MarioGLealP/drive-rag
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: optional mTLS for felt-core only (WP-62 M2b B5.2) #1

Merged
MarioGLealP merged 2 commits from benylin/wp62-m2b-b52-mtls AGit into main 2026-10-07 22:11:13 +01:00
Conversation 0 Commits 2 Files Changed 5
+394 -3
MarioGLealP commented 2026-10-07 18:00:57 +01:00
Owner
Copy link
Copy source

Off unless DRIVE_RAG_TLS_BUNDLE is set (plain HTTP as before), so this ships
ahead of the switch.

  • server/mtls.py: the same module as felt-voice's (B5.1): uvicorn with TLS
    1.3, client cert required against DRIVE_RAG_TLS_CA (the pki_felt
    intermediate, partial chain - never the root); the peer must carry exactly
    one SPIFFE URI from DRIVE_RAG_TLS_ALLOWED (default felt-core), checked before
    any request byte; the server cert reloads when the bundle is renewed.
  • server/serve.py: the entry point (Dockerfile CMD) - plain uvicorn or mTLS.
  • tests/test_mtls.py: real test PKI (name-constrained intermediate): felt-core
    in; no cert, another Felt identity, wrong CA, TLS 1.2 refused; a renewed cert
    is picked up without a restart. 6 pass. CI runs them.

Co-Authored-By: Claude Opus 5.5 (1M context) [email protected]
Claude-Session: https://claude.ai/code/session_015bTPg3qG72vYPLBigJks5h

Off unless DRIVE_RAG_TLS_BUNDLE is set (plain HTTP as before), so this ships ahead of the switch. - server/mtls.py: the same module as felt-voice's (B5.1): uvicorn with TLS 1.3, client cert required against DRIVE_RAG_TLS_CA (the pki_felt intermediate, partial chain - never the root); the peer must carry exactly one SPIFFE URI from DRIVE_RAG_TLS_ALLOWED (default felt-core), checked before any request byte; the server cert reloads when the bundle is renewed. - server/serve.py: the entry point (Dockerfile CMD) - plain uvicorn or mTLS. - tests/test_mtls.py: real test PKI (name-constrained intermediate): felt-core in; no cert, another Felt identity, wrong CA, TLS 1.2 refused; a renewed cert is picked up without a restart. 6 pass. CI runs them. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_015bTPg3qG72vYPLBigJks5h
MarioGLealP merged commit efdd81f60e into main 2026-10-07 22:11:13 +01:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
MarioGLealP (Mario Leal)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: MarioGLealP/drive-rag#1