feat(resources): add backend TLS options #7

Merged

ryan.mcgee merged 27 commits from feat/backend-tls into main

2026-10-15 18:07:08 +00:00

ryan.mcgee commented

2026-10-13 20:19:12 +00:00

Owner

Summary

HTTP resources can control how Traefik verifies the certificates of their https targets: a custom CA, a server name, or skipping verification.
Stacked on #6 (feat/custom-headers); retarget to main once #2 to #6 are merged.

Changes

Migration adds backend_tls_server_name, backend_tls_skip_verify and backend_tls_ca to resources. Columns only, so it is portable and reversible.
BackendTls is the single definition of valid settings, shared by the changeset and the renderer. The CA is parsed and stored re-encoded, so only the validated certificates are kept (never text around them); private keys and other PEM objects are refused; at most 64 KB and 20 certificates. A server name must be a host name. Skipping verification cannot be combined with a CA or server name.
DynamicConfig adds a serversTransports entry (st-<id>) only for resources that deviate from the defaults, and every service of the resource names it. A resource whose stored settings fail validation is not served at all, rather than served with weaker verification.
UI: a Backend TLS fieldset on the resource form (HTTP only) with a warning on skip-verify, a summary line on the resource page, and a red badge when verification is off.
TCP/UDP resources always have the defaults. README section.

Verification

618 tests pass on SQLite and PostgreSQL; format, compile --warnings-as-errors, credo --strict clean; mix dialyzer 0 errors on both backends.
Migration up, down, up on populated databases on both backends: row counts unchanged, columns dropped and restored, SQLite integrity and foreign-key checks clean.
Real Traefik against a backend whose certificate is signed by a private CA: no settings fail (certificate signed by unknown authority, HTTP 500); skip-verify works; the CA alone works; the CA with a matching server name works; the CA with a server name the certificate is not valid for fails (certificate is valid for backend.internal, tlsbackend, not other.internal). All objects loaded with zero errors. Also exercised in the browser: a bad server name is rejected inline, then the saved resource routes with HTTP 200.
Not exercised live: http targets on a resource with TLS settings, and certificate expiry (not checked when saving).

Not included

Client certificates (mutual TLS to the backend).

## Summary - HTTP resources can control how Traefik verifies the certificates of their `https` targets: a custom CA, a server name, or skipping verification. - Stacked on #6 (`feat/custom-headers`); retarget to `main` once #2 to #6 are merged. ## Changes - Migration adds `backend_tls_server_name`, `backend_tls_skip_verify` and `backend_tls_ca` to resources. Columns only, so it is portable and reversible. - `BackendTls` is the single definition of valid settings, shared by the changeset and the renderer. The CA is parsed and stored **re-encoded**, so only the validated certificates are kept (never text around them); private keys and other PEM objects are refused; at most 64 KB and 20 certificates. A server name must be a host name. Skipping verification cannot be combined with a CA or server name. - `DynamicConfig` adds a `serversTransports` entry (`st-<id>`) only for resources that deviate from the defaults, and every service of the resource names it. A resource whose stored settings fail validation is not served at all, rather than served with weaker verification. - UI: a Backend TLS fieldset on the resource form (HTTP only) with a warning on skip-verify, a summary line on the resource page, and a red badge when verification is off. - TCP/UDP resources always have the defaults. README section. ## Verification - 618 tests pass on SQLite and PostgreSQL; format, `compile --warnings-as-errors`, `credo --strict` clean; `mix dialyzer` 0 errors on both backends. - Migration up, down, up on populated databases on both backends: row counts unchanged, columns dropped and restored, SQLite integrity and foreign-key checks clean. - Real Traefik against a backend whose certificate is signed by a private CA: no settings fail (`certificate signed by unknown authority`, HTTP 500); skip-verify works; the CA alone works; the CA with a matching server name works; the CA with a server name the certificate is not valid for fails (`certificate is valid for backend.internal, tlsbackend, not other.internal`). All objects loaded with zero errors. Also exercised in the browser: a bad server name is rejected inline, then the saved resource routes with HTTP 200. - Not exercised live: `http` targets on a resource with TLS settings, and certificate expiry (not checked when saving). ## Not included - Client certificates (mutual TLS to the backend).

ryan.mcgee added 1 commit

2026-10-13 20:19:12 +00:00

feat(resources): add backend TLS options f89423bceb

- HTTP resources can set a CA certificate, a server name, or skip
  verification of the certificates of their https targets
- the CA is parsed and stored re-encoded, so only validated
  certificates are kept; private keys and other PEM objects are
  refused
- skipping verification cannot be combined with a CA or server name
- a resource gets a Traefik serversTransport only when its settings
  deviate from the defaults; a resource whose stored settings are
  invalid is not served rather than served with weaker verification
- a Backend TLS fieldset on the resource form, and a flag on the
  resource page when verification is off

ryan.mcgee referenced this pull request

2026-10-13 20:35:25 +00:00

feat(api): add API keys and the integration API #8

ryan.mcgee changed target branch from feat/custom-headers to main

2026-10-15 18:07:02 +00:00

ryan.mcgee added 1 commit

2026-10-15 18:07:05 +00:00

merge main into feat/backend-tls bdb0cd3c58

ryan.mcgee merged commit 150de44c9c into main

2026-10-15 18:07:08 +00:00

ryan.mcgee referenced this pull request from a commit

2026-10-15 18:07:09 +00:00