feat(credentials): manage declarative credentials through TOML (#2515)

mirror of https://github.com/EasyTier/EasyTier.git synced 2026-09-02 17:15:43 +00:00

* feat(credentials): manage declarative credentials through TOML

Make managed credentials part of the canonical TOML configuration and
load them before peers can authenticate.

Reuse ConfigRpc hot patches to durably replace the configured credential
set without restarting the instance. Serialize credential mutations so
base, managed, and ephemeral keys cannot race into conflicts.

Remove the managed overlay file format, digest protocol, capability
negotiation, force reconciliation, and database CAS machinery. Redact
credential secrets from debug output and management events. Write
credential-bearing files atomically with private permissions.

* fix(core): release JoinSet reapers with their owners

Pass weak task-set references into background reapers so they cannot
retain the JoinSet they are meant to collect. This lets stale smoltcp
bridge tasks terminate when an IPv4 generation is replaced.

Add ownership and TCP generation-replacement regressions covering the
production port-forward failure.

This commit is contained in:

KKRainbow

2026-08-22 16:30:51 +08:00

committed by

GitHub

parent 8794e12a26

commit 3fe427bc99

44 changed files with 1600 additions and 259 deletions

									
										easytier-proto/proto/api_config.proto
									
		+1
		
												View File
												
				@@ -29,6 +29,7 @@ message InstanceConfigPatch {

				  optional string ipv6_public_addr_prefix = 13;

				  optional bool disable_relay_data = 14;

				  repeated VpnPortalClientPatch vpn_portal_clients = 15;

				  api.manage.ManagedCredentialSet managed_credentials = 16;

				}

				message VpnPortalClientPatch {