code wiki / _hdl_build / nx_consul_connect.nx
nx_consul_connect.nx
buildroot/runtime/_hdl_build/nx_consul_connect.nx
about
nx_consul_connect.nx -- sovereign service-mesh CONNECT mTLS + INTENTIONS (HashiCorp Consul Connect-class;
CONSUL-005, the arc capstone). Every service gets an identity cert issued by OUR CA (production: the vault
CA via nx_vault_transit/auth + ed25519/p256 signing). A mesh connection source->dest is authorized IFF:
(1) the peer presents a cert that is CA-ISSUED and whose identity == its claimed source service (mTLS), AND
(2) an INTENTION permits source->dest. Intentions are DEFAULT-DENY with EXPLICIT-DENY-WINS -- the secure
posture: no connection unless explicitly allowed, and a deny always overrides an allow.
Pure logic; cert validity is modeled as (issued-by-our-CA flag + identity match) -- the live signature check
is nx_ed25519/p256 against the vault CA pubkey. license_tier: ORIGINAL
dependencies 1 imports · 2 importers
imports: nx_syscalls.nx
imported by: nx_consul_connect_test.nxnx_consul_suite_test.nx
structs
| none |
consts
| 11 | const INTENT_DENY: i64 = 0 |
| 12 | const INTENT_ALLOW: i64 = 1 |
| 13 | const MESH_DENY: i64 = 0 |
| 14 | const MESH_ALLOW: i64 = 1 |
functions
| 18 | func mc_cert_valid(cert_service: i64, ca_signed: i64, claimed_source: i64) -> i64 |
| 25 | func mc_intention(srcs: *i64, dsts: *i64, acts: *i64, n: i64, src: i64, dst: i64) -> i64 |
| 40 | func mc_authorize(cert_service: i64, ca_signed: i64, claimed_source: i64, dest: i64, srcs: *i64, dsts: *i64, acts: *i64, n: i64) -> i64 |