Dcntrlized/Maestro
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(devboot): remove dev fleet pre-approval

Browse Source 
Dev now runs the real trust-store flow end to end: satellites boot with the
instance-CA identities Maestro issues (devboot.EnsureIdentities), but their
first mTLS contact records a pending authorization and is refused (403) until
the owner approves via /api/peers. The ApproveFleet shortcut is gone, along
with the authmgmt dependency in devboot.
This commit is contained in:
Admin
2026-08-16 16:52:49 +01:00
parent cda3091ad8
commit e66cf54d5b
2 changed files with 8 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/devboot/devboot.go
+5 -47
View File
@@ -15,17 +15,12 @@
// Package devboot provisions the dev fleet the DCNTRLIZED_DEV way: Maestro
// issues the identities its docker-compose.dev/debug.yaml peers bind-mount at
// /dcntrlized/pki, and approves those satellites in the auth service trust
// store. Dev mode runs the real security mechanisms (mTLS peer edges,
// authorized-keys enforcement) — this only removes the human-in-the-loop for
// the *known* dev fleet; any unknown peer still records a pending
// authorization and is refused.
// /dcntrlized/pki. There is no approval shortcut — a satellite's first mTLS
// contact records a pending authorization and is refused (403) until the owner
// approves it via /api/peers, exactly the real trust-store flow.
package devboot
import (
"context"
"git.dcntrlized.org/Dcntrlized/Maestro/lib/authmgmt"
"git.dcntrlized.org/Dcntrlized/Maestro/lib/containers"
"git.dcntrlized.org/Dcntrlized/Maestro/lib/logger"
"git.dcntrlized.org/Dcntrlized/Maestro/lib/pki"
@@ -36,8 +31,8 @@ import (
// trust-store owner, Maestro uses the internal RequireMaestro endpoints).
var Infra = []string{"dcntrlized-auth"}
// Fleet lists the dev-mode satellite identities Maestro issues and approves.
// Their CNs must match the service names used in the dev composes' pki mounts.
// Fleet lists the dev-mode satellite identities Maestro issues. Their CNs must
// match the service names used in the dev composes' pki mounts.
var Fleet = []string{"keepnote", "calendar", "testservice"}
// EnsureIdentities provisions the instance CA identities the dev composes
@@ -63,40 +58,3 @@ func EnsureIdentities() {
}
logger.Info("devboot: ensured dev fleet identities (%d infra + %d satellites)", len(Infra), len(Fleet))
}
// ApproveFleet approves the dev satellites in the auth service trust store —
// the owner decision a fresh first-contact would pend, made once for the known
// fleet. Best-effort: if the auth service is not up yet, the first-contact
// no-op path records the pendings and the next boot approves them.
func ApproveFleet(ctx context.Context) {
if len(Fleet) == 0 {
return
}
client, err := authmgmt.New()
if err != nil {
logger.Warn("devboot: build auth client: %v", err)
return
}
dataRoot, err := containers.DataRoot()
if err != nil {
logger.Warn("devboot: resolve data root: %v", err)
return
}
ca, err := pki.EnsureCA(dataRoot)
if err != nil {
logger.Warn("devboot: ensure instance CA: %v", err)
return
}
for _, name := range Fleet {
identity, err := pki.EnsureServiceIdentity(ca, name)
if err != nil {
logger.Warn("devboot: load identity for %s: %v", name, err)
continue
}
if err := client.Approve(ctx, name, identity.Meta.Fingerprint); err != nil {
logger.Warn("devboot: approve %s: %v", name, err)
continue
}
logger.Info("devboot: approved dev peer %s (%s)", name, identity.Meta.Fingerprint)
}
}