EventEmitter)

Jun 13, 2026 GO-2026-5986

  GO-2026-5986: nebula-mesh: Certificate revocation is never enforced at the mesh in github.com/forgekeep/nebula-mesh

Jun 13, 2026 GO-2026-5986 +2 more

  GO-2026-5986: nebula-mesh: Certificate revocation is never enforced at the mesh in github.com/forgekeep/nebula-mesh

  GO-2026-5987: Insecure enrollment token TTL in nebula-mesh in github.com/forgekeep/nebula-mesh

  GO-2026-5989: Unauthenticated OIDC login in nebula-mesh allows unbounded memory allocation in github.com/forgekeep/nebula-mesh

Jun 4, 2026 GO-2026-5986

  GO-2026-5986: nebula-mesh: Certificate revocation is never enforced at the mesh in github.com/forgekeep/nebula-mesh

Jun 2, 2026 GO-2026-5984 +2 more

  GO-2026-5984: nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh

  GO-2026-5986: nebula-mesh: Certificate revocation is never enforced at the mesh in github.com/forgekeep/nebula-mesh

  GO-2026-5991: nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh

Changes in this version

type Server

+ func (s *Server) WithClock(fn func() time.Time)

+ func (s *Server) WithMetricsRequireAuth(require bool)

May 26, 2026 GO-2026-5255 +4 more

  GO-2026-5255: nebula-mesh: Decrypted CA private key persists in heap after signing in github.com/forgekeep/nebula-mesh

  GO-2026-5950: nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate in github.com/forgekeep/nebula-mesh

  GO-2026-5984: nebula-mesh: CA private key not zeroized on web mobile-bundle error paths in github.com/forgekeep/nebula-mesh

  GO-2026-5986: nebula-mesh: Certificate revocation is never enforced at the mesh in github.com/forgekeep/nebula-mesh

  GO-2026-5991: nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh

Changes in this version

+ const LoginFactorOIDC

+ const LoginFactorPassword

+ const LoginFactorRecovery

+ const LoginFactorTOTP

+ const ResultDenied

+ const ResultError

+ const ResultOK

+ const SigningPublicKeyPEMType

+ var ErrBadSigningPEM = errors.New("bad signing public key PEM")

+ func ActorName(ctx context.Context) string

+ func ActorOf(ctx context.Context) *models.Operator

+ func IsHostIPValidationError(err error) bool

+ type HostSeenEmitter func(hostID string, lastSeen time.Time, networkID string)

+ type Server struct

+ func NewServer(s store.Store, logger *slog.Logger) *Server

+ func (s *Server) RecordLogin(result, factor string)

+ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ func (s *Server) WithCAResolver(r *pki.CAResolver)

+ func (s *Server) WithDefaultCAID(id string)

+ func (s *Server) WithEnrollmentTokenTTL(ttl time.Duration)

+ func (s *Server) WithHostSeenEmitter(emit HostSeenEmitter)

+ func (s *Server) WithMaster(m *keystore.Master)

+ func (s *Server) WithMetricsEnabled(enabled bool)

+ func (s *Server) WithPasswordPolicy(p auth.Policy)

+ func (s *Server) WithRateLimiter(l *ratelimit.Limiter)