feat(relay): native TLS + CLI identity polish - #20
Merged
Merged
Conversation
The documented recommendation was a TLS terminator in front of 3340; wiring iroh-relay's TlsConfig through serve() was listed as future work. This implements it: - RelayTls::Manual — PEM cert chain + key via rustls ring provider. - RelayTls::LetsEncrypt — in-process ACME (TLS-ALPN-01) with a certificate cache dir so restarts do not re-issue and hit LE rate limits. - Both rds-server and rds-relay gain --tls-cert/--tls-key, --tls-acme-*, --tls-https-addr (default 3443 — the unprivileged systemd unit cannot bind 443). - tls_from_flags() shares flag validation between the two binaries. - HTTP port keeps serving only the captive-portal probe; /healthz (built into iroh-relay) is documented for monitoring. - Deployment doc + unit comments updated; smoke-verified: HTTPS listener serves /healthz 200 over real TLS. Also changelog entry covering this and the merged lifecycle fixes.
- rds id is a pure function of the secret key — it no longer binds a socket or contacts a relay (13ms, offline). With no resolvable key file it now refuses clearly instead of printing a fresh ephemeral endpoint id on every run. - rds ticket bounds its online() wait at 15s: an unreachable relay previously hung the command forever; now it warns and still prints the ticket with whatever addresses resolved.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the TLS recommendation from the deployment doc (was listed as future work):
rds-server/rds-relay:--tls-cert/--tls-keyfor PEM files (rustlsringprovider — no new C deps) or in-process Let's Encrypt (--tls-acme-*, TLS-ALPN-01). HTTPS binds--tls-https-addr(default 3443; unit can't bind 443 unprivileged). HTTP port keeps only the captive-portal probe;/healthzdocumented for monitoring.rds idis now key-only: instant (13ms), offline, and refuses clearly when no key resolves — previously it bound a full endpoint and could print a fresh ephemeral id per run.rds ticketboundsonline()at 15s — a dead relay no longer hangs it forever.Test plan
rds-relay --tls-cert/--tls-keyserves/healthz200 over real TLSrds idstable across runs, no socket bind; clap validation (--tls-certwithout--tls-key, ACME without cache) verifiedGenerated with Devin