MarioGLealPandClaude Opus 5.5
84807850ec
CI / test (pull_request) Successful in 27s
Off unless DRIVE_RAG_TLS_BUNDLE is set (plain HTTP as before), so this ships ahead of the switch. - server/mtls.py: the same module as felt-voice's (B5.1): uvicorn with TLS 1.3, client cert required against DRIVE_RAG_TLS_CA (the pki_felt intermediate, partial chain - never the root); the peer must carry exactly one SPIFFE URI from DRIVE_RAG_TLS_ALLOWED (default felt-core), checked before any request byte; the server cert reloads when the bundle is renewed. - server/serve.py: the entry point (Dockerfile CMD) - plain uvicorn or mTLS. - tests/test_mtls.py: real test PKI (name-constrained intermediate): felt-core in; no cert, another Felt identity, wrong CA, TLS 1.2 refused; a renewed cert is picked up without a restart. 6 pass. CI runs them. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_015bTPg3qG72vYPLBigJks5h
38 lines
1.2 KiB
Python
38 lines
1.2 KiB
Python
"""drive-rag's entry point: plain uvicorn, or mTLS when DRIVE_RAG_TLS_BUNDLE is
|
|
set (WP-62 M2b B5.2). Settings from the environment:
|
|
|
|
DRIVE_RAG_TLS_BUNDLE server bundle.pem (key + cert + intermediate)
|
|
DRIVE_RAG_TLS_CA felt-ca.pem (the pki_felt intermediate)
|
|
DRIVE_RAG_TLS_ALLOWED allowed client SPIFFE URIs, comma-separated
|
|
(default: felt-core)
|
|
"""
|
|
|
|
import logging
|
|
import os
|
|
|
|
import uvicorn
|
|
|
|
from server.app import app
|
|
|
|
FELT_CORE = "spiffe://clockmost.internal/workload/felt-core"
|
|
|
|
|
|
def main() -> None:
|
|
logging.basicConfig(level=logging.INFO, format="%(levelname)s %(name)s: %(message)s")
|
|
host, port = "0.0.0.0", 8000
|
|
bundle = os.environ.get("DRIVE_RAG_TLS_BUNDLE")
|
|
if not bundle:
|
|
uvicorn.run(app, host=host, port=port)
|
|
return
|
|
ca = os.environ.get("DRIVE_RAG_TLS_CA") or ""
|
|
if not ca:
|
|
raise SystemExit("DRIVE_RAG_TLS_BUNDLE is set but DRIVE_RAG_TLS_CA isn't")
|
|
allowed = [u.strip() for u in os.environ.get("DRIVE_RAG_TLS_ALLOWED", FELT_CORE).split(",") if u.strip()]
|
|
from server import mtls
|
|
|
|
mtls.serve(app, host, port, bundle, ca, allowed)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|