Paul Payne
3c566540aa
Expose raw-TCP services (postgres) by name at <name>.<domain>:<port> and
cut the gateway's ACME wildcard cert onto them so they present a trusted
cert. Replaces the proxy/public booleans with a single `reach` enum
(off|internal|public); legacy input still parses via derived accessors.
Core:
- expose.tcp{port,tls} + TlsSpec(material: pair|combined|off, reload)
- tls.py: materialize cert files from Caddy's wildcard, reconcile on
renewal; `castle tls` CLI; optional cert_obtained events-exec hook
(gateway.cert_hook, gated so a plugin-less Caddy still parses)
- apply waits (bounded) for the wildcard to issue before materializing so
a fresh-node TLS service starts with its cert in place, then scopes
materialization to the deployments being applied
- reach: internal|public requires an expose block (no silent no-op);
public raw-TCP guarded until tunnel support lands
- chain.pem (${tls_ca}) is the issuer chain (leaf stripped), a real CA
bundle distinct from cert.pem
- one shared ${...} resolver (resolve_placeholders) for env and container
run fields; run.env now expands like volumes/args; $$ escapes a literal
- validate the generated Caddyfile before reloading the gateway so an
invalid config never degrades routing
Docs: docs/tcp-exposure.md. Tests cover reach/expose validation,
placeholder expansion + escape, issuer-chain material, TLS materialize.
34 lines
695 B
Python
34 lines
695 B
Python
"""Re-export from castle-core for backward compatibility."""
|
|
|
|
from castle_core.manifest import * # noqa: F401, F403
|
|
from castle_core.manifest import ( # noqa: F401 — explicit re-exports for type checkers
|
|
BuildSpec,
|
|
CaddyDeployment,
|
|
Capability,
|
|
CommandsSpec,
|
|
DefaultsSpec,
|
|
DeploymentBase,
|
|
DeploymentSpec,
|
|
EnvMap,
|
|
ExposeSpec,
|
|
HttpExposeSpec,
|
|
HttpInternal,
|
|
LaunchBase,
|
|
LaunchSpec,
|
|
ManageSpec,
|
|
PathDeployment,
|
|
ProgramSpec,
|
|
Reach,
|
|
ReadinessHttpGet,
|
|
RemoteDeployment,
|
|
RestartPolicy,
|
|
RunCommand,
|
|
RunCompose,
|
|
RunContainer,
|
|
RunNode,
|
|
RunPython,
|
|
SystemdDeployment,
|
|
SystemdSpec,
|
|
kind_for,
|
|
)
|