legion-crypt 1.4.10 → 1.4.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 14e4a34517eb19612bc6e2f1f07093f3e5d2affef6e04f48b5c8a1fb1bd06a74
-  data.tar.gz: 793e8657ba9d56a34a96362fb0777c7f22e1c63f8953ab00b562fa3e57e9e5a3
+  metadata.gz: 9955ad145758d89e705e6fdc0d7f90824710b98c2752979a425d6dbdfb65b693
+  data.tar.gz: c38bfc3054ec7facfb1b0c84c19983314e7c1af4cbd7170a74b2400b4a641fb8
 SHA512:
-  metadata.gz: e56636a54d3a9e6c615184361ca3242d7c17919c0235878cf43e8283858b2e261dc82ff02fa4777d57b2b619cd16f3c254e7aa5e453cf56cdcfca6156166c98d
-  data.tar.gz: e5f5b735f176da76b49438d1bd5b0a40a42b1087c288d5487edbcc3b0601466ca9f4d16fba257bda8cd2f84782102ab675d117c976567efab4dcaa493706343e
+  metadata.gz: 68364ee4acade59550e9e6f3054315f013948c7bc194b4693cc381eef7ee27edc44840ebf55ce27fbe271986f004581739a8cbaf436ffb1d5c8e7fbb91cc9948
+  data.tar.gz: bf403bc4b5ad7c28404b91968d08b4984e8e2fb0177388674eb49f6ef83261abcd6c2568ec58f6c02b250686a155a8924aa28a77f837b3eb1360093986ba35ad

data/.gitignore

@@ -13,3 +13,6 @@
 # rspec failure tracking
 .rspec_status
 legionio.key
+
+# git worktrees
+.worktrees/

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Legion::Crypt
 
+## [1.4.11] - 2026-03-24
+
+### Added
+- `Legion::Crypt::Mtls` module: Vault PKI cert issuance with `.issue_cert`, `.enabled?`, `.pki_path`, `.local_ip`; feature-flagged via `security.mtls.enabled`
+- `Legion::Crypt::CertRotation` class: background cert rotation at 50% TTL boundary with `#start`, `#stop`, `#rotate!`, `#needs_renewal?`; emits `cert.rotated` event via `Legion::Events`
+
 ## [1.4.10] - 2026-03-24
 
 ### Added

data/lib/legion/crypt/cert_rotation.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+module Legion
+  module Crypt
+    class CertRotation
+      DEFAULT_CHECK_INTERVAL = 43_200 # 12 hours
+
+      attr_reader :check_interval, :current_cert, :issued_at
+
+      def initialize(check_interval: DEFAULT_CHECK_INTERVAL)
+        @check_interval = check_interval
+        @current_cert   = nil
+        @issued_at      = nil
+        @running        = false
+        @thread         = nil
+      end
+
+      def start
+        return unless Legion::Crypt::Mtls.enabled?
+        return if running?
+
+        @running = true
+        @thread  = Thread.new { rotation_loop }
+        log_info('[mTLS] CertRotation started')
+      end
+
+      def stop
+        @running = false
+        if @thread&.alive?
+          @thread.kill
+          @thread.join(2)
+        end
+        @thread = nil
+        log_debug('[mTLS] CertRotation stopped')
+      end
+
+      def running?
+        (@running && @thread&.alive?) || false
+      end
+
+      def rotate!
+        node_name = node_common_name
+        new_cert = Legion::Crypt::Mtls.issue_cert(common_name: node_name)
+        @current_cert = new_cert
+        @issued_at    = Time.now
+        log_info("[mTLS] Certificate rotated: serial=#{new_cert[:serial]} expiry=#{new_cert[:expiry]}")
+        emit_rotated_event(new_cert)
+        new_cert
+      end
+
+      def needs_renewal?
+        return false if @current_cert.nil? || @issued_at.nil?
+
+        expiry = @current_cert[:expiry]
+        total  = expiry - @issued_at
+        return true if total <= 0
+
+        remaining = expiry - Time.now
+        fraction  = remaining / total
+        fraction < renewal_window
+      end
+
+      private
+
+      def rotation_loop
+        rotate!
+      rescue StandardError => e
+        log_warn("[mTLS] Initial rotation failed: #{e.message}")
+      ensure
+        loop_check
+      end
+
+      def loop_check
+        while @running
+          sleep(@check_interval)
+          next unless @running && needs_renewal?
+
+          begin
+            rotate!
+          rescue StandardError => e
+            log_warn("[mTLS] Rotation check failed: #{e.message}")
+          end
+        end
+      rescue StandardError => e
+        log_warn("[mTLS] CertRotation loop error: #{e.message}")
+        retry if @running
+      end
+
+      def renewal_window
+        return 0.5 unless defined?(Legion::Settings)
+
+        security = Legion::Settings[:security]
+        return 0.5 if security.nil?
+
+        mtls = security[:mtls] || security['mtls'] || {}
+        mtls[:renewal_window] || mtls['renewal_window'] || 0.5
+      rescue StandardError
+        0.5
+      end
+
+      def node_common_name
+        return 'legion.internal' unless defined?(Legion::Settings)
+
+        name = Legion::Settings[:client]&.dig(:name) || Legion::Settings[:client]&.dig('name')
+        name || 'legion.internal'
+      rescue StandardError
+        'legion.internal'
+      end
+
+      def emit_rotated_event(cert)
+        return unless defined?(Legion::Events)
+
+        Legion::Events.emit('cert.rotated', serial: cert[:serial], expiry: cert[:expiry])
+      rescue StandardError => e
+        log_debug("[mTLS] Event emit failed: #{e.message}")
+      end
+
+      def log_info(msg)
+        if defined?(Legion::Logging)
+          Legion::Logging.info(msg)
+        else
+          $stdout.puts(msg)
+        end
+      end
+
+      def log_debug(msg)
+        if defined?(Legion::Logging)
+          Legion::Logging.debug(msg)
+        else
+          $stdout.puts("[DEBUG] #{msg}")
+        end
+      end
+
+      def log_warn(msg)
+        if defined?(Legion::Logging)
+          Legion::Logging.warn(msg)
+        else
+          warn("[WARN] #{msg}")
+        end
+      end
+    end
+  end
+end

data/lib/legion/crypt/mtls.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require 'socket'
+
+module Legion
+  module Crypt
+    module Mtls
+      DEFAULT_PKI_PATH = 'pki/issue/legion-internal'
+      DEFAULT_TTL      = '24h'
+
+      class << self
+        def enabled?
+          security = safe_security_settings
+          return false if security.nil?
+
+          mtls = security[:mtls] || security['mtls']
+          return false if mtls.nil?
+
+          mtls[:enabled] || mtls['enabled'] || false
+        end
+
+        def pki_path
+          security = safe_security_settings
+          return DEFAULT_PKI_PATH if security.nil?
+
+          mtls = security[:mtls] || security['mtls'] || {}
+          mtls[:vault_pki_path] || mtls['vault_pki_path'] || DEFAULT_PKI_PATH
+        end
+
+        def issue_cert(common_name:, ttl: nil)
+          resolved_ttl = ttl || cert_ttl_setting || DEFAULT_TTL
+
+          response = ::Vault.logical.write(
+            pki_path,
+            common_name: common_name,
+            ttl:         resolved_ttl,
+            ip_sans:     local_ip,
+            alt_names:   ''
+          )
+
+          raise "Vault PKI returned nil for #{pki_path} (common_name=#{common_name})" if response.nil?
+
+          data = response.data
+
+          {
+            cert:     data[:certificate],
+            key:      data[:private_key],
+            ca_chain: Array(data[:ca_chain]),
+            serial:   data[:serial_number],
+            expiry:   Time.at(data[:expiration].to_i)
+          }
+        end
+
+        def local_ip
+          Socket.ip_address_list.find { |a| a.ipv4? && !a.ipv4_loopback? }&.ip_address || '127.0.0.1'
+        end
+
+        private
+
+        def safe_security_settings
+          return nil unless defined?(Legion::Settings)
+
+          Legion::Settings[:security]
+        rescue StandardError
+          nil
+        end
+
+        def cert_ttl_setting
+          security = safe_security_settings
+          return nil if security.nil?
+
+          mtls = security[:mtls] || security['mtls'] || {}
+          mtls[:cert_ttl] || mtls['cert_ttl']
+        end
+      end
+    end
+  end
+end

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.4.10'
+    VERSION = '1.4.11'
   end
 end

data/lib/legion/crypt.rb

@@ -11,6 +11,8 @@ require 'legion/crypt/lease_manager'
 require 'legion/crypt/vault_cluster'
 require 'legion/crypt/ldap_auth'
 require 'legion/crypt/helper'
+require 'legion/crypt/mtls'
+require 'legion/crypt/cert_rotation'
 
 module Legion
   module Crypt

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.4.10
+  version: 1.4.11
 platform: ruby
 authors:
 - Esity
@@ -73,6 +73,7 @@ files:
 - legion-crypt.gemspec
 - lib/legion/crypt.rb
 - lib/legion/crypt/attestation.rb
+- lib/legion/crypt/cert_rotation.rb
 - lib/legion/crypt/cipher.rb
 - lib/legion/crypt/cluster_secret.rb
 - lib/legion/crypt/ed25519.rb
@@ -83,6 +84,7 @@ files:
 - lib/legion/crypt/ldap_auth.rb
 - lib/legion/crypt/lease_manager.rb
 - lib/legion/crypt/mock_vault.rb
+- lib/legion/crypt/mtls.rb
 - lib/legion/crypt/partition_keys.rb
 - lib/legion/crypt/settings.rb
 - lib/legion/crypt/tls.rb