Expand description
Per-upstream TLS identities — mTLS to upstream backends.
An UpstreamTls bundles what an upstream node needs to talk to a
mutual-TLS or private-PKI backend: an optional client cert/key pair, an
optional CA bundle (which replaces the native roots for that upstream),
and the verify flag. Materials are read, parsed, and dry-built into a
rustls config once at policy-compile time, so bad files fail the policy
load rather than a live request.
Consumers cache built clients/connectors keyed by UpstreamTls::cache_key,
a hash of the PEM contents + flags: rotated cert files hash to a new key
and naturally get a fresh connection pool after a config reload. Cache and
registry entries are never evicted; the population is bounded by the number
of distinct identities ever configured, which is small in practice.
Structs§
Functions§
- registry 🔒
- Process-wide identity registry, so code that only sees JSON context values (the WebSocket relay) can resolve an identity from its cache key.