Rename trueforge mtls env vars

.changeset/migrate-assistant-runtime.md

@@ -1,6 +1,6 @@
 ---
-'@truefoundry/trueforge-assistant-ui-runtime': major
-'@truefoundry/trueforge-ui': major
+'@truefoundry/trueforge-assistant-ui-runtime': minor
+'@truefoundry/trueforge-ui': minor
 '@truefoundry/trueforge': patch
 ---
 

.changeset/rename-mtls-env.md

@@ -0,0 +1,5 @@
+---
+'@truefoundry/trueforge': patch
+---
+
+Rename server mTLS env vars from `TRUEFORGE_MTLS_ENABLED` / `TRUEFORGE_MTLS_CERTS_DIR` to `MTLS_ENABLED` / `MTLS_CERTS_DIR`. Independent of ServiceFoundry `TRUEFOUNDRY_MTLS_*`.

charts/trueforge/README.md

@@ -371,9 +371,9 @@ extraObjects:
 | `podSecurityContext`  | non-root UID/GID `10001`            | Pod-level restricted security defaults. |
 | `securityContext`     | read-only root FS + drop all capabilities | Container-level restricted security defaults. |
 | `resources`           | 100m/256Mi requests, 200m/512Mi limits | Server CPU, memory, and ephemeral-storage. Replaced when a resourceTier is set. |
-| `mtls.enabled`        | `false`                             | HTTPS listener + controller→server mTLS (`TRUEFORGE_MTLS_*`). When true, probes use `scheme: HTTPS`. |
+| `mtls.enabled`        | `false`                             | HTTPS listener + controller→server mTLS (`MTLS_*`). When true, probes use `scheme: HTTPS`. |
 | `mtls.secretName`     | `""`                                | Secret with `tls.crt` / `tls.key` / `ca.crt` (required when `mtls.enabled`). |
-| `mtls.certsDir`       | `/etc/tls`                          | Mount path / `TRUEFORGE_MTLS_CERTS_DIR`. |
+| `mtls.certsDir`       | `/etc/tls`                          | Mount path / `MTLS_CERTS_DIR`. |
 
 The server uses a RollingUpdate strategy by default (`server.strategy`); the
 controller is fixed to a single replica with `Recreate` and exposes neither.

charts/trueforge/templates/_helpers.tpl

@@ -550,8 +550,8 @@ fields, wires bundled Postgres/Redis, optional OIDC, then server.extraEnv.
 
 {{- if .Values.mtls.enabled -}}
 {{- $_ := required "mtls.secretName is required when mtls.enabled is true" .Values.mtls.secretName -}}
-{{- $env = append $env (dict "name" "TRUEFORGE_MTLS_ENABLED" "value" "true") -}}
-{{- $env = append $env (dict "name" "TRUEFORGE_MTLS_CERTS_DIR" "value" .Values.mtls.certsDir) -}}
+{{- $env = append $env (dict "name" "MTLS_ENABLED" "value" "true") -}}
+{{- $env = append $env (dict "name" "MTLS_CERTS_DIR" "value" .Values.mtls.certsDir) -}}
 {{- end -}}
 
 {{- toYaml $env -}}

packages/trueforge/.env.example

@@ -203,9 +203,9 @@ POSTGRES_PORT=5432
 
 ## Mutual TLS for this process's HTTPS listener and controller→server. Off by default (plain HTTP).
 ## When true, serves HTTPS with client-cert enforcement (except /healthz) and the controller
-## presents tls.crt/tls.key from TRUEFORGE_MTLS_CERTS_DIR. Chart probes must use scheme HTTPS.
-# TRUEFORGE_MTLS_ENABLED=false
-# TRUEFORGE_MTLS_CERTS_DIR=/etc/tls
+## presents tls.crt/tls.key from MTLS_CERTS_DIR. Chart probes must use scheme HTTPS.
+# MTLS_ENABLED=false
+# MTLS_CERTS_DIR=/etc/tls
 
 ## ---------------------------------------------------------------------------
 ## TrueForge mode (STANDALONE=false only; ignored when STANDALONE=true).

packages/trueforge/src/app.ts

@@ -243,7 +243,7 @@ export function createServerApp<TTransaction>(deps: ServerDeps<TTransaction>) {
   if (configuration.ACCESS_LOGS) {
     app.use('*', createAccessLogMiddleware(deps.logger));
   }
-  if (!configuration.STANDALONE && configuration.TRUEFORGE_MTLS_ENABLED) {
+  if (!configuration.STANDALONE && configuration.MTLS_ENABLED) {
     app.use('*', createClientCertificateMiddleware(deps.logger));
   }
   app.use('*', createRequestBodyLimitMiddleware(configuration.MAX_REQUEST_BODY_BYTES));

packages/trueforge/src/config.ts

@@ -651,7 +651,7 @@ export interface SharedServerConfiguration {
    * Base URL the controller uses to reach the server's HTTP API. Dedicated controller
    * (`STANDALONE=false`, `dist/controller-main.js`) and the in-process standalone controller
    * both call the server over HTTP(S) at this URL (loopback in standalone). When
-   * `TRUEFORGE_MTLS_ENABLED` is true the controller upgrades an `http://` URL to `https://`
+   * `MTLS_ENABLED` is true the controller upgrades an `http://` URL to `https://`
    * and presents the client cert. Env: `SERVER_URL`.
    * Default: `http://localhost:$PORT`; in-cluster deployments MUST point this at the server Service.
    */
@@ -665,14 +665,14 @@ export interface SharedServerConfiguration {
   /**
    * Mutual TLS for this process's HTTPS listener and controller→server. When true, serves HTTPS
    * with client-cert enforcement (except `/healthz`) and the controller presents a client cert.
-   * Env: `TRUEFORGE_MTLS_ENABLED`. Default false.
+   * Env: `MTLS_ENABLED`. Default false.
    */
-  TRUEFORGE_MTLS_ENABLED: boolean;
+  MTLS_ENABLED: boolean;
   /**
    * Directory holding the TLS cert triple (`tls.crt` / `tls.key` / `ca.crt`) when
-   * `TRUEFORGE_MTLS_ENABLED` is true. Env: `TRUEFORGE_MTLS_CERTS_DIR`. Default `/etc/tls`.
+   * `MTLS_ENABLED` is true. Env: `MTLS_CERTS_DIR`. Default `/etc/tls`.
    */
-  TRUEFORGE_MTLS_CERTS_DIR: string;
+  MTLS_CERTS_DIR: string;
   /** Env: `NETWORK_POLICY_ENABLED`. Default true. `false` skips the outbound URL guard. */
   NETWORK_POLICY_ENABLED: boolean;
   /** Hosts always allowed. Env: `OUTBOUND_URL_ALLOWED_HOSTS` (JSON string array). Empty = none. */
@@ -933,12 +933,12 @@ const shared: SharedServerConfiguration = {
   TRUEFORGE_API_KEY: standalone
     ? (getEnv('TRUEFORGE_API_KEY', { defaultValue: STANDALONE_TRUEFORGE_API_KEY }) ?? STANDALONE_TRUEFORGE_API_KEY)
     : (getEnv('TRUEFORGE_API_KEY', { required: true }) ?? ''),
-  TRUEFORGE_MTLS_ENABLED: parseBoolean({
-    envKey: 'TRUEFORGE_MTLS_ENABLED',
-    raw: getEnv('TRUEFORGE_MTLS_ENABLED'),
+  MTLS_ENABLED: parseBoolean({
+    envKey: 'MTLS_ENABLED',
+    raw: getEnv('MTLS_ENABLED'),
     defaultValue: false,
   }),
-  TRUEFORGE_MTLS_CERTS_DIR: getEnv('TRUEFORGE_MTLS_CERTS_DIR', { defaultValue: '/etc/tls' }) ?? '/etc/tls',
+  MTLS_CERTS_DIR: getEnv('MTLS_CERTS_DIR', { defaultValue: '/etc/tls' }) ?? '/etc/tls',
   NETWORK_POLICY_ENABLED: parseBoolean({
     envKey: 'NETWORK_POLICY_ENABLED',
     raw: getEnv('NETWORK_POLICY_ENABLED'),

packages/trueforge/src/controller-main.ts

@@ -10,7 +10,7 @@
  * Migrations are owned by the server (`main.ts`). This process only connects to the
  * already-migrated database; the loops have per-pass error boundaries, so they retry
  * each tick until the schema is present. The loops call the server over HTTP(S) at
- * `SERVER_URL` (mutual TLS when `TRUEFORGE_MTLS_ENABLED`), so no Redis peering is wired here.
+ * `SERVER_URL` (mutual TLS when `MTLS_ENABLED`), so no Redis peering is wired here.
  */
 import configuration from './config';
 import { runController } from './controller';
@@ -45,7 +45,7 @@ try {
 
   logger.info('Controller starting', {
     serverUrl: configuration.SERVER_URL,
-    mTlsEnabled: configuration.TRUEFORGE_MTLS_ENABLED,
+    mTlsEnabled: configuration.MTLS_ENABLED,
   });
 
   runController({

packages/trueforge/src/controller/scheduleDispatch.ts

@@ -46,8 +46,8 @@ export type ScheduleRunExecutor = (scheduleRunId: string) => Promise<void>;
 /** HTTP handoff to `POST /api/internal/schedules/runs/execute` (dedicated controller or standalone loopback). */
 export function createHttpScheduleRunExecutor(): ScheduleRunExecutor {
   const tls = {
-    enabled: configuration.TRUEFORGE_MTLS_ENABLED,
-    dir: configuration.TRUEFORGE_MTLS_CERTS_DIR,
+    enabled: configuration.MTLS_ENABLED,
+    dir: configuration.MTLS_CERTS_DIR,
   };
   const tlsFetch = createTlsFetch(tls);
   const client = new TrueForge({

packages/trueforge/src/http/tls.ts

@@ -92,7 +92,7 @@ function requestUrlFromFetchInput(input: Parameters<typeof fetch>[0]): string {
 export function createTlsFetch(options: TlsOptions): typeof fetch | undefined {
   const dispatcher = createTlsDispatcher({
     ...options,
-    enabledEnvKey: 'TRUEFORGE_MTLS_ENABLED',
+    enabledEnvKey: 'MTLS_ENABLED',
   });
   if (dispatcher === undefined) {
     return undefined;
@@ -108,8 +108,7 @@ export function serverTlsServeOptions(
   if (!options.enabled) {
     return undefined;
   }
-  const read = (fileName: string) =>
-    readTlsFile({ dir: options.dir, fileName, enabledEnvKey: 'TRUEFORGE_MTLS_ENABLED' });
+  const read = (fileName: string) => readTlsFile({ dir: options.dir, fileName, enabledEnvKey: 'MTLS_ENABLED' });
   return {
     createServer: createHttpsServer,
     serverOptions: {

packages/trueforge/src/main.ts

@@ -692,8 +692,8 @@ try {
   }
 
   const tlsServe = serverTlsServeOptions({
-    enabled: !configuration.STANDALONE && configuration.TRUEFORGE_MTLS_ENABLED,
-    dir: configuration.TRUEFORGE_MTLS_CERTS_DIR,
+    enabled: !configuration.STANDALONE && configuration.MTLS_ENABLED,
+    dir: configuration.MTLS_CERTS_DIR,
   });
   const server = serve(
     {