extract palisade — shared trust-boundary primitives #3277
No reviewers
Labels
No labels
1week
2weeks
Failed compliance check
IP cameras
NATS
Possible security concern
Review effort 1/5
Review effort 2/5
Review effort 3/5
Review effort 4/5
Review effort 5/5
UI
aardvark
accessibility
amd64
api
arm64
auth
back-end
bgp
blog
bug
build
checkers
ci-cd
cleanup
cnpg
codex
core
dependencies
device-management
documentation
duplicate
dusk
ebpf
enhancement
eta 1d
eta 1hr
eta 3d
eta 3hr
feature
fieldsurvey
github_actions
go
good first issue
help wanted
invalid
javascript
k8s
log-collector
mapper
mtr
needs-triage
netflow
network-sweep
observability
oracle
otel
plug-in
proton
python
question
reddit
redhat
research
rperf
rperf-checker
rust
sdk
security
serviceradar-agent
serviceradar-agent-gateway
serviceradar-web
serviceradar-web-ng
siem
snmp
sysmon
topology
ubiquiti
wasm
wontfix
zen-engine
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
carverauto/serviceradar!3277
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "carverauto/extract-palisade"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Extracts shared trust-boundary primitives into a new
`elixir/palisade/` sub-project, plus wires the CI quality gate
and a publish-on-tag workflow.
What lands
`elixir/palisade/` — new sub-project
Apache-2.0 licensed. Houses the modules that CRM and
ServiceRadar previously kept as drifting verbatim copies:
(loopback, link-local, ULA, private). DNS-resolution-aware
(defeats DNS rebinding).
validator.
resolved IP, with TLS hostname verification + Host: header
on the original hostname.
36 ExUnit cases ported (with module renames) from the previous
`serviceradar_core/lib/serviceradar/policies/` test surface +
the `web-ng`'s `outbound_fetch.ex` test.
CI
existing matrix-driven Elixir Quality gate (format / compile
/ test / credo on every PR + push).
`palisade-v*` tag pushes. Verifies tag matches `@version`,
runs the quality gate, then `mix hex.publish package --repo
carverauto --yes` against https://hex.carverauto.dev.
Requires `HEX_API_KEY` secret on the runner.
Consumer model
etc.) will consume via `{:palisade, path: "../palisade"}` —
same sibling-path pattern already used for serviceradar_srql,
connection, elixir_uuid.
public CarverAutomation hex registry:
`{:palisade, "~> 0.1", repo: "carverauto"}` after
`mix hex.repo add carverauto https://hex.carverauto.dev`.
Out of scope (separate tracks)
`serviceradar_core/lib/serviceradar/policies/` and
`web-ng/lib/.../auth/{outbound_fetch,outbound_url_policy}.ex`
for the new package. Filed as a follow-up issue.
Test plan
under the matrix gate (will run on this PR).
workflow editor).
HEX_API_KEY secret (in-flight in a separate session).
publish workflow, verify CRM PR #179's
`{:palisade, "~> 0.1", repo: "carverauto"}` resolves.
New `elixir/palisade/` sub-project housing the boundary-defense modules that CRM and ServiceRadar previously kept as drifting verbatim copies: Palisade.NetworkAddressPolicy Palisade.OutboundURLPolicy Palisade.OutboundFetch Apache-2.0 licensed. ServiceRadar-internal consumers (web-ng, serviceradar_core, etc.) consume via the standard sibling-path dep: {:palisade, path: "../palisade"} External consumers (CRM, and anyone else who wants the modules) pull from the public CarverAutomation hex registry at https://hex.carverauto.dev. Add the registry once per machine / CI runner: mix hex.repo add carverauto https://hex.carverauto.dev then declare the dep: {:palisade, "~> 0.1", repo: "carverauto"} CI .forgejo/workflows/elixir-quality.yml — palisade joins the existing matrix-driven Elixir Quality gate (format / compile / test / credo on every PR + push). .forgejo/workflows/palisade-publish.yml — new workflow that fires on `palisade-vX.Y.Z` tag pushes: 1. Verifies the tag version matches mix.exs @version 2. Runs the full quality gate one more time 3. `mix hex.publish package --repo carverauto --yes` Requires HEX_API_KEY secret on the runner with publish scope against hex.carverauto.dev. Versioning Tag from repo root: `git tag palisade-v0.x.y && git push --tags`. Bump consumers' `~> 0.x` pin to pick up the new release. Tests 36 ExUnit cases ported (with module renames) from the previous serviceradar/policies test surface + the web-ng outbound_fetch test. Covers scheme rejection (https-only, case-insensitive), IPv4 + IPv6 private/loopback/link-local blocks, hostname blocks (localhost, *.local, case-insensitive), public IPv4 acceptance, URL rewriting to resolved IP with original-host SNI / Host: header, IPv6 inet6 transport flag, conservative req_opts. Out of scope (next palisade versions, tracked separately) - Palisade.OIDC.Client — discovery + JWKS + ID-token verify with proper nonce / iss / aud / exp validation. - Palisade.OIDC.ConfigCache — ETS-backed cache for OIDC discovery + JWKS payloads. - Palisade.SAML.{CertTrust, AssertionValidator, XML} — SAML primitives. - ServiceRadar consumers swapping their local copies in serviceradar_core/lib/serviceradar/policies/ and web-ng/lib/.../auth/{outbound_fetch,outbound_url_policy}.ex for the new package. Filed as a follow-up issue. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>51f42c2a3bf9fb3c25ab