fix: TLS cert hot-reload when services change #13

2026-03-23T22:14:55+08:00

razvandimescu commented

2026-03-23 22:14:55 +08:00

(Migrated from github.com)

Summary

HTTPS proxy certs were generated once at startup — services added at runtime via API or LAN discovery got "not secure" in the browser
Added arc-swap for lock-free TLS config swapping; cert is regenerated (~5ms) on every service add/remove
New connections pick up the latest cert; in-flight connections are unaffected
PeerStore::update returns bool so LAN discovery only triggers regen when new names appear
ServiceStore::names() / PeerStore::names() helpers eliminate duplicated collection patterns
regenerate_tls moved to tls.rs, uses HashSet for O(n) dedup instead of O(n²) Vec::contains

Test plan

Start Numa with HTTPS proxy enabled and existing services → verify green lock
Add a service via POST /services → verify https://<name>.numa immediately shows green lock
Remove a service via DELETE /services/<name> → verify cert no longer covers it
Start two Numa instances with LAN discovery → verify LAN-discovered services get valid HTTPS certs
Re-register an existing service (port change) → verify no unnecessary cert regeneration in logs

🤖 Generated with Claude Code

## Summary - HTTPS proxy certs were generated once at startup — services added at runtime via API or LAN discovery got "not secure" in the browser - Added `arc-swap` for lock-free TLS config swapping; cert is regenerated (~5ms) on every service add/remove - New connections pick up the latest cert; in-flight connections are unaffected - `PeerStore::update` returns `bool` so LAN discovery only triggers regen when new names appear - `ServiceStore::names()` / `PeerStore::names()` helpers eliminate duplicated collection patterns - `regenerate_tls` moved to `tls.rs`, uses `HashSet` for O(n) dedup instead of O(n²) `Vec::contains` ## Test plan - [x] Start Numa with HTTPS proxy enabled and existing services → verify green lock - [x] Add a service via `POST /services` → verify `https://<name>.numa` immediately shows green lock - [x] Remove a service via `DELETE /services/<name>` → verify cert no longer covers it - [ ] Start two Numa instances with LAN discovery → verify LAN-discovered services get valid HTTPS certs - [ ] Re-register an existing service (port change) → verify no unnecessary cert regeneration in logs 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dearsky/numa#13