Documentation
¶
Overview ¶
Package mtls provides mutual TLS helpers for backend HTTPS servers and gateway outbound clients.
Role in architecture:
- Infrastructure: builds tls.Config, configures http.Server / Gin listeners, and outbound transports.
- Configuration is loaded via config.GetConfig().MTLS (or config.Setup).
Responsibilities:
- ServerTLSConfig / ClientTLSConfig / CloneTLSConfig for certificate material.
- ConfigureServer, ListenAndServe, RunGin (and *Config / *WithConfig variants) when MTLS_ENABLED.
- NewTransport for outbound HTTP with client certificate authentication.
Constraints:
- When MTLS_ENABLED is false, listen helpers use plain HTTP / no client cert attachment.
- Pair server TLS with middlewares.MTLSMiddleware so application checks match client auth.
- Skip paths for the middleware come from MTLS_SKIP_PATHS (e.g. /live, /ready, /metrics).
This package must NOT:
- Contain use-case or domain logic.
- Implement HTTP auth beyond TLS client certificate verification.
Index ¶
- func ClientTLSConfig(cfg Config) (*tls.Config, error)
- func CloneTLSConfig(cfg *tls.Config) *tls.Config
- func ConfigureServer(srv *http.Server) error
- func ConfigureServerWithConfig(srv *http.Server, cfg Config) error
- func ListenAndServe(handler http.Handler, addr string) error
- func ListenAndServeConfig(handler http.Handler, addr string, cfg Config) error
- func ListenConfigured(srv *http.Server) error
- func ListenConfiguredWithConfig(srv *http.Server, cfg Config) error
- func NewTransport(cfg Config) (*http.Transport, error)
- func RunGin(engine *gin.Engine, addr string) error
- func RunGinConfig(engine *gin.Engine, addr string, cfg Config) error
- func ServerTLSConfig(cfg Config) (*tls.Config, error)
- type Config
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ClientTLSConfig ¶
ClientTLSConfig returns TLS settings for the api-gateway outbound proxy.
func CloneTLSConfig ¶
CloneTLSConfig returns a shallow copy safe for per-connection use.
func ConfigureServer ¶
ConfigureServer applies mTLS to an existing http.Server when enabled in config.
func ConfigureServerWithConfig ¶
ConfigureServerWithConfig applies mTLS to srv when cfg.Enabled is true.
func ListenAndServe ¶
ListenAndServe starts plain HTTP or mTLS HTTPS depending on cfg.Enabled.
func ListenAndServeConfig ¶
ListenAndServeConfig starts plain HTTP or mTLS HTTPS using the given configuration.
func ListenConfigured ¶
ListenConfigured serves using srv.TLSConfig when mTLS is enabled.
func ListenConfiguredWithConfig ¶
ListenConfiguredWithConfig serves with TLS when cfg.Enabled is true.
func NewTransport ¶
NewTransport builds an http.Transport for gateway upstream connections.
func RunGinConfig ¶
RunGinConfig is RunGin with an explicit configuration.
Types ¶
type Config ¶
type Config = config.MTLSConfiguration
Config is the mTLS configuration loaded from the central config package.
func LoadConfig ¶
func LoadConfig() Config
LoadConfig returns mTLS settings from the global config package.
Source Files