Dcntrlized/Maestro
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(dev): DCNTRLIZED_DEV drives dev mode; dev fleet runs real mTLS

Browse Source 
The single canonical dev flag is DCNTRLIZED_DEV=true, injected by every
docker-compose.debug/dev.yaml. Dev mode now selects endpoints and behaviors
without downgrading control-plane security:

- lib/env: IsDev()/GiteaURL(); registry BaseURL keys on DCNTRLIZED_DEV and
  DCNTRLIZED_GITEA_URL (renamed from GITEA_URL).
- authmgmt: Scheme()/PeerTransport() (satellite edges) key on DCNTRLIZED_DEV
  — dev satellites keep a plaintext RN-facing listener, production mTLS. The
  auth-management edge (New()) stays mTLS in both, preferring
  DCNTRLIZED_AUTH_URL in dev.
- Removed INSECURE_INTERNAL + propagateInsecureInternal from Maestro: the
  orchestrator no longer runs plaintext, and no longer injects the escape
  hatch into services it starts.
- lib/devboot: at boot (dev only) Maestro provisions the identities its
  compose-managed peers bind-mount at /dcntrlized/pki (before infra boots)
  and approves the known fleet in the auth trust store. Unknown peers still
  record a pending authorization and are refused (mechanisms active).
- Composes: prod docker-compose.yaml is clean (no DCNTRLIZED_DEV/GITEA_URL);
  the debug compose carries the dev flag + DCNTRLIZED_GITEA_URL only.
This commit is contained in:
Admin
2026-08-16 15:51:49 +01:00
parent e569466dc3
commit addaabc0a8
12 changed files with 178 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/authmgmt/client.go
+17 -15
View File
@@ -32,6 +32,7 @@ import (
"path/filepath"
"time"
"git.dcntrlized.org/Dcntrlized/Maestro/lib/env"
"git.dcntrlized.org/Dcntrlized/Maestro/lib/logger"
"git.dcntrlized.org/Dcntrlized/Maestro/lib/pki"
)
@@ -95,7 +96,13 @@ func New() (*Client, error) {
return nil, err
}
baseURL := os.Getenv("AUTH_SERVICE_URL")
baseURL := ""
if env.IsDev() {
baseURL = os.Getenv("DCNTRLIZED_AUTH_URL")
}
if baseURL == "" {
baseURL = os.Getenv("AUTH_SERVICE_URL")
}
if baseURL == "" {
baseURL = AuthServiceURL
}
@@ -144,27 +151,22 @@ func maestroTransport() (*http.Transport, error) {
}, nil
}
// InsecureInternal reports whether the dev escape hatch is enabled
// (INSECURE_INTERNAL=1): peer edges run plaintext, mirroring the services'
// listeners in the dev compose files.
func InsecureInternal() bool {
return os.Getenv("INSECURE_INTERNAL") == "1"
}
// Scheme returns "http" under the dev escape hatch and "https" otherwise, for
// building service peer URLs (RunAction, manifest fetch).
// Scheme returns "http" in dev mode and "https" otherwise, for building
// satellite peer URLs (RunAction, manifest fetch). Dev satellites keep a
// plaintext listener so the RN clients (which cannot do mTLS) can reach them;
// production satellites bind mTLS listeners.
func Scheme() string {
if InsecureInternal() {
if env.IsDev() {
return "http"
}
return "https"
}
// PeerTransport returns the transport Maestro uses for the service peer edges
// (M2 §2). Normally mutual TLS with Maestro's identity; a plaintext transport
// under INSECURE_INTERNAL=1 so the dev fleet keeps working mid-migration.
// PeerTransport returns the transport Maestro uses for the satellite peer
// edges (M2 §2): plaintext in dev mode (matching the RN-facing listeners),
// mutual TLS with Maestro's identity in production.
func PeerTransport() (*http.Transport, error) {
if InsecureInternal() {
if env.IsDev() {
return &http.Transport{}, nil
}
return maestroTransport()