6651c14adc
m11p7 — secure the cluster, all opt-in (pre-m11p7 byte-for-byte):
- gRPC replication mTLS by default via a custom tokio-rustls acceptor +
DynamicCertResolver; zero-drop content-hash cert rotation (k8s ..data swap,
no pod restart, no inotify)
- inter-node HTTP TLS sharing the same resolver (one rotation, both planes) +
per-node keyed-BLAKE3 signed x-tidal-node-token; marker-without-token -> 403
- admin audit log (operator-leg only) + per-principal rate limit (engine
RateLimiter; sibling nodes exempt)
- k8s cert-manager manifest (certs.yaml) + scripts/gen-cluster-certs.sh fallback;
secret.example.yaml gains TIDAL_CLUSTER_KEY (file-mounted, hot-rotatable)
- exit gate verified real: mtls.rs (gRPC foreign-pod), cluster_security.rs
(HTTP foreign + zero-drop rotation under load), 7 security unit tests
perf — instrument floor (sweep Wave 1):
- new tidal/benches/wal.rs + tidal-server/benches/scatter.rs
- p99->mean honesty relabel; sweep manifest at docs/reviews/perf-sweep-2026-06-13.md
- add @tidal-performance agent (Martin Thompson)
new: cluster/{audit,http_tls,security}.rs, tests/cluster_security.rs,
docs/planning/milestone-11/phase-7.md
73 lines
3.1 KiB
TOML
73 lines
3.1 KiB
TOML
[package]
|
|
name = "tidal-net"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
description = "gRPC network transport for tidalDB WAL segment shipping"
|
|
|
|
# ── tidal-crate lint posture (single source of truth) ──────────────────────
|
|
# IDENTICAL block across tidaldb / tidal-net / tidal-server / tidalctl. These
|
|
# crates deliberately DO NOT inherit `[workspace.lints]`; they hold the embedded
|
|
# recommendation DB + its transport/server/CLI to a stricter correctness bar
|
|
# (`unsafe_code = forbid`, `clippy::all = deny`, `unwrap_used = deny`). A network
|
|
# transport crate especially must gate unsafe + unwrap.
|
|
# `unwrap_used = "deny"` is kept per-crate rather than in `[workspace.lints]`
|
|
# because the workspace also hosts the example/consumer crates under
|
|
# `applications/` (not held to the engine's bar). Keep these four blocks BYTE-IDENTICAL.
|
|
[lints.rust]
|
|
unsafe_code = "forbid"
|
|
|
|
[lints.clippy]
|
|
all = { level = "deny", priority = -1 }
|
|
pedantic = { level = "warn", priority = -1 }
|
|
nursery = { level = "warn", priority = -1 }
|
|
# Justified allows (lossy numeric casts are pervasive + intentional in the
|
|
# ranking/scoring math; module_name_repetitions is idiomatic for the flat
|
|
# module layout documented in CLAUDE.md):
|
|
cast_possible_truncation = "allow"
|
|
module_name_repetitions = "allow"
|
|
unwrap_used = "deny"
|
|
|
|
[dependencies]
|
|
tidaldb = { path = "../tidal" }
|
|
tonic = { version = "0.12", features = ["tls", "tls-roots"] }
|
|
prost = "0.13"
|
|
tokio = { version = "1", features = ["rt-multi-thread", "sync", "time", "net"] }
|
|
tokio-stream = "0.1"
|
|
# Direct rustls dep with an explicit crypto provider. tonic pulls rustls only
|
|
# transitively (no provider feature in tidal-net's own closure), so the
|
|
# process-level default CryptoProvider is otherwise absent/ambiguous and the
|
|
# mTLS path panics ("Could not automatically determine the process-level
|
|
# CryptoProvider"). `transport::ensure_crypto_provider` installs this aws-lc-rs
|
|
# provider idempotently at GrpcTransport construction. See BUILD.bazel.
|
|
rustls = { version = "0.23", features = ["aws_lc_rs"] }
|
|
# m11p7 cert hot-rotation: the inbound gRPC server is served over a custom
|
|
# `tokio-rustls` acceptor (NOT tonic's fixed `.tls_config()`) so a
|
|
# `ResolvesServerCert` backed by `arc-swap` can hot-swap the node's identity
|
|
# with ZERO connection drop — tonic 0.12 caches a fixed `Arc<ServerConfig>` and
|
|
# exposes no resolver hook. `rustls-pemfile` parses the PEM files the resolver
|
|
# (re)reads on rotation. `tonic` already implements `Connected` for
|
|
# `tokio_rustls::server::TlsStream`, so accepted streams feed
|
|
# `serve_with_incoming` directly and the peer client-cert surfaces in request
|
|
# extensions for inter-node identity.
|
|
tokio-rustls = "0.26"
|
|
rustls-pemfile = "2"
|
|
arc-swap = "1"
|
|
tracing = "0.1"
|
|
thiserror = "2"
|
|
|
|
[build-dependencies]
|
|
tonic-build = "0.12"
|
|
|
|
[dev-dependencies]
|
|
blake3 = "1"
|
|
criterion = { version = "0.5", features = ["html_reports"] }
|
|
rcgen = "0.13"
|
|
tempfile = "3"
|
|
tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
|
|
|
|
[[bench]]
|
|
name = "transport_throughput"
|
|
harness = false
|