feat: Certificates management #1086
Conversation
| if err := server.importConfig(); err != nil { | ||
| logging.S.Error(fmt.Errorf("import config: %w", err)) | ||
| } | ||
|
|
There was a problem hiding this comment.
unrelated change here. I think this is functionally equivalent to what the TODO comment says it should have done
There was a problem hiding this comment.
I think Mike is changing this in #1068 too
internal/server/server.go
Outdated
| @@ -60,14 +70,23 @@ type Options struct { | |||
| Secrets []SecretProvider `mapstructure:"secrets"` | |||
|
|
|||
| Import *config.Config `mapstructure:"import"` | |||
|
|
|||
| NetworkEncryption string `yaml:"networkEncryption"` // mtls (default), e2ee, none. | |||
There was a problem hiding this comment.
--experimental-enable-mtls or similar is a better flag for this
Also use mapstructure so flags work
There was a problem hiding this comment.
I imagine in the future this will also support e2ee, so the options would be mtls, e2ee, or none. If I go with boolean flags there will be two flags, and I'm not sure if it makes sense to do both mtls and e2ee.
- support passing in starting cert - use db for cert backend
|
had to rebase with latest main |
| // type Signer interface { | ||
| // SignCert() | ||
| // } | ||
| func MakeUserCert(commonName string, lifetime time.Duration) (*KeyPair, error) { |
There was a problem hiding this comment.
minor: would prefer without abbreviations, MakeUserCertificate
start of certificates management