feat(web): tighten setup-mode gating and add settings.tls connection config #40

Merged

David merged 1 commit from feat/setup-gate-and-tls-config into main

2026-06-06 02:42:03 +02:00

David commented

2026-06-06 02:38:55 +02:00

Owner

What

Reworks onboarding gating and moves connection configuration into config.json.

Setup mode (tightened)

/api/setup and /api/setup/register are active only when ALL of these hold: (1) VERVAIN_SETUP_ENABLE=true, (2) config.json does not exist, (3) no user account exists yet. Any failed condition returns 404 (the old existing-user 403 and the needs_first_user: false probe response are both 404 now), so the registration surface closes itself the moment the first admin is created, a config.json is written, or the env var is cleared.

Connection configuration (`settings.tls`)

New config.json section, with env overrides so a fresh deployment without a config.json (i.e. during setup mode) behind a reverse proxy still works; env wins over config:

mode (VERVAIN_TLS_MODE): terminate (default; the server terminates TLS itself) or offload (a reverse proxy terminates TLS and the listener serves plain HTTP). Unlike dev mode, offload keeps Secure cookies and the strict agent handshake because clients still reach the server over https. The HTTP->HTTPS redirect listener is skipped in offload mode. Traefik can point its upstream at http://<host>:15443 with no serversTransport/skip-verify.
certUrl: config home for what VERVAIN_CERT_URL (VS-27) does; the env var still overrides.
insecureSkipHashCheck: agent handshake accepts any agent-reported server cert hash. Narrower than the dev-mode short-circuit: AuthVerify signature verification stays real, only the cert-pinning check is skipped. Debugging aid; keep false in production.

Naming is ours by design (not MeshCentral's tlsOffload/ignoreAgentHashCheck), per best-practice explicit enum + insecure- prefix.

Tests

meshcentral-config: settings.tls parsing (defaults, full section incl. key lower-casing, unknown mode, type errors, case-insensitive mode values).
agent_handshake: unknown hash accepted with skip_hash_check while a bad signature is still rejected.
tls_smoke: new offload listener test (plain HTTP serves, setup auto-login cookie keeps Secure).
setup: updated 404 contract (existing-user GET and register both 404; post-registration probe 404s).

All suites for meshcentral-config, meshcentral-web, and meshcentral pass; clippy clean; fmt clean (the two pre-existing boot.rs fmt diffs on main are untouched).

## What Reworks onboarding gating and moves connection configuration into config.json. ### Setup mode (tightened) `/api/setup` and `/api/setup/register` are active only when ALL of these hold: (1) `VERVAIN_SETUP_ENABLE=true`, (2) `config.json` does not exist, (3) no user account exists yet. Any failed condition returns 404 (the old existing-user 403 and the `needs_first_user: false` probe response are both 404 now), so the registration surface closes itself the moment the first admin is created, a config.json is written, or the env var is cleared. ### Connection configuration (`settings.tls`) New config.json section, with env overrides so a fresh deployment without a config.json (i.e. during setup mode) behind a reverse proxy still works; env wins over config: - `mode` (`VERVAIN_TLS_MODE`): `terminate` (default; the server terminates TLS itself) or `offload` (a reverse proxy terminates TLS and the listener serves plain HTTP). Unlike dev mode, offload keeps `Secure` cookies and the strict agent handshake because clients still reach the server over https. The HTTP->HTTPS redirect listener is skipped in offload mode. Traefik can point its upstream at `http://<host>:15443` with no serversTransport/skip-verify. - `certUrl`: config home for what `VERVAIN_CERT_URL` (VS-27) does; the env var still overrides. - `insecureSkipHashCheck`: agent handshake accepts any agent-reported server cert hash. Narrower than the dev-mode short-circuit: `AuthVerify` signature verification stays real, only the cert-pinning check is skipped. Debugging aid; keep `false` in production. Naming is ours by design (not MeshCentral's `tlsOffload`/`ignoreAgentHashCheck`), per best-practice explicit enum + insecure- prefix. ## Tests - `meshcentral-config`: `settings.tls` parsing (defaults, full section incl. key lower-casing, unknown mode, type errors, case-insensitive mode values). - `agent_handshake`: unknown hash accepted with `skip_hash_check` while a bad signature is still rejected. - `tls_smoke`: new offload listener test (plain HTTP serves, setup auto-login cookie keeps `Secure`). - `setup`: updated 404 contract (existing-user GET and register both 404; post-registration probe 404s). All suites for `meshcentral-config`, `meshcentral-web`, and `meshcentral` pass; clippy clean; fmt clean (the two pre-existing `boot.rs` fmt diffs on main are untouched).

David added 1 commit

2026-06-06 02:38:55 +02:00

feat(web): tighten setup-mode gating and add settings.tls connection config

Check / fmt + clippy + build + tests (pull_request) Failing after 4s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

103a84e460

Setup mode (VS-26 follow-up): /api/setup and /api/setup/register are now active only when VERVAIN_SETUP_ENABLE=true AND config.json does not exist AND no user account exists yet. Every failed condition returns 404 (the old existing-user 403 and the needs_first_user=false probe are both 404 now), so the registration surface closes itself the moment the first admin is created, a config.json is written, or the env var is cleared.

Connection configuration moves into a new settings.tls section of config.json, with env overrides so a fresh deployment without a config.json still works (env wins over config):

- mode (VERVAIN_TLS_MODE): "terminate" (default, server terminates TLS itself) or "offload" (a reverse proxy terminates TLS; the listener serves plain HTTP). Unlike dev mode, offload keeps Secure cookies and the strict agent handshake because clients still reach the server over https; the HTTP->HTTPS redirect listener is skipped.
- certUrl: config home for what VERVAIN_CERT_URL (VS-27) does today; the env var still overrides.
- insecureSkipHashCheck: the agent handshake accepts any agent-reported server cert hash. Narrower than the dev-mode short-circuit: AuthVerify signature verification stays real, only the cert-pinning check is skipped.

Covered by new tests: settings.tls parsing (modes, certUrl trim, type errors), handshake skip-hash-check (unknown hash accepted, bad signature still rejected), offload listener smoke test (plain HTTP with Secure setup cookie), and the updated setup 404 contract.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>