feat(mesh): NodeCommandService on the telemetry listener

2026-08-06 05:14:12 -04:00
parent 3f96115cab
commit 64774652b7
5 changed files with 310 additions and 1 deletions
@@ -740,9 +740,18 @@ if (hasAdmin && configServeGrpcPort > 0)

 // Driver-node live-telemetry stream (per-cluster mesh Phase 5). Central dials in; gated by
 // TelemetryStreamAuthInterceptor (fail-closed on empty Telemetry:ApiKey).
+//
+// The node-side command endpoint (ClusterClient→gRPC migration Phase 1) rides the SAME driver-role
+// h2c listener rather than claiming a fourth port: central already dials this node here, both
+// directions are per-cluster-keyed, and a separate port would be one more thing to open on every
+// site firewall for no isolation gain. Mapping it is what makes MeshCommandAuthInterceptor live —
+// it is registered above and is a pass-through until a call matches this service's method prefix.
+// It fail-closes with no MeshTransport:GrpcPsk, so an operator who maps the service without setting
+// a key gets a closed endpoint, not an open one.
 if (hasDriver && telemetryListenPort > 0)
 {
    app.MapGrpcService<TelemetryStreamGrpcService>();
+    app.MapGrpcService<NodeCommandGrpcService>();
 }

 app.MapOtOpcUaHealth();