Expand description
The control-plane HTTP service.
Latency-tolerant by design — its contract is correctness (no double-spend,
fencing, idempotent ingest), enforced by whatever tollgate_store backend
it is built over. The service is generic over that backend: anything
satisfying Backend serves identically, which is the
pluggability seam the Postgres backend drops into.
Surface (/v1):
POST /v1/leases/acquire,POST /v1/leases/release,POST /v1/leases/consolidate,POST /v1/leases/reclaim— fenced lease lifecycle.GET /v1/keys— revisioned active credential pages (instance authority only).GET /v1/snapshots— the principal catalogue (GL-48).GET /v1/snapshots/{principal}— compiled snapshot fetch.POST /v1/usage/ingest— idempotent usage batches.POST /v1/admin/accounts,POST /v1/admin/accounts/{id}/deposit,POST /v1/admin/accounts/{id}/status,POST /v1/admin/accounts/{id}/capacity-class,POST/GET /v1/admin/accounts/{id}/keys,DELETE /v1/admin/accounts/{id}/keys/{key},PUT/DELETE /v1/admin/accounts/{id}/keys/{key}/snapshot(GL-143),PUT/DELETE /v1/admin/snapshots/{principal}— administration.GET /livez,GET /readyz— probes.
All protected handlers require verified instance or operator evidence.
serve owns TLS and refuses exposed plaintext; security::ServerSecurity
atomically rotates roles, credentials and TLS. Administrative audit events
carry receipts captured by the backend at mutation. See
docs/CONTROL_PLANE_SECURITY.md for deployment and audit collection.
Modules§
- config
- File-backed security configuration. Operators stage referenced files first, then atomically replace the JSON manifest. Failed loads preserve the live generation.
- error
- RFC-7807
application/problem+jsonerrors with stable machine codes. - Google service-account ID tokens. Key discovery stays off the HTTP handlers; an unknown key or an expired key set fails closed until refresh succeeds.
- security
- Control-plane identities, route authorization, and operator-approved provisioner policies.
- transport
- TLS is owned by the listener. HTTP headers cannot manufacture a peer identity.
Structs§
- Server
State - Everything the handlers need.
Sis the storage backend; the clock is the single place wall time enters the server.
Traits§
- Backend
- The full store bound the server needs from a backend.