Documentation
¶
Overview ¶
Package localorigin realizes the node-local mTLS publication inside the existing StackKits server. Only Apply-owned, signed publication state is read.
Index ¶
- Variables
- func Bind(ctx context.Context, workspaceRoot string, ...) error
- func InstallPeer(root string, credential PeerCredential, rootFingerprint string) error
- func NewServer(workspaceRoot, address string) (*http.Server, error)
- func ProbePeer(ctx context.Context, root, peerRef, address string) (int, error)
- func ProbePeerOrigin(ctx context.Context, root, peerRef, address, serverName string) (int, error)
- func RecordBackend(workspaceRoot string, backend Backend) error
- func RemoveObsolete(root string, serverNames []string) error
- func WithdrawBackend(workspaceRoot string, backend Backend) error
- type Backend
- type PeerCredential
- type PeerRequest
- type Proof
Constants ¶
This section is empty.
Variables ¶
var ErrPeerSelection = errors.New("localorigin: CSR identity differs from explicit Owner peer selection")
Functions ¶
func Bind ¶
func Bind(ctx context.Context, workspaceRoot string, policy architecturev2renderer.BridgeOriginMTLSPublicationPolicy) error
Bind issues the server certificate through the existing step-ca and installs the supplied publication. Callers must validate its executor artifact before granting this local capability. It cannot select an arbitrary URL: the backend must already be attested by the application runtime producer.
func InstallPeer ¶
func InstallPeer(root string, credential PeerCredential, rootFingerprint string) error
InstallPeer requires the Home root fingerprint through a separate approved channel. A certificate response cannot bootstrap its own trust anchor.
func NewServer ¶
NewServer constructs the dedicated origin-only TLS listener in the existing StackKits process. No management route or caller-selected upstream is exposed. It is disabled unless the process explicitly supplies a loopback listen socket.
func ProbePeer ¶
ProbePeer exercises the installed Cloud credential over the separately established federation loopback socket. The credential selects the sole origin identity; redirects cannot forward it to a different destination.
func ProbePeerOrigin ¶
ProbePeerOrigin additionally pins the expected origin identity supplied by an adopted external fabric. It reuses the same local credential custody.
func RecordBackend ¶
func RemoveObsolete ¶
RemoveObsolete disables omitted publications in signed custody. Both new TLS handshakes and the next request on an existing connection consult that state. Keys remain in custody so interruption cannot accidentally resurrect a route.
func WithdrawBackend ¶
WithdrawBackend removes the exact signed origin backend record for the removed container. Missing exact state may converge. A replaced directory, a non-regular occupancy of the hashed path, or a newer ContainerID is left untouched.
Types ¶
type Backend ¶
type Backend struct {
ModuleRef string `json:"moduleRef"`
UnitRef string `json:"unitRef"`
InstanceRef string `json:"instanceRef"`
NodeRef string `json:"nodeRef"`
ServiceRef string `json:"serviceRef"`
TargetPort int `json:"targetPort"`
Address string `json:"address"`
ContainerID string `json:"containerId"`
ObservedAt time.Time `json:"observedAt"`
}
Backend is produced only after the existing application runtime has observed the exact running container, its scoped loopback mapping and HTTP readiness.
type PeerCredential ¶
type PeerCredential struct {
PeerRef string `json:"peerRef"`
ServerName string `json:"serverName"`
CertificatePEM string `json:"certificatePEM"`
RootCertificatePEM string `json:"rootCertificatePEM"`
}
PeerCredential is returned after Home has issued and admitted the exact leaf. Only certificate material crosses nodes; the private key stays at Cloud.
func EnrollPeer ¶
func EnrollPeer(ctx context.Context, root, serverName, selectedPeer string, request PeerRequest, replaceKey bool) (PeerCredential, error)
EnrollPeer is called by the explicitly approved local Owner lifecycle. It binds the CSR to an installed origin publication, then uses the existing signed, current-state-bound admission operation after step-ca issuance.
type PeerRequest ¶
PeerRequest contains only public proof of a Cloud-held key. PeerRef is an explicit local Owner choice; it is never inferred from a site or hostname.
func RequestPeer ¶
func RequestPeer(root, peerRef string) (PeerRequest, error)
func RequestPeerWithRotation ¶
func RequestPeerWithRotation(root, peerRef string, rotate bool) (PeerRequest, error)
type Proof ¶
type Proof struct {
Nonce string `json:"nonce"`
Policy architecturev2renderer.BridgeOriginMTLSPublicationPolicy `json:"policy"`
CertificatePEM string `json:"certificatePEM"`
ObservedAt time.Time `json:"observedAt"`
TLSVersion uint16 `json:"tlsVersion"`
ClientCertificateRequired bool `json:"clientCertificateRequired"`
LoopbackOnly bool `json:"loopbackOnly"`
}
Proof is read from the real listener after current publication, backend and peer authorization have been evaluated. It never contains private key data.
Source Files