legion-crypt 1.4.2 → 1.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 171a3a22eeb730be2a47dccb7f96ec1b4ffcf4df03792eae594f63b61106224a
-  data.tar.gz: 597ca3ea73e5864a572621312cf7ff0efea424c4e3e05c22e16f0044deb97753
+  metadata.gz: 755c4278bc3e6f3ba845f5d46ba61b753a19b9a4fc0212f9da9827e6fefe3ac2
+  data.tar.gz: '04585ab20ddb62568949ca90c33405b61bb477cd2750503944acadcf665925b9'
 SHA512:
-  metadata.gz: fb76b8b671a10380aaccb82eb62f611f9998112bd95ec8a5b184679b1694204d3b7adb14b3c7f141ae072254671728bf2b8b1701c94291f0b285ccb335d0e15e
-  data.tar.gz: 8d0d58cb2c9d4fc543fc7d3be4628142405c388e1436211df59d1d26614c18d49f6e158ab25e440b643401c8c527de1160470a0623536a4f79040fb2f475a6fc
+  metadata.gz: 53c5f43b6ab1ca2f0dad978a3cee6b1d3314b8aa57ffae077641d9882756f3a331b21258f3b45a9789639095facdff27baec911e6cbd066c7d2c2fc1058237bd
+  data.tar.gz: f3b542c8ca98c768ddfae7763da33ddc3638fd46dbb174abf037cd0baca348fa6127c4ad1d3efa46c86a943b2cd3d2c6f2df5d8d179e0a64a5b94d5b3ec4f35c

data/CHANGELOG.md

@@ -1,6 +1,12 @@
 # Legion::Crypt
 
-## [Unreleased]
+## [1.4.3] - 2026-03-17
+
+### Added
+- `Crypt::TLS`: mTLS configuration for RabbitMQ (Bunny) and PostgreSQL (Sequel) connections
+- `TLS.ssl_context` builds OpenSSL::SSL::SSLContext with TLS 1.2+ and VERIFY_PEER
+- `TLS.bunny_options` and `TLS.sequel_options` generate adapter-specific TLS option hashes
+- Configurable cert/key/ca paths via settings with sensible defaults
 
 ## [1.4.2] - 2026-03-16
 

data/lib/legion/crypt/tls.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require 'openssl'
+
+module Legion
+  module Crypt
+    module TLS
+      DEFAULT_CERT_DIR = '/etc/legion/tls'
+
+      class << self
+        def enabled?
+          settings_dig(:enabled) == true
+        end
+
+        def ssl_context(role: :client) # rubocop:disable Lint/UnusedMethodArgument
+          ctx = OpenSSL::SSL::SSLContext.new
+          ctx.min_version = OpenSSL::SSL::TLS1_2_VERSION
+          ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER
+
+          ctx.cert = OpenSSL::X509::Certificate.new(File.read(cert_path)) if cert_path && File.exist?(cert_path)
+          ctx.key = OpenSSL::PKey.read(File.read(key_path)) if key_path && File.exist?(key_path)
+          ctx.ca_file = ca_path if ca_path && File.exist?(ca_path)
+
+          ctx
+        end
+
+        def bunny_options
+          return {} unless enabled?
+
+          {
+            tls:                 true,
+            tls_cert:            cert_path,
+            tls_key:             key_path,
+            tls_ca_certificates: [ca_path].compact,
+            verify_peer:         true
+          }
+        end
+
+        def sequel_options
+          return {} unless enabled?
+
+          {
+            sslmode:     'verify-full',
+            sslcert:     cert_path,
+            sslkey:      key_path,
+            sslrootcert: ca_path
+          }
+        end
+
+        def cert_path
+          settings_dig(:cert_path) || File.join(DEFAULT_CERT_DIR, 'legion.crt')
+        end
+
+        def key_path
+          settings_dig(:key_path) || File.join(DEFAULT_CERT_DIR, 'legion.key')
+        end
+
+        def ca_path
+          settings_dig(:ca_path) || File.join(DEFAULT_CERT_DIR, 'ca-bundle.crt')
+        end
+
+        private
+
+        def settings_dig(*keys)
+          return nil unless defined?(Legion::Settings)
+
+          result = Legion::Settings[:crypt]
+          [:tls, *keys].each do |key|
+            return nil unless result.is_a?(Hash)
+
+            result = result[key]
+          end
+          result
+        rescue StandardError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.4.2'
+    VERSION = '1.4.3'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.4.2
+  version: 1.4.3
 platform: ruby
 authors:
 - Esity
@@ -82,6 +82,7 @@ files:
 - lib/legion/crypt/mock_vault.rb
 - lib/legion/crypt/partition_keys.rb
 - lib/legion/crypt/settings.rb
+- lib/legion/crypt/tls.rb
 - lib/legion/crypt/vault.rb
 - lib/legion/crypt/vault_jwt_auth.rb
 - lib/legion/crypt/vault_renewer.rb