Documentation
¶
Overview ¶
Package caimport validates and persists an existing Nebula certificate authority without ever storing its plaintext signing key.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrInvalidMaterial = errors.New("invalid CA material") ErrUnsupportedCurve = errors.New("unsupported CA curve") ErrInvalidValidity = errors.New("CA certificate is not currently valid") ErrKeyMismatch = errors.New("CA private key does not match certificate") ErrDuplicateCA = errors.New("CA already imported") ErrKDFLimits = errors.New("private key KDF exceeds import limits") ErrDecryptBusy = errors.New("another private key decrypt is in progress") ErrInputTooLarge = errors.New("CA import input is too large") )
Functions ¶
This section is empty.
Types ¶
type Importer ¶
Importer is the shared CA import contract consumed by API and Web. A single Service instance should be shared by all server entrypoints so its Argon2 decrypt slot is process-wide.
type Limits ¶
type Limits struct {
MaxCertificateBytes int
MaxPrivateKeyBytes int
MaxArgon2MemoryKiB uint32
MaxArgon2Iterations uint32
MaxArgon2Parallelism uint8
}
Limits bounds uploaded material and the work accepted from an encrypted Nebula signing key. A zero-valued field is replaced with its safe default.
func DefaultLimits ¶
func DefaultLimits() Limits
DefaultLimits returns the production CA import limits.
type Request ¶
type Request struct {
Name string
OwnerOperatorID string
CertificatePEM []byte
PrivateKeyPEM []byte
Passphrase []byte
}
Request contains one existing CA certificate and its signing key. Import consumes and zeroizes PrivateKeyPEM and Passphrase before returning.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service implements the shared CA import path used by HTTP and CLI callers.
func NewService ¶
NewService creates a CA import service. Encrypted key decryption is globally serialized per service instance to bound Argon2 memory use.
Source Files