Documentation
¶
Index ¶
- Constants
- func Enroll(ctx context.Context, ...) error
- func IsRekey(err error) bool
- func IsRevoked(err error) bool
- func ReadCertFingerprint(dataDir string) (string, error)
- func Reenroll(ctx context.Context, ...) error
- type EnrollResponse
- type Poller
- type PollerConfig
- type RekeyError
- type RevocationError
- type UpdatesResponse
Constants ¶
const SigningPrivateKeyPEMType = "NEBULA ED25519 PRIVATE KEY"
SigningPrivateKeyPEMType is the PEM block type used to persist the Ed25519 signing private key on disk (mode 0600). The block bytes contain the full 64-byte ed25519.PrivateKey (seed + public-key half), so SignerFromDisk can reconstruct the keypair without re-deriving from a seed.
const SigningPublicKeyPEMType = "NEBULA ED25519 PUBLIC KEY"
SigningPublicKeyPEMType is the PEM block type used by the agent for its Ed25519 poll-signature public key (ADR 0004 §7.1).
Variables ¶
This section is empty.
Functions ¶
func Enroll ¶
func Enroll(ctx context.Context, serverURL, token, dataDir, signingKeyPath, nebulaConfigPath string) error
Enroll performs the enrollment flow: generates keypair, sends public key to the server with the token, saves received cert (and CA cert) to dataDir, writes the rendered Nebula config to nebulaConfigPath, and writes the Ed25519 signing private key to signingKeyPath.
nebulaConfigPath is the path Nebula actually reads its config from; an empty value falls back to dataDir/config.yml for backward compatibility. Honoring it keeps the initial enroll write and the running daemon's rewrites pointed at the same file (#224); the daemon resolves the same path in poller.go.
signingKeyPath is intentionally separate from dataDir — Nebula's data dir holds Nebula-owned secrets (host.key / host.crt / ca.crt / config.yml), while the agent's PoP signing key (ADR 0004) is the agent's concern and lives next to agent.yml (default /etc/nebula-agent/host.signing.key). The parent directory of signingKeyPath is created with mode 0o755 if missing.
func ReadCertFingerprint ¶
ReadCertFingerprint reads the host certificate from dataDir and returns its fingerprint.
func Reenroll ¶
func Reenroll(ctx context.Context, serverURL, token, dataDir, signingKeyPath, nebulaConfigPath string) error
Reenroll runs the enrollment flow against an existing data directory. It is a thin alias of Enroll: the server side decides whether the token is fresh (rekey) or bound to an unenrolled host (initial enroll), so the agent path is identical. Exposed separately so the cmd-side rekey loop reads cleanly.
Types ¶
type EnrollResponse ¶
type EnrollResponse struct {
CertificatePEM string `json:"certificate_pem"`
CACertificatePEM string `json:"ca_certificate_pem"`
ConfigYAML string `json:"config_yaml"`
}
EnrollResponse is the response from the enrollment endpoint.
type Poller ¶
type Poller struct {
// contains filtered or unexported fields
}
Poller periodically checks the management server for updates.
func NewPoller ¶
func NewPoller(cfg PollerConfig, logger *slog.Logger) (*Poller, error)
NewPoller creates a new Poller and loads the Ed25519 signing key needed to sign poll requests (ADR 0004 §7.1). If the key cannot be loaded the returned error is propagated to the caller; the agent must re-enroll before polling can resume.
func (*Poller) PollOnce ¶
PollOnce performs a single signed poll iteration and returns. The enroll subcommand uses it to verify the freshly enrolled host can reach the server before exiting. Errors are informational — callers decide whether to gate behavior on them; the daemon's Run() never invokes PollOnce.
type PollerConfig ¶
type PollerConfig struct {
ServerURL string
Fingerprint string
DataDir string
SigningKeyPath string
Interval time.Duration
PIDFile string
// NebulaConfigPath is where the rendered Nebula config.yml is written.
// Empty falls back to DataDir/config.yml. Honors agent.yml's
// nebula_config_path so the daemon writes the config to the file Nebula
// actually reads, not always DataDir/config.yml (#224).
NebulaConfigPath string
// HTTPTimeout bounds a single poll request. Zero or negative falls back
// to defaultAgentHTTPTimeout.
HTTPTimeout time.Duration
}
PollerConfig holds configuration for the Poller.
type RekeyError ¶
type RekeyError struct {
Token string
}
RekeyError is returned by Poller.poll when the server signals that the agent must regenerate its keypair (force-rotate with new_key=true, ADR 0004 §7.1). The token attached to the error is single-use and short-lived; the caller is expected to invoke agent.Reenroll with it.
func (*RekeyError) Error ¶
func (e *RekeyError) Error() string
type RevocationError ¶
RevocationError is returned by Poller.poll when the management server signals that the agent should stop polling — either 403 revoked (the host is blocked) or 410 gone (the host row has been deleted). Run() returns this error so callers can exit with status 0 and avoid systemd auto-restart loops.
func (*RevocationError) Error ¶
func (e *RevocationError) Error() string
type UpdatesResponse ¶
type UpdatesResponse struct {
HasUpdates bool `json:"has_updates"`
CertificatePEM *string `json:"certificate_pem,omitempty"`
CACertPEM *string `json:"ca_certificate_pem,omitempty"`
ConfigYAML *string `json:"config_yaml,omitempty"`
Blocklist []string `json:"blocklist"`
RekeyRequired bool `json:"rekey_required,omitempty"`
EnrollmentToken string `json:"enrollment_token,omitempty"`
}
UpdatesResponse is the response from the agent updates endpoint.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package pop is the agent-side proof-of-possession helper for ADR 0004 (#75): it owns the Ed25519 signing private key, knows how to load it from disk, and signs poll-request canonical strings.
|
Package pop is the agent-side proof-of-possession helper for ADR 0004 (#75): it owns the Ed25519 signing private key, knows how to load it from disk, and signs poll-request canonical strings. |