Admin
e66cf54d5b
Dev now runs the real trust-store flow end to end: satellites boot with the instance-CA identities Maestro issues (devboot.EnsureIdentities), but their first mTLS contact records a pending authorization and is refused (403) until the owner approves via /api/peers. The ApproveFleet shortcut is gone, along with the authmgmt dependency in devboot.
61 lines
2.6 KiB
Go
61 lines
2.6 KiB
Go
// Copyright (C) 2026 Dcntrlized
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published
|
|
// by the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
|
|
// Package devboot provisions the dev fleet the DCNTRLIZED_DEV way: Maestro
|
|
// issues the identities its docker-compose.dev/debug.yaml peers bind-mount at
|
|
// /dcntrlized/pki. There is no approval shortcut — a satellite's first mTLS
|
|
// contact records a pending authorization and is refused (403) until the owner
|
|
// approves it via /api/peers, exactly the real trust-store flow.
|
|
package devboot
|
|
|
|
import (
|
|
"git.dcntrlized.org/Dcntrlized/Maestro/lib/containers"
|
|
"git.dcntrlized.org/Dcntrlized/Maestro/lib/logger"
|
|
"git.dcntrlized.org/Dcntrlized/Maestro/lib/pki"
|
|
)
|
|
|
|
// Infra are the shared services whose identities the dev composes mount. They
|
|
// are peers/attesters themselves, not approval candidates (auth is the
|
|
// trust-store owner, Maestro uses the internal RequireMaestro endpoints).
|
|
var Infra = []string{"dcntrlized-auth"}
|
|
|
|
// Fleet lists the dev-mode satellite identities Maestro issues. Their CNs must
|
|
// match the service names used in the dev composes' pki mounts.
|
|
var Fleet = []string{"keepnote", "calendar", "testservice"}
|
|
|
|
// EnsureIdentities provisions the instance CA identities the dev composes
|
|
// bind-mount at /dcntrlized/pki, so compose-managed services come up with a
|
|
// valid mTLS identity before they ever dial the auth service. Run before the
|
|
// shared infrastructure is ensured, because dcntrlized-auth's mTLS listener
|
|
// refuses to start without its identity.
|
|
func EnsureIdentities() {
|
|
dataRoot, err := containers.DataRoot()
|
|
if err != nil {
|
|
logger.Warn("devboot: resolve data root: %v", err)
|
|
return
|
|
}
|
|
ca, err := pki.EnsureCA(dataRoot)
|
|
if err != nil {
|
|
logger.Warn("devboot: ensure instance CA: %v", err)
|
|
return
|
|
}
|
|
for _, name := range append(append([]string{}, Infra...), Fleet...) {
|
|
if _, err := pki.EnsureServiceIdentity(ca, name); err != nil {
|
|
logger.Warn("devboot: ensure identity for %s: %v", name, err)
|
|
}
|
|
}
|
|
logger.Info("devboot: ensured dev fleet identities (%d infra + %d satellites)", len(Infra), len(Fleet))
|
|
}
|