dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 15 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(plans): TLS production profile design for Traefik, Kestrel, gRPC and Akka remoting (ScadaBridge#64)

Browse Source 
Per-hop current state with code evidence (browser/Traefik/Kestrel, CLI,
central<->site gRPC + PSK, LocalDb sync, Akka remoting, OPC UA /
MxGateway), the recommended mode per hop (Kestrel HTTPS + ALPN, gRPC over
TLS with validation and the PSK retained, Akka DotNetty SSL with a cert
per node and mutual auth), certificate issuance/storage/rotation, rig and
wonder impact, a staged rollout, rollback, a test plan and 13 open owner
decisions. Findings: the central ASPNETCORE_URLS re-bind drops the
scheme (an https URL binds plaintext); Akka.NET has no secure-cookie, so
mTLS is the only remoting authentication. Component-ClusterInfrastructure
documents the new RemotingTls option.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
This commit is contained in:
Joseph Doherty
2026-11-09 17:06:01 -05:00
parent 9138f3edf8
commit 31cb2c79e3
2 changed files with 537 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/requirements/Component-ClusterInfrastructure.md
+1
View File
@@ -244,6 +244,7 @@ Each node is configured with:
- **Akka.NET remoting**: Hostname/port for inter-node and inter-cluster communication (default 8081 central, 8082 site).
- **gRPC port** (site nodes only): Dedicated HTTP/2 port for the SiteStreamGrpcServer (default 8083). Separate from the Akka remoting port — gRPC uses Kestrel, Akka uses its own TCP transport.
- **Local storage paths**: SQLite database locations (site nodes only).
- **Akka.Remote TLS** (opt-in, `ScadaBridge:Cluster:RemotingTls`, default **off**; ScadaBridge#64): when `Enabled`, `BuildHocon` renders `akka.remote.dot-netty.tcp.enable-ssl` with this node's own certificate (`CertificatePath` + `CertificatePassword`, or `CertificateThumbprint` + `StoreName`/`StoreLocation`), mutual authentication on by default and chain validation always on (no `suppress-validation` switch). Node addresses become `akka.ssl.tcp://…`, so every seed must use that scheme — `ClusterOptionsValidator` refuses an `akka.tcp` seed with TLS on. Both nodes of a pair flip together. With TLS off the HOCON is byte-identical to before. Akka.Remote has no other authentication, so mTLS is the only way to stop an arbitrary reachable host joining the pair. Design and rollout: `docs/plans/2026-11-09-tls-production-profile-design.md`.
## Windows Service