feat: replace chisel broker with purpose-built mTLS Go daemon - #1
Open
sarrafgsarraf wants to merge 2 commits into
Open
feat: replace chisel broker with purpose-built mTLS Go daemon#1sarrafgsarraf wants to merge 2 commits into
sarrafgsarraf wants to merge 2 commits into
Conversation
Replace the chisel-based reverse-SOCKS broker (client/server Dockerfiles + entrypoint scripts) with a purpose-built, self-contained Go daemon. The daemon dials one outbound TLS 1.3 mTLS connection to the ZeroPath broker-gateway, SPKI-pins the gateway (InsecureSkipVerify is never set), multiplexes with yamux, and splices reverse streams to a default-deny intersection allowlist of internal hosts. It also runs a forward CONNECT proxy that permits only zeropath.com:443. It is a pure byte pipe: it never terminates TLS to the internal target or to zeropath.com, so it never sees repository contents, credentials, or ZeroPath API tokens. Distroless static image, non-root (uid 65532), no NET_ADMIN/NET_RAW. Adds DEPLOYMENT.md with Kubernetes and systemd deployment steps. The ZeroPath SaaS-side counterpart (broker-gateway, enrollment endpoint, admin API, dialers) lives in the ZeroPathAI/cunningham monorepo. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Generate go.sum via `go mod tidy` so the module builds reproducibly without a network fetch of checksums at build time. Covers hashicorp/yamux, yaml.v3, and its indirect gopkg.in/check.v1. go.mod stays at `go 1.22` with no toolchain pin, so the golang:1.22-alpine Docker build stage still compiles it. Validated locally: `go build ./...`, `go vet ./...`, and `go test ./...` all pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Replaces the chisel-based reverse-SOCKS broker with a purpose-built, self-contained Go daemon — the on-prem component customers run so SaaS ZeroPath can reach private hosts (GHES, GitLab self-managed, Bitbucket DC, Jira DC) over one outbound mTLS + yamux connection, with no inbound firewall changes.
The old chisel implementation disabled server auth (
--tls-skip-verify, no pinning), defaulted to a whole-network SOCKS proxy, and requiredNET_ADMIN. This daemon fixes all of that.Why replace the old broker
InsecureSkipVerifyis never set (old broker used--tls-skip-verify).allowlist.yaml) + resolved-IP re-screen (loopback/metadata/CGNAT refused) instead of a whole-network SOCKS proxy.NET_ADMIN/NET_RAW, distroless static, non-root (uid 65532), read-only rootfs friendly.Contents
main.go,enroll.go,tunnel.go,reverse.go,forward.go,allowlist.go,framing.go, tests,go.mod,go.sum,Dockerfile.DEPLOYMENT.md— Kubernetes + systemd deployment steps.README.md,.gitignore.Dockerfile.client,Dockerfile.server,*-entrypoint.sh,deploy-example.sh,test-client.sh).Build & test
go build ./...,go vet ./..., andgo test ./...all pass.go.sumis committed (covershashicorp/yamux,yaml.v3, and its indirectgopkg.in/check.v1);go.modstays atgo 1.22so thegolang:1.22-alpineDocker stage builds it unchanged.Relationship to the SaaS side
The ZeroPath-side counterpart (broker-gateway,
/api/broker/enroll, tRPC admin API, Prisma model, dialers, Pulumi infra) lives in theZeroPathAI/cunninghammonorepo (PR #1868).Enrollment SPKI-pin contract — resolved
This daemon requires a
serverSpkiPinfield in the enrollment response to pin the gateway's leaf (tunnel.gospkiPin=sha256/base64(SubjectPublicKeyInfo DER)). The cunningham/api/broker/enrollendpoint now computes and returns it (with a golden test asserting byte-parity against the openssl/Go value), so first-boot enrollment works end to end.🤖 Generated with Claude Code