forked from wrenn/wrenn
pptx704
25ce0729d5
- Internal ECDSA P-256 CA (WRENN_CA_CERT/WRENN_CA_KEY env vars); when absent the system falls back to plain HTTP so dev mode works without certificates - Host leaf cert (7-day TTL, IP SAN) issued at registration and renewed on every JWT refresh; fingerprint + expiry stored in DB (cert_expires_at column replaces the removed mtls_enabled flag) - CP ephemeral client cert (24-hour TTL) via CPCertStore with atomic hot-swap; background goroutine renews it every 12 hours without restarting the server - Host agent uses tls.Listen + httpServer.Serve so GetCertificate callback is respected (ListenAndServeTLS always reads cert from disk) - Sandbox reverse proxy now uses pool.Transport() so it shares the same TLS config as the Connect RPC clients instead of http.DefaultTransport - Credentials file renamed host-credentials.json with cert_pem/key_pem/ ca_cert_pem fields; duplicate register/refresh response structs collapsed to authResponse
8 lines
252 B
SQL
8 lines
252 B
SQL
-- +goose Up
|
|
ALTER TABLE hosts DROP COLUMN mtls_enabled;
|
|
ALTER TABLE hosts ADD COLUMN cert_expires_at TIMESTAMPTZ;
|
|
|
|
-- +goose Down
|
|
ALTER TABLE hosts DROP COLUMN cert_expires_at;
|
|
ALTER TABLE hosts ADD COLUMN mtls_enabled BOOLEAN NOT NULL DEFAULT FALSE;
|