mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-10-25 21:20:25 +00:00
Anso
c02dfa4fdd
* feat: listen with HTTPS so Pilot credential delivery stays confidential When the control instance is not behind a reverse proxy, cert and key files opt the process into an HTTPS listener so Pilot tunnels are encrypted. Enrollment emits an https URL and an optional CA bind-mount. Pilot agents ignore those cert files so loopback replay stays HTTP. * fix: verify native TLS health probes against the public URL Keep certificate verification on for the loopback HEALTHCHECK. Dial 127.0.0.1, check identity against SENCHO_PUBLIC_URL, and trust SENCHO_TLS_CA_FILE when set. * fix: trust HEALTHCHECK CA via the process store, not the request Private-issuer PEM is added with tls.setDefaultCACertificates so the loopback HTTPS probe never puts file bytes into https.get options.