feat: Add opt-in TLS end to end - #127

Merged

uberware merged 21 commits into

mainfrom

feat/tls

Aug 22, 2026

Commits on Aug 22, 2026

feat(certgen): generate farm CA, server and client certificates
uberware
committed
73b04c8
feat(certgen): write CA and leaf material with safe file modes
uberware
committed
725837c
feat(config): add http.tls and nats.tls with load-time validation
uberware
committed
9e6ac24
feat(server): terminate TLS on the REST and WebSocket listener
uberware
committed
6c8c017
feat(bus): add TLS and optional client-certificate auth to the embedded broker
uberware
committed
fa2891e
test(server): pin that credential reload preserves broker TLS
uberware
committed
13a6f21
feat(discovery): advertise TLS state, and pin cookie behavior under TLS
uberware
committed
52b5361
feat(worker): enroll over HTTPS against a private CA and force-enable broker TLS
uberware
committed
6f9263a
feat(cli): add sqi-server tls init certificate generator
uberware
committed
ca33d4f
test: cover TLS end to end in integration and smoke
uberware
committed
2d81d71
test(server): pin the plaintext default configuration
uberware
committed
10ab898
docs: document TLS configuration, tls init, and the enablement flag-day
uberware
committed
d9b0531
refactor(tls): share TLS loading in internal/tlsutil and unfork the test harness
uberware
committed
5e5eb77
feat(worker): make nats.tls_enabled tri-state and act on the advertised broker TLS
uberware
committed
626ee5d
test(discovery): cover the mDNS path end to end over real multicast
uberware
committed
fb0a88d
test(discovery): restrict test advertisements to loopback
uberware
committed
26253e3
fix(tls): drop the in-process TLS workaround and close review gaps
uberware
committed
2aceebe
feat(cli): add sqi-server tls issue for certificates from an existing CA
uberware
committed
da2b359
docs: correct the TLS scope claim and cover the plaintext worker listener
uberware
committed
0612cb7
fix(discovery): fall back to the advertised IP and add TLS to the worker listener
uberware
committed
3baff52
fix(ci): give Linux loopback a non-loopback address so mDNS can register
uberware
committed
c64641f

Navigation Menu

feat: Add opt-in TLS end to end - #127

feat: Add opt-in TLS end to end#127
uberware merged 21 commits into
mainfrom
feat/tls

Commits on Aug 22, 2026

feat(certgen): generate farm CA, server and client certificates

feat(certgen): write CA and leaf material with safe file modes

feat(config): add http.tls and nats.tls with load-time validation

feat(server): terminate TLS on the REST and WebSocket listener

feat(bus): add TLS and optional client-certificate auth to the embedded broker

test(server): pin that credential reload preserves broker TLS

feat(discovery): advertise TLS state, and pin cookie behavior under TLS

feat(worker): enroll over HTTPS against a private CA and force-enable broker TLS

feat(cli): add sqi-server tls init certificate generator

test: cover TLS end to end in integration and smoke

test(server): pin the plaintext default configuration

docs: document TLS configuration, tls init, and the enablement flag-day

refactor(tls): share TLS loading in internal/tlsutil and unfork the test harness

feat(worker): make nats.tls_enabled tri-state and act on the advertised broker TLS

test(discovery): cover the mDNS path end to end over real multicast

test(discovery): restrict test advertisements to loopback

fix(tls): drop the in-process TLS workaround and close review gaps

feat(cli): add sqi-server tls issue for certificates from an existing CA

docs: correct the TLS scope claim and cover the plaintext worker listener

fix(discovery): fall back to the advertised IP and add TLS to the worker listener

fix(ci): give Linux loopback a non-loopback address so mDNS can register