M2 §2: require a CA-issued client cert on the HTTP listener (mTLS)

Serve the listener over TLS with ClientAuth=RequireAndVerifyClientCert trusting the instance CA (shared tlsutil.ServerConfig): only Maestro can drive actions (T4), and the peer edge is encrypted. INSECURE_INTERNAL=1 (dev debug compose) keeps the listener plaintext for the RN client's direct mode and hot reload.
2026-08-16 01:14:06 +01:00
parent 39b6c642be
commit 73c09132b3
2 changed files with 39 additions and 1 deletions
@@ -39,6 +39,9 @@ services:
    # Environment variables for the application
    environment:
      - DEV_MODE=true
+      # Security theme M2 §2: dev escape hatch — keep the listener plaintext
+      # so the RN client (direct mode) and hot reload work without certs.
+      - INSECURE_INTERNAL=1
      # Application configuration
      # - PORT=8080
      # - ENVIRONMENT=development