didericis/bot-bottle
1
0
Fork 0
Code Issues 25 Pull Requests 9 Actions Packages Projects Releases Wiki Activity

feat(orchestrator): slice 13c(vii) — stable shared gateway CA #377

Closed
didericis-claude wants to merge 1 commits from orchestrator-gateway-ca into orchestrator-consolidated-launch
pull from: orchestrator-gateway-ca
merge into: didericis:orchestrator-consolidated-launch
Conversation 1 Commits 1 Files Changed 2
+41
didericis-claude commented 2026-07-13 22:12:19 -04:00
Collaborator
Copy Link
Copy Source

Sub-slice of slice 13c — the one genuine design piece in the cut-over: a single CA every agent trusts.

The consolidated gateway TLS-intercepts every bottle's egress, so all agents must trust one CA (per-bottle each had its own host-generated CA). Rather than host-generate + mount one, this lets the gateway's own mitmproxy generate its CA into a persistent named volume and extracts the cert for agents — no host openssl, and gateway.py stays lean.

Changes

  • DockerGateway mounts GATEWAY_CA_VOLUME at /home/mitmproxy/.mitmproxy, so the self-generated CA survives container recreation — it must not rotate, or already-launched agents would stop trusting the gateway.
  • ca_cert_pem() reads the CA cert (PEM) out of the running gateway (docker exec cat mitmproxy-ca-cert.pem); the agent-launch installs this into the agent's trust store so it accepts the gateway's bumped CONNECT certs.

Verification

pyright 0 errors, pylint 9.83/10 (changed files 10.00), unit suite green (the 13 test_sidecar_init /bin/sleep errors are pre-existing NixOS-local noise). New tests: runs with the persistent CA volume, ca_cert_pem reads the container path, raises when absent.

Stacked on #376.

🤖 Generated with Claude Code

Sub-slice of **slice 13c** — the one genuine design piece in the cut-over: a **single CA every agent trusts**. The consolidated gateway TLS-intercepts every bottle's egress, so all agents must trust one CA (per-bottle each had its own host-generated CA). Rather than host-generate + mount one, this lets the gateway's own **mitmproxy generate its CA into a persistent named volume** and extracts the cert for agents — no host openssl, and `gateway.py` stays lean. ### Changes - `DockerGateway` mounts `GATEWAY_CA_VOLUME` at `/home/mitmproxy/.mitmproxy`, so the self-generated CA **survives container recreation** — it must not rotate, or already-launched agents would stop trusting the gateway. - `ca_cert_pem()` reads the CA cert (PEM) out of the running gateway (`docker exec cat mitmproxy-ca-cert.pem`); the agent-launch installs this into the agent's trust store so it accepts the gateway's bumped CONNECT certs. ### Verification pyright **0 errors**, pylint **9.83/10** (changed files 10.00), unit suite green (the 13 `test_sidecar_init` `/bin/sleep` errors are pre-existing NixOS-local noise). New tests: runs with the persistent CA volume, `ca_cert_pem` reads the container path, raises when absent. Stacked on #376. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
didericis-claude added 1 commit 2026-07-13 22:12:20 -04:00
feat(orchestrator): slice 13c(vii) — stable shared gateway CA
lint / lint (push) Successful in 2m4s
Details
test / unit (pull_request) Successful in 1m2s
Details
test / integration (pull_request) Successful in 20s
Details
test / coverage (pull_request) Successful in 1m13s
Details
389a2c10ce 
The consolidated gateway TLS-intercepts every bottle, so all agents must
trust ONE CA. Rather than host-generate + mount a CA, let the gateway's own
mitmproxy generate its CA into a persistent named volume and extract the
cert for agents — no host openssl, keeps gateway.py lean.

- DockerGateway mounts GATEWAY_CA_VOLUME at /home/mitmproxy/.mitmproxy so the
  self-generated CA survives container recreation (it must not rotate, or
  already-launched agents would stop trusting the gateway).
- ca_cert_pem(): read the CA cert (PEM) out of the running gateway
  (docker exec cat mitmproxy-ca-cert.pem) — the agent installs this into its
  trust store to accept the gateway's bumped certs.

pyright 0 errors; pylint 9.83/10; unit suite green (the 13 test_sidecar_init
/bin/sleep errors are pre-existing NixOS-local noise).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck
didericis-claude commented 2026-07-14 00:57:44 -04:00
Author
Collaborator
Copy Link
Copy Source

Collapsed into the single stack PR #380 (per-host orchestrator, PRD 0070). Closing this slice PR; review + merge happens on #380.

Collapsed into the single stack PR #380 (per-host orchestrator, PRD 0070). Closing this slice PR; review + merge happens on #380.
didericis-claude closed this pull request 2026-07-14 00:57:45 -04:00
Some checks are pending
lint / lint (push) Successful in 2m4s
Details
test / unit (pull_request) Successful in 1m2s
Details
test / integration (pull_request) Successful in 20s
Details
test / coverage (pull_request) Successful in 1m13s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
didericis-claude (didericis (claude)) didericis-codex (didericis (codex)) didericis-gemma (gemma) didericis
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: didericis/bot-bottle#377
Delete Branch "orchestrator-gateway-ca"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?