Documentation
¶
Overview ¶
Package creds resolves TLS transport credentials for Temporal proxy connections from a small set of options.
A Dialer secures outbound (client) connections and a Listener secures inbound (server) connections. Both are built from the same options (Insecure, WithCA, WithCertificate) but interpret them per role: for a client a CA is a trust anchor and a certificate is presented to the upstream; for a server a CA requires and verifies client certificates. Each constructor resolves the TLS Mode and the cross-field legality of the configuration once, so validation, dialing, and serving cannot disagree.
Security is the default: only Insecure yields a plaintext credential, and an accidentally-empty client credential verifies the peer against the system root pool rather than silently downgrading. Construction performs no file I/O; certificate material is read and parsed lazily (and once) when a credential is validated or used.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Dialer ¶
type Dialer struct {
// contains filtered or unexported fields
}
Dialer is a client-side credential resolved from a set of [Option]s. It owns the outbound TLS-mode decision (insecure, system-root TLS, custom-CA TLS, or mutual TLS) and builds the corresponding google.golang.org/grpc.DialOption. Certificate and CA material is parsed once and reused, so a single Dialer backs every per-request dial of a templated upstream.
func NewDialer ¶
NewDialer builds a client-side credential from opts. With no material options it verifies the peer against the system root pool. Construction performs no file I/O and never fails; illegal combinations and file problems surface at Validate and DialOption.
func (*Dialer) DialOption ¶
func (d *Dialer) DialOption(serverName string) (grpc.DialOption, error)
DialOption returns the grpc.DialOption for outbound connections. serverName sets the SNI and hostname-verification name (empty uses the dial target's host). The certificate and CA material is parsed on the first call and reused on subsequent calls, so only serverName varies per call. The same legality guard as Validate runs first, so an illegal configuration fails here rather than dialing with the wrong mode.
type Listener ¶
type Listener struct {
// contains filtered or unexported fields
}
Listener is a server-side credential resolved from a set of [Option]s. It owns the inbound TLS-mode decision (insecure, server TLS, or mutual TLS) and builds the corresponding google.golang.org/grpc.ServerOption.
func NewListener ¶
NewListener builds a server-side credential from opts. With no material options it is a server-TLS listener that requires its own certificate. Construction performs no file I/O and never fails; illegal combinations and file problems surface at Validate and ServerOption.
func (*Listener) Encrypted ¶
Encrypted reports whether the inbound transport is encrypted. Only the insecure mode is unencrypted.
func (*Listener) ServerOption ¶
func (l *Listener) ServerOption() (grpc.ServerOption, error)
ServerOption returns the grpc.ServerOption for inbound connections. The same legality guard as Validate runs first. Server TLS presents the configured certificate; mutual TLS additionally requires and verifies client certificates against the configured CA. Both require at least TLS 1.2 and restrict TLS 1.2 sessions to the preferred AES-GCM cipher suites.
type Mode ¶
type Mode int
Mode is the transport-security decision derived once from the configured material and the role. It is exposed for logging and tests; callers never branch on the raw file paths themselves.
const ( // ModeInsecure disables transport security. ModeInsecure Mode = iota // ModeServerTLS presents a server certificate; clients are not required to // present one. ModeServerTLS // ModeSystemTLS verifies the peer against the system root pool (client side). ModeSystemTLS // ModeCustomCA verifies the peer against a private CA or pinned anchor // (client side). ModeCustomCA // ModeMutualTLS presents a certificate and verifies the peer's certificate. ModeMutualTLS )
type Option ¶
type Option interface {
// contains filtered or unexported methods
}
Option configures the TLS material for a Dialer or Listener.
func Insecure ¶
func Insecure() Option
Insecure disables transport security. It is the only way to obtain a plaintext credential: security is the default, so an accidentally-empty credential fails toward TLS rather than silently downgrading. Use it deliberately, for example on the local loopback socket.
func WithCertificate ¶
WithCertificate presents the certFile/keyFile key pair. Both must be set together; that pairing is enforced when the credential is validated or used.
Source Files