This repository has been archived on 2026-11-02. You can view files and clone it. You cannot open issues or pull requests or push a commit.

jschoubben 5fad1f89cf route-proxy: a second authority for internal names, and a target a route names the scheme of ...

Internal aliases were served over plain HTTP only — correctly refused a
public certificate (no public CA can validate a private name), and then
left with nothing. The mesh has two authorities for its two name spaces
(08-connectivity §2), so the proxy now takes an optional internal ACME
directory and dispatches at the handshake by the same question HostPolicy
already answers: which authority may certify this name at all.

A route may also say its target speaks https, with insecure for a backend
whose own certificate nothing would trust — the shape Mailu's webmail
front needs, and the exception: everything else the mesh hands this proxy
stays plain http on the private network.

2026-09-25 20:37:03 +02:00

..

authority_test.go

route-proxy: an ACME account belongs to the authority that issued it

2026-09-10 21:02:00 +02:00

Dockerfile

A route is a grant, and a provider is told where its consumer is

2026-08-31 02:43:19 +02:00

main.go

route-proxy: a second authority for internal names, and a target a route names the scheme of

2026-09-25 20:37:03 +02:00

policy_test.go

route-proxy serves a route's internal-name alias, never certifies it

2026-09-25 17:24:13 +02:00

routes_test.go

route-proxy: a second authority for internal names, and a target a route names the scheme of

2026-09-25 20:37:03 +02:00