From 23bc97a4465ec7d01f76d43ccf54e9f316f634c5 Mon Sep 17 00:00:00 2001 From: Chirag Jain Date: Tue, 22 Sep 2026 15:34:07 +0530 Subject: [PATCH 1/2] Rename trueforge mtls env vars --- .changeset/rename-mtls-env.md | 5 +++++ charts/trueforge/README.md | 4 ++-- charts/trueforge/templates/_helpers.tpl | 4 ++-- packages/trueforge/.env.example | 6 +++--- packages/trueforge/src/app.ts | 2 +- packages/trueforge/src/config.ts | 18 +++++++++--------- packages/trueforge/src/controller-main.ts | 4 ++-- .../src/controller/scheduleDispatch.ts | 4 ++-- packages/trueforge/src/http/tls.ts | 5 ++--- packages/trueforge/src/main.ts | 4 ++-- 10 files changed, 30 insertions(+), 26 deletions(-) create mode 100644 .changeset/rename-mtls-env.md diff --git a/.changeset/rename-mtls-env.md b/.changeset/rename-mtls-env.md new file mode 100644 index 000000000..4890f2694 --- /dev/null +++ b/.changeset/rename-mtls-env.md @@ -0,0 +1,5 @@ +--- +'@truefoundry/trueforge': patch +--- + +Rename server mTLS env vars from `TRUEFORGE_MTLS_ENABLED` / `TRUEFORGE_MTLS_CERTS_DIR` to `MTLS_ENABLED` / `MTLS_CERTS_DIR`. Independent of ServiceFoundry `TRUEFOUNDRY_MTLS_*`. diff --git a/charts/trueforge/README.md b/charts/trueforge/README.md index 4d32b9f63..eaeb13c22 100644 --- a/charts/trueforge/README.md +++ b/charts/trueforge/README.md @@ -371,9 +371,9 @@ extraObjects: | `podSecurityContext` | non-root UID/GID `10001` | Pod-level restricted security defaults. | | `securityContext` | read-only root FS + drop all capabilities | Container-level restricted security defaults. | | `resources` | 100m/256Mi requests, 200m/512Mi limits | Server CPU, memory, and ephemeral-storage. Replaced when a resourceTier is set. | -| `mtls.enabled` | `false` | HTTPS listener + controller→server mTLS (`TRUEFORGE_MTLS_*`). When true, probes use `scheme: HTTPS`. | +| `mtls.enabled` | `false` | HTTPS listener + controller→server mTLS (`MTLS_*`). When true, probes use `scheme: HTTPS`. | | `mtls.secretName` | `""` | Secret with `tls.crt` / `tls.key` / `ca.crt` (required when `mtls.enabled`). | -| `mtls.certsDir` | `/etc/tls` | Mount path / `TRUEFORGE_MTLS_CERTS_DIR`. | +| `mtls.certsDir` | `/etc/tls` | Mount path / `MTLS_CERTS_DIR`. | The server uses a RollingUpdate strategy by default (`server.strategy`); the controller is fixed to a single replica with `Recreate` and exposes neither. diff --git a/charts/trueforge/templates/_helpers.tpl b/charts/trueforge/templates/_helpers.tpl index 0bf3f36cf..b6257e67e 100644 --- a/charts/trueforge/templates/_helpers.tpl +++ b/charts/trueforge/templates/_helpers.tpl @@ -550,8 +550,8 @@ fields, wires bundled Postgres/Redis, optional OIDC, then server.extraEnv. {{- if .Values.mtls.enabled -}} {{- $_ := required "mtls.secretName is required when mtls.enabled is true" .Values.mtls.secretName -}} -{{- $env = append $env (dict "name" "TRUEFORGE_MTLS_ENABLED" "value" "true") -}} -{{- $env = append $env (dict "name" "TRUEFORGE_MTLS_CERTS_DIR" "value" .Values.mtls.certsDir) -}} +{{- $env = append $env (dict "name" "MTLS_ENABLED" "value" "true") -}} +{{- $env = append $env (dict "name" "MTLS_CERTS_DIR" "value" .Values.mtls.certsDir) -}} {{- end -}} {{- toYaml $env -}} diff --git a/packages/trueforge/.env.example b/packages/trueforge/.env.example index 50be2adcb..ce176669a 100644 --- a/packages/trueforge/.env.example +++ b/packages/trueforge/.env.example @@ -203,9 +203,9 @@ POSTGRES_PORT=5432 ## Mutual TLS for this process's HTTPS listener and controller→server. Off by default (plain HTTP). ## When true, serves HTTPS with client-cert enforcement (except /healthz) and the controller -## presents tls.crt/tls.key from TRUEFORGE_MTLS_CERTS_DIR. Chart probes must use scheme HTTPS. -# TRUEFORGE_MTLS_ENABLED=false -# TRUEFORGE_MTLS_CERTS_DIR=/etc/tls +## presents tls.crt/tls.key from MTLS_CERTS_DIR. Chart probes must use scheme HTTPS. +# MTLS_ENABLED=false +# MTLS_CERTS_DIR=/etc/tls ## --------------------------------------------------------------------------- ## TrueForge mode (STANDALONE=false only; ignored when STANDALONE=true). diff --git a/packages/trueforge/src/app.ts b/packages/trueforge/src/app.ts index a8c9ef36e..3efb8b554 100644 --- a/packages/trueforge/src/app.ts +++ b/packages/trueforge/src/app.ts @@ -243,7 +243,7 @@ export function createServerApp(deps: ServerDeps) { if (configuration.ACCESS_LOGS) { app.use('*', createAccessLogMiddleware(deps.logger)); } - if (!configuration.STANDALONE && configuration.TRUEFORGE_MTLS_ENABLED) { + if (!configuration.STANDALONE && configuration.MTLS_ENABLED) { app.use('*', createClientCertificateMiddleware(deps.logger)); } app.use('*', createRequestBodyLimitMiddleware(configuration.MAX_REQUEST_BODY_BYTES)); diff --git a/packages/trueforge/src/config.ts b/packages/trueforge/src/config.ts index 4b1255048..6599b837d 100644 --- a/packages/trueforge/src/config.ts +++ b/packages/trueforge/src/config.ts @@ -651,7 +651,7 @@ export interface SharedServerConfiguration { * Base URL the controller uses to reach the server's HTTP API. Dedicated controller * (`STANDALONE=false`, `dist/controller-main.js`) and the in-process standalone controller * both call the server over HTTP(S) at this URL (loopback in standalone). When - * `TRUEFORGE_MTLS_ENABLED` is true the controller upgrades an `http://` URL to `https://` + * `MTLS_ENABLED` is true the controller upgrades an `http://` URL to `https://` * and presents the client cert. Env: `SERVER_URL`. * Default: `http://localhost:$PORT`; in-cluster deployments MUST point this at the server Service. */ @@ -665,14 +665,14 @@ export interface SharedServerConfiguration { /** * Mutual TLS for this process's HTTPS listener and controller→server. When true, serves HTTPS * with client-cert enforcement (except `/healthz`) and the controller presents a client cert. - * Env: `TRUEFORGE_MTLS_ENABLED`. Default false. + * Env: `MTLS_ENABLED`. Default false. */ - TRUEFORGE_MTLS_ENABLED: boolean; + MTLS_ENABLED: boolean; /** * Directory holding the TLS cert triple (`tls.crt` / `tls.key` / `ca.crt`) when - * `TRUEFORGE_MTLS_ENABLED` is true. Env: `TRUEFORGE_MTLS_CERTS_DIR`. Default `/etc/tls`. + * `MTLS_ENABLED` is true. Env: `MTLS_CERTS_DIR`. Default `/etc/tls`. */ - TRUEFORGE_MTLS_CERTS_DIR: string; + MTLS_CERTS_DIR: string; /** Env: `NETWORK_POLICY_ENABLED`. Default true. `false` skips the outbound URL guard. */ NETWORK_POLICY_ENABLED: boolean; /** Hosts always allowed. Env: `OUTBOUND_URL_ALLOWED_HOSTS` (JSON string array). Empty = none. */ @@ -933,12 +933,12 @@ const shared: SharedServerConfiguration = { TRUEFORGE_API_KEY: standalone ? (getEnv('TRUEFORGE_API_KEY', { defaultValue: STANDALONE_TRUEFORGE_API_KEY }) ?? STANDALONE_TRUEFORGE_API_KEY) : (getEnv('TRUEFORGE_API_KEY', { required: true }) ?? ''), - TRUEFORGE_MTLS_ENABLED: parseBoolean({ - envKey: 'TRUEFORGE_MTLS_ENABLED', - raw: getEnv('TRUEFORGE_MTLS_ENABLED'), + MTLS_ENABLED: parseBoolean({ + envKey: 'MTLS_ENABLED', + raw: getEnv('MTLS_ENABLED'), defaultValue: false, }), - TRUEFORGE_MTLS_CERTS_DIR: getEnv('TRUEFORGE_MTLS_CERTS_DIR', { defaultValue: '/etc/tls' }) ?? '/etc/tls', + MTLS_CERTS_DIR: getEnv('MTLS_CERTS_DIR', { defaultValue: '/etc/tls' }) ?? '/etc/tls', NETWORK_POLICY_ENABLED: parseBoolean({ envKey: 'NETWORK_POLICY_ENABLED', raw: getEnv('NETWORK_POLICY_ENABLED'), diff --git a/packages/trueforge/src/controller-main.ts b/packages/trueforge/src/controller-main.ts index 5171d527c..1e4e7b26a 100644 --- a/packages/trueforge/src/controller-main.ts +++ b/packages/trueforge/src/controller-main.ts @@ -10,7 +10,7 @@ * Migrations are owned by the server (`main.ts`). This process only connects to the * already-migrated database; the loops have per-pass error boundaries, so they retry * each tick until the schema is present. The loops call the server over HTTP(S) at - * `SERVER_URL` (mutual TLS when `TRUEFORGE_MTLS_ENABLED`), so no Redis peering is wired here. + * `SERVER_URL` (mutual TLS when `MTLS_ENABLED`), so no Redis peering is wired here. */ import configuration from './config'; import { runController } from './controller'; @@ -45,7 +45,7 @@ try { logger.info('Controller starting', { serverUrl: configuration.SERVER_URL, - mTlsEnabled: configuration.TRUEFORGE_MTLS_ENABLED, + mTlsEnabled: configuration.MTLS_ENABLED, }); runController({ diff --git a/packages/trueforge/src/controller/scheduleDispatch.ts b/packages/trueforge/src/controller/scheduleDispatch.ts index 4c4a1bc9d..178c0886d 100644 --- a/packages/trueforge/src/controller/scheduleDispatch.ts +++ b/packages/trueforge/src/controller/scheduleDispatch.ts @@ -46,8 +46,8 @@ export type ScheduleRunExecutor = (scheduleRunId: string) => Promise; /** HTTP handoff to `POST /api/internal/schedules/runs/execute` (dedicated controller or standalone loopback). */ export function createHttpScheduleRunExecutor(): ScheduleRunExecutor { const tls = { - enabled: configuration.TRUEFORGE_MTLS_ENABLED, - dir: configuration.TRUEFORGE_MTLS_CERTS_DIR, + enabled: configuration.MTLS_ENABLED, + dir: configuration.MTLS_CERTS_DIR, }; const tlsFetch = createTlsFetch(tls); const client = new TrueForge({ diff --git a/packages/trueforge/src/http/tls.ts b/packages/trueforge/src/http/tls.ts index 648547cfa..4f1e48104 100644 --- a/packages/trueforge/src/http/tls.ts +++ b/packages/trueforge/src/http/tls.ts @@ -92,7 +92,7 @@ function requestUrlFromFetchInput(input: Parameters[0]): string { export function createTlsFetch(options: TlsOptions): typeof fetch | undefined { const dispatcher = createTlsDispatcher({ ...options, - enabledEnvKey: 'TRUEFORGE_MTLS_ENABLED', + enabledEnvKey: 'MTLS_ENABLED', }); if (dispatcher === undefined) { return undefined; @@ -108,8 +108,7 @@ export function serverTlsServeOptions( if (!options.enabled) { return undefined; } - const read = (fileName: string) => - readTlsFile({ dir: options.dir, fileName, enabledEnvKey: 'TRUEFORGE_MTLS_ENABLED' }); + const read = (fileName: string) => readTlsFile({ dir: options.dir, fileName, enabledEnvKey: 'MTLS_ENABLED' }); return { createServer: createHttpsServer, serverOptions: { diff --git a/packages/trueforge/src/main.ts b/packages/trueforge/src/main.ts index 321d51979..63531d3b3 100644 --- a/packages/trueforge/src/main.ts +++ b/packages/trueforge/src/main.ts @@ -692,8 +692,8 @@ try { } const tlsServe = serverTlsServeOptions({ - enabled: !configuration.STANDALONE && configuration.TRUEFORGE_MTLS_ENABLED, - dir: configuration.TRUEFORGE_MTLS_CERTS_DIR, + enabled: !configuration.STANDALONE && configuration.MTLS_ENABLED, + dir: configuration.MTLS_CERTS_DIR, }); const server = serve( { From f399713849488b23188b14d86c0da688218d6eda Mon Sep 17 00:00:00 2001 From: Chirag Jain Date: Tue, 22 Sep 2026 15:35:46 +0530 Subject: [PATCH 2/2] Fix changeset file --- .changeset/migrate-assistant-runtime.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.changeset/migrate-assistant-runtime.md b/.changeset/migrate-assistant-runtime.md index 033484834..3cddd9dc0 100644 --- a/.changeset/migrate-assistant-runtime.md +++ b/.changeset/migrate-assistant-runtime.md @@ -1,6 +1,6 @@ --- -'@truefoundry/trueforge-assistant-ui-runtime': major -'@truefoundry/trueforge-ui': major +'@truefoundry/trueforge-assistant-ui-runtime': minor +'@truefoundry/trueforge-ui': minor '@truefoundry/trueforge': patch ---