Function bootstrap_credentials

nodedb/src/control/cluster/tls.rs:313–349

(
    settings: &ClusterSettings,
    tls_dir: &Path,
)

}

fn bootstrap_credentials(
    settings: &ClusterSettings,
    tls_dir: &Path,
) -> crate::Result<TlsCredentials> {
    fs::create_dir_all(tls_dir).map_err(|e| crate::Error::Config {
        detail: format!("create tls dir {}: {e}", tls_dir.display()),
    })?;

    // Multi-SAN cert: one cert satisfies both the fixed cluster SNI
    // (`"nodedb"`, required by the QUIC client config) AND the
    // per-node identity (`node-<id>`), so future CRL-based revocation
    // can target a specific node without tearing down the fleet.
    let node_san = format!("node-{}", settings.node_id);
    let (ca, creds) = nodedb_cluster::generate_node_credentials_multi_san(&[
        &node_san,
        nodedb_cluster::transport::config::SNI_HOSTNAME,
    ])
    .map_err(|e| crate::Error::Config {
        detail: format!("bootstrap cluster CA: {e}"),
    })?;

    write_pem_cert(&tls_dir.join(CA_CERT_FILE), ca.cert_der().as_ref())?;
    // Persist the CA key so `nodedb regen-certs` can reissue node
    // certs under the same CA. 0600 perms enforced by
    // `write_pem_private_key`.
    write_pem_private_key(&tls_dir.join(CA_KEY_FILE), &ca.key_pair_pkcs8_der())?;
    write_pem_cert(&tls_dir.join(NODE_CERT_FILE), creds.cert.as_ref())?;
    write_pem_private_key(&tls_dir.join(NODE_KEY_FILE), creds.key.secret_der())?;
    write_cluster_secret(&tls_dir.join(CLUSTER_SECRET_FILE), &creds.cluster_secret)?;

    // Load the (empty-by-default) overlap-CA set so the bootstrap path
    // behaves the same as a reload — any `ca.d/` pre-seeded by the
    // operator is honoured on first start.
    let mut creds = creds;
    creds.additional_ca_certs = load_extra_cas(tls_dir)?;
    Ok(creds)
}

fn read_cluster_secret(path: &Path) -> crate::Result<[u8; CLUSTER_SECRET_LEN]> {
    ensure_secret_file_perms(path)?;