Jon Chery
181cc769e6
Internal CA with CSR join, mTLS 1.3 config builders, rotation alarm, PEM redaction, and cert inventory schema (REQ-033/034/035/036). - internal/security/ca.go: CAInit/LoadCA/SignCSR, file mode enforcement (ca.crt 0644, ca.key 0600) per REQ-033 - internal/security/csr.go: GenerateCSR with DNS + IP SANs (REQ-036) - internal/security/fingerprint.go: SHA-256 hex of cert DER - internal/security/rotation.go: 30d pre-expiry alarm, history pruning - internal/security/redact.go: PEM private key block stripping (REQ-035) - internal/security/tls_config.go: TLS 1.3 with AEAD allowlist - internal/security/certgen_test.go: round-trip + mode + rotation + redact - internal/store/migrations/0004_certs.sql: cert inventory table - internal/store/cert_repo.go: CRUD + PruneOlderThan (REQ-025) ---ci--- project: orca phase: 8 milestone: v0.2 status: execute ---/ci---
18 lines
970 B
Go
18 lines
970 B
Go
// Package security provides certificate authority, CSR signing, TLS
|
|
// configuration, and rotation helpers for orca's mTLS transport.
|
|
//
|
|
// The CA model is internal + operator-mediated (per PROJECT.md D-011, D-012):
|
|
//
|
|
// - The bootstrap node runs CAInit(dir) to mint a self-signed CA and persist
|
|
// ca.crt (0644) + ca.key (0600). Mode enforcement is intentional — REQ-033
|
|
// requires the daemon to refuse to start if the file modes are wrong.
|
|
// - Operators copy ca.crt to peers out-of-band.
|
|
// - Peers run GenerateCSR to produce a CSR + key, ship the CSR to the CA
|
|
// node, which calls SignCSR to produce a server cert. The peer verifies
|
|
// the on-disk CA cert's SHA-256 fingerprint at `node join` time against
|
|
// a pinned value (REQ-026) — fail fast on CA mismatch (D-014).
|
|
//
|
|
// All certificate operations use the Go standard library (no external
|
|
// crypto deps) per the v0.2 plan's "no new direct deps for P01" rule.
|
|
package security
|