Conversation
openvox-edge is a small Go reverse proxy that terminates mTLS and enforces auth.conf-style authorization from a JSON ruleset (EDGE_AUTH_RULES) modeled on the operator's builtinAuthRules. It supports the dynamic allow "$1" catalog rule (client CN must equal the certname capture), literal certnames, "*", allow_unauthenticated, and pp_cli_auth/pp_* certificate-extension matching, then forwards the verified identity to a localhost backend via X-Client-* headers. This is the authorization front for the experimental non-JVM native server.
openvox-server-native pairs the openvox-edge Go proxy with a Puma/CRuby compile backend (backend/config.ru drives the same node=plain / catalog=compiler indirections as openvox-server's compiler.rb) to serve the SERVER role without JRuby or the JVM. OpenVox is installed as the openvox gem into a self-contained GEM_HOME (no RPM), the Ruby interpreter comes from the ubi ruby:3.3 module, and the image keeps the rootless/OpenShift conventions and :8140 mTLS surface of the JVM server. The CA role stays on the JVM puppetserver image, so this can be swapped in for server-only pods. Ships a demo control repo and self-bootstraps a PoC PKI when no operator certificate is mounted.
Suppress http.Server "TLS handshake error ... EOF / connection reset / broken pipe" lines from clients that close the socket before completing the handshake (health probes, port scans, load-balancer checks). Real mTLS failures -- bad or unknown client certificates -- are still logged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Experimental, additional server image that runs the server role (catalog compilation) on plain CRuby instead of the JRuby pool + JVM.
Shape:
cmd/edge(openvox-edge): small Go reverse proxy that terminates mTLS and does authorization from a JSON ruleset (EDGE_AUTH_RULES) modeled on the operatorsbuiltinAuthRules. Supports the dynamicallow "$1"catalog rule (client CN must equal the certname), literal certnames,,allow_unauthenticated, andpp_cli_auth/pp_cert-extension matching. Forwards the verified identity to the backend viaX-Client-*` headers.images/openvox-server-native: Go edge + a Puma/CRuby compile backend (backend/config.rudrives the samenode=plain/catalog=compilerindirections as openvox-serverscompiler.rb). OpenVox is installed as theopenvoxgem into a self-containedGEM_HOME(no RPM); the Ruby interpreter comes from the ubiruby:3.3module (Ruby 3.3.12). Keeps the rootless/OpenShift conventions and:8140` mTLS surface of the JVM image.Scope / intent:
auth-rules.jsonfrom the same authorization model it already renders as HOCONauth.conf.Verified locally (standalone
docker run, self-bootstrapped PoC PKI):200+ a real catalog compiled by CRuby (openvox 8.28.1)403(the dynamicallow "$1"rule)401Known gaps vs. the JVM server: CA endpoints delegated to the JVM CA, only a subset of the v3 API (catalog/node/file/report/environments/status), no PuppetDB termini wiring, and CRuby copy-on-write sharing erodes under GC at scale. Draft / proof-of-concept - opening for discussion, not for merge yet.