DatagroutConduit.Identity (DataGrout Conduit v0.5.0)

Copy Markdown View Source

mTLS client identity for mutual TLS authentication.

Discovers client certificates from the filesystem or environment variables and provides them to the transport layer for HTTPS connections.

Discovery Order

try_discover/1 searches in this order:

  1. override_dir option (if provided)
  2. CONDUIT_MTLS_CERT + CONDUIT_MTLS_KEY environment variables
  3. CONDUIT_IDENTITY_DIR environment variable
  4. ~/.conduit/identity.pem + identity_key.pem
  5. .conduit/ relative to current working directory

Summary

Types

t()

Functions

from_env()

Creates an identity from CONDUIT_MTLS_CERT and CONDUIT_MTLS_KEY environment variables containing PEM data directly.

from_paths(cert_path, key_path, ca_path \\ nil)

Creates an identity from explicit file paths.

from_pem(cert_pem, key_pem, ca_pem \\ nil)

Creates an identity from PEM-encoded binaries.

needs_rotation?(identity, opts \\ [])

Returns true if the identity's certificate will expire within the given threshold.

try_discover(opts \\ [])

Attempts to discover mTLS identity from the filesystem and environment.

Types

t()

@type t() :: %DatagroutConduit.Identity{
  ca_path: String.t() | nil,
  ca_pem: binary() | nil,
  cert_path: String.t() | nil,
  cert_pem: binary() | nil,
  key_path: String.t() | nil,
  key_pem: binary() | nil
}

Functions

from_env()

@spec from_env() :: {:ok, t()} | {:error, :not_found}

Creates an identity from CONDUIT_MTLS_CERT and CONDUIT_MTLS_KEY environment variables containing PEM data directly.

from_paths(cert_path, key_path, ca_path \\ nil)

@spec from_paths(String.t(), String.t(), String.t() | nil) ::
  {:ok, t()} | {:error, term()}

Creates an identity from explicit file paths.

from_pem(cert_pem, key_pem, ca_pem \\ nil)

@spec from_pem(binary(), binary(), binary() | nil) :: {:ok, t()} | {:error, term()}

Creates an identity from PEM-encoded binaries.

needs_rotation?(identity, opts \\ [])

@spec needs_rotation?(
  t(),
  keyword()
) :: boolean()

Returns true if the identity's certificate will expire within the given threshold.

Options

  • :threshold_days - number of days before expiry to trigger (default: 30)

try_discover(opts \\ [])

@spec try_discover(keyword()) :: t() | nil

Attempts to discover mTLS identity from the filesystem and environment.

Returns %Identity{} if found, nil otherwise.

Options

  • :override_dir - directory to search first (highest priority)