certs

Documentation

Index

• type CertManager
  • func NewCertManager(dataDir string) (*CertManager, error)
  • func (cm *CertManager) GenerateKernelCert() (certPath, keyPath string, err error)
  • func (cm *CertManager) GeneratePluginCert(pluginID string) (certPath, keyPath, caPath string, err error)
  • func (cm *CertManager) GetClientTLSConfig() (*tls.Config, error)
  • func (cm *CertManager) GetPluginCertDir(pluginID string) string
  • func (cm *CertManager) GetServerTLSConfig() (*tls.Config, error)
  • func (cm *CertManager) InitCA() error

Types

type CertManager

type CertManager struct {
	// contains filtered or unexported fields
}

CertManager handles CA operations and certificate generation for mTLS.

func NewCertManager

func NewCertManager(dataDir string) (*CertManager, error)

NewCertManager initializes the cert manager. Creates CA if it doesn't exist.

func (*CertManager) GenerateKernelCert

func (cm *CertManager) GenerateKernelCert() (certPath, keyPath string, err error)

GenerateKernelCert creates a cert for the kernel itself, signed by the CA.

func (*CertManager) GeneratePluginCert

func (cm *CertManager) GeneratePluginCert(pluginID string) (certPath, keyPath, caPath string, err error)

GeneratePluginCert creates a cert for a plugin, signed by the CA.

func (*CertManager) GetClientTLSConfig

func (cm *CertManager) GetClientTLSConfig() (*tls.Config, error)

GetClientTLSConfig returns a tls.Config for making requests to plugins. The kernel presents its own cert as a client certificate.

func (*CertManager) GetPluginCertDir

func (cm *CertManager) GetPluginCertDir(pluginID string) string

GetPluginCertDir returns the directory where a plugin's certs are stored. This is the host path that gets volume-mounted into the plugin container.

func (*CertManager) GetServerTLSConfig

func (cm *CertManager) GetServerTLSConfig() (*tls.Config, error)

GetServerTLSConfig returns a tls.Config for the kernel's HTTPS server.

SECURITY NOTE: This uses VerifyClientCertIfGiven (not RequireAndVerifyClientCert) because the same Gin router serves both the HTTP (8080) and TLS (8081) ports. Unauthenticated endpoints on the TLS port include:

• /api/health — Docker/orchestrator health checks
• /api/webhook/:id/* — external webhook ingress (Telegram, Discord, etc.)
• /ws/:container_id/* — workspace proxy (unguessable IDs)

RequireAndVerifyClientCert would break these endpoints on port 8081.

Plugin auth is enforced at the middleware layer: PluginTokenAuth() requires either a valid mTLS client cert OR a valid JWT. On TLS connections, it rejects JWT-only auth (plugins MUST present their mTLS cert when connecting over TLS).

func (*CertManager) InitCA

func (cm *CertManager) InitCA() error

InitCA generates a new CA certificate and key.