feat(appgate): serve HTTPS and HTTP on the same app port

lfg2025/archy

An app port must answer whatever the browser asks for: an HTTP dashboard
embeds http://host:PORT, an HTTPS one embeds https://host:PORT, and an HTTPS
page cannot embed an HTTP frame at all. So the choice is per-node, not
per-fleet, and a second port number would mean every manifest changes and
torrc doubles.

Instead the gate peeks the first byte. A TLS ClientHello is 0x16; no HTTP
method starts with it. peek() leaves the bytes in the socket buffer, so the
acceptor still sees a complete, untouched ClientHello. TLS and plain share one
generic serve_http(), so authentication, proxying and upgrade handling cannot
drift apart by scheme.

EXISTING NODES ARE UNAFFECTED BY CONSTRUCTION. Anything that is not a TLS
handshake takes the identical path as before, and a node with no certificate
serves plain HTTP exactly as today — TLS is strictly additive.

rustls does NOT verify that a private key matches its certificate. Established
by test, not assumed: with_single_cert accepted a pair from two different keys
and would only have failed mid-handshake in a user's browser — a security
control that reports success and does nothing, the exact shape this module's
own docs warn about. So the pairing is now proven explicitly (sign a fixed
message with the key, verify against the certificate's public key) and a
mismatch refuses to serve.

Also: cert and key mtimes are stamped as a PAIR, because reissuing writes them
separately and keying on one would serve a certificate that no longer matches
its key; a 15s first-byte timeout closes the slowloris window one step earlier
than the existing header-read timeout; PKCS#8 and PKCS#1 keys are both
accepted so a hand-made key does not silently downgrade a working node.

Deps pinned to the rustls 0.21 line reqwest already resolves — no new vendor,
no second rustls major. Test fixtures are throwaway (localhost SANs only), not
any node's identity.

38/38 appgate tests pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

This commit is contained in:

archipelago

2026-08-06 15:23:47 -04:00

co-authored by

Claude Opus 5

parent f09ff102ee

commit 7515166a07

9 changed files with 577 additions and 17 deletions

									
										core/archipelago/src/appgate/testdata/README.md
									
Vendored

		+10
		
												View File
												
				@@ -0,0 +1,10 @@

				Throwaway TLS fixtures for `appgate::tls` unit tests.

				Generated by `openssl req -x509 -nodes` with SANs `localhost`/`127.0.0.1` only.

				They are **not** any node's identity: a real node's pair lives at

				`/etc/archipelago/ssl/` and is created by `scripts/setup-node-ca.sh`. Nothing

				here is trusted by anything, and `other.key` exists purely to prove a

				mismatched cert/key pair is rejected rather than silently served.

				Regenerate with the command in this directory's git history if they ever

				expire — `-days 36500` means that should not happen.