feat(orchestrator): slice 13c(vii) — stable shared gateway CA #377

Closed

didericis-claude wants to merge 1 commits from orchestrator-gateway-ca into orchestrator-consolidated-launch

Author	SHA1	Message	Date
didericis	389a2c10ce	feat(orchestrator): slice 13c(vii) — stable shared gateway CA lint / lint (push) Successful in 2m4s Details test / unit (pull_request) Successful in 1m2s Details test / integration (pull_request) Successful in 20s Details test / coverage (pull_request) Successful in 1m13s Details The consolidated gateway TLS-intercepts every bottle, so all agents must trust ONE CA. Rather than host-generate + mount a CA, let the gateway's own mitmproxy generate its CA into a persistent named volume and extract the cert for agents — no host openssl, keeps gateway.py lean. - DockerGateway mounts GATEWAY_CA_VOLUME at /home/mitmproxy/.mitmproxy so the self-generated CA survives container recreation (it must not rotate, or already-launched agents would stop trusting the gateway). - ca_cert_pem(): read the CA cert (PEM) out of the running gateway (docker exec cat mitmproxy-ca-cert.pem) — the agent installs this into its trust store to accept the gateway's bumped certs. pyright 0 errors; pylint 9.83/10; unit suite green (the 13 test_sidecar_init /bin/sleep errors are pre-existing NixOS-local noise). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck	2026-07-13 22:12:18 -04:00

Author

SHA1

Message

Date

didericis

389a2c10ce

feat(orchestrator): slice 13c(vii) — stable shared gateway CA

lint / lint (push) Successful in 2m4s

Details

test / unit (pull_request) Successful in 1m2s

Details

test / integration (pull_request) Successful in 20s

Details

test / coverage (pull_request) Successful in 1m13s

Details

The consolidated gateway TLS-intercepts every bottle, so all agents must
trust ONE CA. Rather than host-generate + mount a CA, let the gateway's own
mitmproxy generate its CA into a persistent named volume and extract the
cert for agents — no host openssl, keeps gateway.py lean.

- DockerGateway mounts GATEWAY_CA_VOLUME at /home/mitmproxy/.mitmproxy so the
  self-generated CA survives container recreation (it must not rotate, or
  already-launched agents would stop trusting the gateway).
- ca_cert_pem(): read the CA cert (PEM) out of the running gateway
  (docker exec cat mitmproxy-ca-cert.pem) — the agent installs this into its
  trust store to accept the gateway's bumped certs.

pyright 0 errors; pylint 9.83/10; unit suite green (the 13 test_sidecar_init
/bin/sleep errors are pre-existing NixOS-local noise).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

2026-07-13 22:12:18 -04:00

feat(orchestrator): slice 13c(vii) — stable shared gateway CA #377

1 Commits