Repository navigation
feat: multi-tenant serve, core library split, crates.io publishing - #2
Merged
Merged
Conversation
…nnect The clap, ratatui and crossterm dependencies now sit behind a default-on `cli` feature so embedders can build the tunnel library without them. run_serve_with_shutdown and run_connect_with_shutdown take a CancellationToken and return once every listener, session and tunnelled connection has been stopped. run_serve and run_connect are unchanged.
…crate The command-line interface and terminal UI move to the erbridge crate, so embedders depend on erbridge-core and pull in neither clap nor ratatui. This replaces the `cli` feature gate, which could be re-enabled by feature unification elsewhere in a build graph. Version now lives in [workspace.package]; the release workflow bumps both crates' Cargo.lock entries. Install with `cargo install --path crates/erbridge`.
… tenant file write - time out the Noise handshake after 5 s and cap unauthenticated control connections at 256 - compare PSKs in constant time everywhere - Tenant, EnrollCode and Credentials no longer print their secret in Debug - remove a stale or failed temp file before and after writing the tenant file - refuse to issue an enrollment code for a host a tenant already holds
- tenant_serve locks recover from poisoning instead of panicking every later connection - connections refused for lack of handshake slots are logged once and then every thousandth
…disable race, pin actions - one address may hold at most 16 handshake slots - a tenant whose credentials could not be delivered is withdrawn again - a session registered after its tenant was removed or disabled is ended at once - redeeming a code also drops expired codes - pin every action to a commit SHA, add concurrency and an actionlint step - spec: describe reload as a once-a-second re-read
… constant time Tenant, EnrollCode, the candidate list and the noise API take a Psk instead of a bare [u8; 32]; the hand-written Debug impls and constant_time_eq calls for PSKs are no longer needed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a multi-tenant mode to
serve: many users on one server, each with their own token and hostname, routed by TLS SNI without decrypting the traffic. Splits the repo into anerbridge-corelibrary and anerbridgebinary crate, and adds CI plus crates.io publishing to the release workflow.serve(serve --tenants FILE --sni-listen ADDR): the Noise handshake tries each tenant's PSK, so a client never states who it is and the wire format is unchanged. The tunnel name is chosen byserve, so a client cannot reach another tenant's target. Per-tenantmax_conns, live reload of the tenant file, and a new session replaces the tenant's old one.serve-admin issuemakes a single-use code,enrolltrades it for credentials,connect --credentialsuses them.serve-adminalso haslist,disable,enableandrevoke.erbridge-corehas no CLI/TUI dependencies;run_serve_with_shutdown/run_connect_with_shutdownstop cleanly on aCancellationToken;Registry::subscribegives structured events;TenantStorelets a host keep tenants elsewhere than a file.ci.yml(fmt, clippy, tests on Linux and macOS, MSRV, publish dry run, release-script tests);release.ymlpicks the next version from Conventional Commits (auto, still overridable) and publishes both crates to crates.io after the GitHub release.Design and the ten tickets are in
docs/multi-tenant/.Compatibility
Old and new builds interoperate; I checked v0.2.0 binaries against this branch in both directions for
serve/connect(single-tenant and multi-tenant) andforward/clientover noise. The CLI and config files are unchanged. Library users: the crate is nowerbridge_core, andServeConfiggained two fields (see "Upgrading" in the README). Release as minor (0.3.0).Test plan
cargo fmt --check,cargo clippy --workspace --all-targets -- -D warningscargo test --workspace(core integration tests with real TLS clients and servers, plus end-to-end tests that run the real binary)cargo publish --workspace --dry-runopensslandcurlCARGO_REGISTRY_TOKENis set