route-proxy binds the mesh's own authority for internal names; gitea's internal-API refusal joins its route #70

2026-09-25T18:52:13Z

jschoubben commented

2026-09-25 18:52:13 +00:00

step-ca offers a second seat, internal-acme-ca, beside its existing acme-ca — the same directory and roots, distinctly named so route-proxy can require both authorities at once (one bind per provision name). route-proxy binds it into INTERNAL_ACME_DIRECTORY/INTERNAL_ACME_CA_BUNDLE with its own trust step, mirroring the public one.

gitea's /api/internal refusal moves into its route contribution (ADR 0108: a route carries the policy applied to a request). The 2026-09-12 incident-response file in the predecessor's dynamic directory said its durable home is the mesh's routing — this is that. route-adapter skips the port-less contribution aloud (nothing to write); route-proxy enforces it on both the public name and the internal alias the moment it serves the route. The hand-authored file stands until the proxy it configures retires.

Companion to mesh-controller's route-proxy PR of the same branch name.

**step-ca offers a second seat, `internal-acme-ca`**, beside its existing `acme-ca` — the same directory and roots, distinctly named so route-proxy can require both authorities at once (one bind per provision name). route-proxy binds it into `INTERNAL_ACME_DIRECTORY`/`INTERNAL_ACME_CA_BUNDLE` with its own trust step, mirroring the public one. **gitea's `/api/internal` refusal moves into its route contribution** (ADR 0108: a route carries the policy applied to a request). The 2026-09-12 incident-response file in the predecessor's dynamic directory said its durable home is the mesh's routing — this is that. route-adapter skips the port-less contribution aloud (nothing to write); route-proxy enforces it on both the public name and the internal alias the moment it serves the route. The hand-authored file stands until the proxy it configures retires. Companion to mesh-controller's route-proxy PR of the same branch name.

jschoubben added 2 commits 2026-09-25 18:52:13 +00:00

route-proxy: internal names are certified by the mesh's own authority 962cba7c04

Two name spaces, two authorities (08-connectivity §2): a public name is
certified by a public CA, an internal one by the mesh's own. step-ca now
offers that second seat as internal-acme-ca beside its existing acme-ca,
and route-proxy requires both — the server dispatches by which authority
may certify the name at all, so an .internal alias stops being plain-HTTP
only without ever asking a public CA for a name it cannot validate.

gitea: the internal-API refusal is part of the route, not a file beside the proxy c2353fc0a6

The 2026-09-12 incident response blocked /api/internal by hand in the
predecessor's dynamic directory, with a note that its durable home is the
mesh's routing. A route carries the policy applied to a request (ADR
0108), so the refusal now travels with the grant: route-proxy enforces
it on both the public name and the internal alias the moment it serves
this route, and the adapter skips it aloud (no port, nothing to write)
while the predecessor's own file still stands. The hand-authored file
retires with the proxy it configures.

jschoubben merged commit bbd1723612 into main

2026-09-25 19:55:33 +00:00

jschoubben deleted branch feat/route-proxy-internal-acme

2026-09-25 19:55:33 +00:00

jschoubben referenced this pull request

2026-09-26 16:20:54 +00:00

Six modules name no /var/lib: the root is a place, the maps reference it #104

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#70