feat: add self-enrollment workflow for automated PKI provisioning

- Phase 1: CLI args (--enroll flag), enroll module skeleton, config support
- Phase 2: Registration request, polling loop (24h timeout), main.rs integration
- Phase 3: PKI extraction, atomic cert writing, whitelist auto-append, mTLS transition
- Phase 4: E2E test suite, README/DEPLOYMENT docs, CI pipeline
- Phase 5: SPEC.md, API_DOCUMENTATION.md, CHANGELOG.md, ROADMAP.md sync

Security review: APPROVED (0 critical, 0 high findings)
Cross-distro compatible: Debian/Ubuntu, RHEL/CentOS/Fedora, Alpine, Arch Linux

.a0proj/agents.json

@@ -0,0 +1 @@
+{}

.a0proj/memory/embedding.json

@@ -0,0 +1 @@
+{"model_provider": "ollama", "model_name": "bge-m3:latest"}

.a0proj/memory/index.faiss.sha256

@@ -0,0 +1 @@
+9cde4598eb68e4b1810cdf657333d8ca9e228ebcb4b4717524b62a61ae06f900

.a0proj/memory/knowledge_import.json

@@ -0,0 +1 @@
+{"/a0/usr/knowledge/main/Iran-US-Conflict-Update-2026-04-01.md": {"file": "/a0/usr/knowledge/main/Iran-US-Conflict-Update-2026-04-01.md", "checksum": "6beea9874c3bcb846d17f9a60c29d528", "ids": ["5sQkc0Ylqa", "FeZVPLWYss", "kYBRtDfHjJ"]}, "/a0/usr/knowledge/main/ollama-27b-modelfile.txt": {"file": "/a0/usr/knowledge/main/ollama-27b-modelfile.txt", "checksum": "3f4f724d6f777e0620df9781ebc82f36", "ids": ["yZoFOCA99D"]}, "/a0/usr/knowledge/main/behavioral-rules.md": {"file": "/a0/usr/knowledge/main/behavioral-rules.md", "checksum": "ff4230d5f02891487008864de55151e8", "ids": ["5LhBKVgUXB"]}, "/a0/usr/knowledge/main/utility_test.txt": {"file": "/a0/usr/knowledge/main/utility_test.txt", "checksum": "c8c29a129e935836a77048f47e231705", "ids": ["vrbKe4D4sR"]}, "/a0/usr/knowledge/main/welcome.md": {"file": "/a0/usr/knowledge/main/welcome.md", "checksum": "d947ce81d6dcc977a3ddf52e8d5e4712", "ids": ["0Qx7U1mSZH"]}, "/a0/usr/knowledge/main/capability_test_results.txt": {"file": "/a0/usr/knowledge/main/capability_test_results.txt", "checksum": "880b2a6e355125561f22e1f0ac38a3c4", "ids": ["hmVC8arGTg"]}, "/a0/usr/knowledge/main/Iran-US-Conflict-Analysis-2026.md": {"file": "/a0/usr/knowledge/main/Iran-US-Conflict-Analysis-2026.md", "checksum": "ffa6e16f560fc2c021df9c656e8dfdcc", "ids": ["WKKtg5Rj2e", "VBSDN1KENS"]}, "/a0/knowledge/main/tool_call_reference_examples.md": {"file": "/a0/knowledge/main/tool_call_reference_examples.md", "checksum": "1558e6e118619185e31224b1ed646b9a", "ids": ["mLgFu7vH7Z"]}, "/a0/knowledge/main/about/architecture.md": {"file": "/a0/knowledge/main/about/architecture.md", "checksum": "0de7a9280419982ef5fc98d0cc6ad2dc", "ids": ["VG5QHEdqZt", "oALIWNguyG"]}, "/a0/knowledge/main/about/configuration.md": {"file": "/a0/knowledge/main/about/configuration.md", "checksum": "9f83690fdca64631d063c75fd324d42c", "ids": ["XX5kcVMvDu", "T2B8pFL10O"]}, "/a0/knowledge/main/about/capabilities.md": {"file": "/a0/knowledge/main/about/capabilities.md", "checksum": "cf4d100df544af245940971464357e0b", "ids": ["S6MH1eLPzP", "laWnXkj3Ky"]}, "/a0/knowledge/main/about/identity.md": {"file": "/a0/knowledge/main/about/identity.md", "checksum": "63a2c83c6c3bf4c4008786c396618755", "ids": ["Yi3PLqGcaj"]}, "/a0/knowledge/main/about/setup-and-deployment.md": {"file": "/a0/knowledge/main/about/setup-and-deployment.md", "checksum": "3cf57d685f11a6989a73cf041c2018a3", "ids": ["KVJ5zsWDQX", "LoANN0xNbF"]}}

.a0proj/project.json

@@ -0,0 +1 @@
+{"title": "Linux_Patch_API", "description": "Create an API service that will allow remote clients to securely remote manage the patching process and control software add and removal. ", "instructions": "Use Strict Spec Driven development process following the kiro standards.\nAsk questions and help build all of the spec driven files needed\nAlways get approval before taking next steps\nAlways ask questions to determine the right path for the software\nNever make assumptions, always confirm. \nCode must be build following strict security coding guidelines\n", "color": "#00bbf9", "git_url": "", "file_structure": {"enabled": true, "max_depth": 5, "max_files": 20, "max_folders": 20, "max_lines": 250, "gitignore": "# Python environments & cache\nvenv/**\n**/__pycache__/**\n\n# Node.js dependencies\n**/node_modules/**\n**/.npm/**\n\n# Version control metadata\n**/.git/**\n"}}

.a0proj/variables.env

@@ -0,0 +1,3 @@
+EMBEDDING_MODEL=bge-m3:latest
+OLLAMA_HOST=http://ares.moon-dragon.us:11434
+LLM_MODEL=qwen3.5:9b

.gitea/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
     steps:
       - name: Checkout repository
         run: |
-          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/git-echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
+          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
           tar -xzf repo.tar.gz --strip-components=1
           rm -f repo.tar.gz
       - name: Install Rust
@@ -36,7 +36,7 @@ jobs:
     steps:
       - name: Checkout repository
         run: |
-          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/git-echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
+          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
           tar -xzf repo.tar.gz --strip-components=1
           rm -f repo.tar.gz
       - name: Install Rust
@@ -49,7 +49,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get -f install -y
-          sudo apt-get install -y build-essential libsystemd-dev pkg-config libssl-dev
+          sudo apt-get install -y build-essential libsystemd-dev pkg-config
       - name: Run clippy
         run: cargo clippy --all-targets --all-features -- -D warnings
 
@@ -59,7 +59,7 @@ jobs:
     steps:
       - name: Checkout repository
         run: |
-          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/git-echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
+          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
           tar -xzf repo.tar.gz --strip-components=1
           rm -f repo.tar.gz
       - name: Install Rust
@@ -71,7 +71,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get -f install -y
-          sudo apt-get install -y build-essential libsystemd-dev pkg-config libssl-dev
+          sudo apt-get install -y build-essential libsystemd-dev pkg-config
       - name: Run tests
         run: cargo test --all-features
 
@@ -81,7 +81,7 @@ jobs:
     steps:
       - name: Checkout repository
         run: |
-          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/git-echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
+          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
           tar -xzf repo.tar.gz --strip-components=1
           rm -f repo.tar.gz
       - name: Install Rust
@@ -93,7 +93,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get -f install -y
-          sudo apt-get install -y build-essential libsystemd-dev pkg-config libssl-dev
+          sudo apt-get install -y build-essential libsystemd-dev pkg-config
       - name: Run cargo-audit
         run: |
           cargo install cargo-audit
@@ -106,7 +106,7 @@ jobs:
     steps:
       - name: Checkout repository
         run: |
-          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/git-echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
+          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
           tar -xzf repo.tar.gz --strip-components=1
           rm -f repo.tar.gz
       - name: Install Rust
@@ -118,7 +118,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get -f install -y
-          sudo apt-get install -y build-essential libsystemd-dev pkg-config libssl-dev
+          sudo apt-get install -y build-essential libsystemd-dev pkg-config
       - name: Run enrollment unit tests
         run: cargo test --test enroll_identity
       - name: Run enrollment integration tests
@@ -133,7 +133,7 @@ jobs:
     steps:
       - name: Checkout repository
         run: |
-          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/git-echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
+          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
           tar -xzf repo.tar.gz --strip-components=1
           rm -f repo.tar.gz
       - name: Install Rust
@@ -145,7 +145,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get -f install -y
-          sudo apt-get install -y build-essential libsystemd-dev pkg-config libssl-dev
+          sudo apt-get install -y build-essential libsystemd-dev pkg-config
       - name: Build binary
         run: cargo build
       - name: Verify --enroll flag exists
@@ -158,7 +158,7 @@ jobs:
     steps:
       - name: Checkout repository
         run: |
-          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/git-echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
+          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
           tar -xzf repo.tar.gz --strip-components=1
           rm -f repo.tar.gz
       - name: Install Rust
@@ -170,27 +170,17 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get -f install -y
-          sudo apt-get install -y build-essential debhelper pkg-config libsystemd-dev libssl-dev
-      - name: Clean previous build artifacts
-        run: |
-          cargo clean
-          rm -f ../linux-patch-api_*.deb
+          sudo apt-get install -y build-essential debhelper pkg-config libsystemd-dev
       - name: Build Debian package
         run: |
           sudo dpkg-buildpackage -us -uc -b -d
       - name: Upload to Gitea Release
-        if: github.ref_type == 'tag'
+        if: startsWith(github.ref, 'refs/tags/')
         env:
           GITEA_TOKEN: ${{ secrets.GITEATOKEN }}
         run: |
           TAG_NAME=${GITHUB_REF#refs/tags/}
           FILE=$(ls ../linux-patch-api_*.deb 2>/dev/null | head -1)
-          # Rename deb to include u2404 in filename to distinguish from u2204 build
-          if [ -n "$FILE" ]; then
-            U2404_FILE="$(echo "$FILE" | sed 's/_amd64/_u2404_amd64/')"
-            mv "$FILE" "$U2404_FILE"
-            FILE="$U2404_FILE"
-          fi
           chmod +x scripts/upload-release.sh
           ./scripts/upload-release.sh "$TAG_NAME" "$FILE"
 
@@ -201,7 +191,7 @@ jobs:
     steps:
       - name: Checkout repository
         run: |
-          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/git-echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
+          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
           tar -xzf repo.tar.gz --strip-components=1
           rm -f repo.tar.gz
       - name: Install Rust
@@ -213,16 +203,12 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get -f install -y
-          sudo apt-get install -y build-essential debhelper pkg-config libsystemd-dev libssl-dev
-      - name: Clean previous build artifacts
-        run: |
-          cargo clean
-          rm -f ../linux-patch-api_*.deb
+          sudo apt-get install -y build-essential debhelper pkg-config libsystemd-dev
       - name: Build Debian package
         run: |
           sudo dpkg-buildpackage -us -uc -b -d
       - name: Upload to Gitea Release
-        if: github.ref_type == 'tag'
+        if: startsWith(github.ref, 'refs/tags/')
         env:
           GITEA_TOKEN: ${{ secrets.GITEATOKEN }}
         run: |
@@ -244,7 +230,7 @@ jobs:
     steps:
       - name: Checkout repository
         run: |
-          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/git-echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
+          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
           tar -xzf repo.tar.gz --strip-components=1
           rm -f repo.tar.gz
       - name: Install Rust
@@ -254,47 +240,20 @@ jobs:
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
       - name: Install build dependencies
         run: |
-          sudo dnf install -y gcc rpm-build systemd-devel pkg-config openssl-devel
-      - name: Clean stale RPM artifacts
-        run: |
-          rm -f ~/rpmbuild/RPMS/x86_64/linux-patch-api-*.rpm
-          rm -f releases/linux-patch-api-*.rpm
+          sudo dnf install -y gcc rpm-build systemd-devel pkg-config
       - name: Build release binary
         run: cargo build --release
       - name: Build RPM package
         run: |
           chmod +x build-rpm.sh
-          SKIP_CARGO_BUILD=1 ./build-rpm.sh
-      - name: Verify RPM package
-        run: |
-          VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*=.*"\([^"]*\)".*/\1/')
-          RPM_FILE=$(ls ~/rpmbuild/RPMS/x86_64/linux-patch-api-${VERSION}-*.rpm 2>/dev/null | head -1)
-          if [ -z "$RPM_FILE" ]; then
-            echo "ERROR: RPM package not found for version $VERSION!"
-            ls -la ~/rpmbuild/RPMS/x86_64/ 2>/dev/null || echo "RPM directory empty or missing"
-            exit 1
-          fi
-          RPM_VERSION=$(rpm -qp --queryformat '%{VERSION}' "$RPM_FILE" 2>/dev/null || true)
-          echo "RPM file: $RPM_FILE"
-          echo "RPM version: $RPM_VERSION"
-          echo "Expected version: $VERSION"
-          if [ "$RPM_VERSION" != "$VERSION" ]; then
-            echo "ERROR: RPM version ($RPM_VERSION) does not match expected version ($VERSION)!"
-            exit 1
-          fi
-          echo "RPM verification passed"
+          ./build-rpm.sh
       - name: Upload to Gitea Release
-        if: github.ref_type == 'tag'
+        if: startsWith(github.ref, 'refs/tags/')
         env:
           GITEA_TOKEN: ${{ secrets.GITEATOKEN }}
         run: |
           TAG_NAME=${GITHUB_REF#refs/tags/}
-          VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*=.*"\([^"]*\)".*/\1/')
-          FILE=$(ls ~/rpmbuild/RPMS/x86_64/linux-patch-api-${VERSION}-*.rpm 2>/dev/null | head -1)
-          if [ -z "$FILE" ]; then
-            echo "ERROR: No RPM found with version $VERSION for upload!"
-            exit 1
-          fi
+          FILE=$(ls ~/rpmbuild/RPMS/x86_64/*.rpm 2>/dev/null | head -1)
           chmod +x scripts/upload-release.sh
           ./scripts/upload-release.sh "$TAG_NAME" "$FILE"
 
@@ -306,52 +265,32 @@ jobs:
       - name: Checkout repository
         run: |
           apk add --no-cache curl
-          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/git-echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
+          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
           tar -xzf repo.tar.gz --strip-components=1
           rm -f repo.tar.gz
       - name: Install Rust
         run: |
           apk add --no-cache curl bash
-          curl --ipv4 --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
           . "$HOME/.cargo/env"
           rustup target add x86_64-unknown-linux-musl
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
       - name: Install build dependencies
         run: |
-          apk add --no-cache alpine-sdk rust cargo openssl openssl-dev elogind-dev musl-dev abuild gcc
+          apk add --no-cache alpine-sdk rust cargo openssl-dev elogind-dev musl-dev abuild gcc
       - name: Build release binary
         run: cargo build --release --target x86_64-unknown-linux-musl
       - name: Build Alpine package
         run: |
           chmod +x build-alpine.sh
           SKIP_CARGO_BUILD=1 ./build-alpine.sh
-      - name: Verify Alpine package
-        run: |
-          EXPECTED_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*=.*"\([^"]*\)".*/\1/')
-          FILE=$(ls releases/linux-patch-api-*.apk 2>/dev/null | head -1)
-          if [ -z "$FILE" ]; then
-            echo "ERROR: No Alpine package found!"
-            exit 1
-          fi
-          echo "Expected version: $EXPECTED_VERSION"
-          echo "Package file: $FILE"
-          # Verify filename contains expected version
-          if ! echo "$FILE" | grep -q "$EXPECTED_VERSION"; then
-            echo "ERROR: Alpine package version ($FILE) does not match expected version ($EXPECTED_VERSION)!"
-            exit 1
-          fi
-          echo "Alpine package verification passed"
       - name: Upload to Gitea Release
         if: startsWith(github.ref, 'refs/tags/')
         env:
           GITEA_TOKEN: ${{ secrets.GITEATOKEN }}
         run: |
           TAG_NAME=${GITHUB_REF#refs/tags/}
-          FILE=$(ls releases/linux-patch-api-*.apk 2>/dev/null | head -1)
-          if [ -z "$FILE" ]; then
-            echo "ERROR: No Alpine package found for upload!"
-            exit 1
-          fi
+          FILE=$(ls releases/*.apk 2>/dev/null | head -1)
           chmod +x scripts/upload-release.sh
           ./scripts/upload-release.sh "$TAG_NAME" "$FILE"
 
@@ -362,7 +301,7 @@ jobs:
     steps:
       - name: Checkout repository
         run: |
-          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/git-echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
+          curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_api/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
           tar -xzf repo.tar.gz --strip-components=1
           rm -f repo.tar.gz
       - name: Install Rust
@@ -373,28 +312,12 @@ jobs:
       - name: Install build dependencies
         run: |
           sudo pacman -Syu --noconfirm rust cargo systemd git base-devel gcc
-      - name: Clean previous build artifacts
-        run: |
-          cargo clean
-          rm -f releases/linux-patch-api-*.pkg.tar.zst
       - name: Build release binary
         run: cargo build --release
       - name: Build Arch package
         run: |
           chmod +x build-arch.sh
           SKIP_CARGO_BUILD=1 ./build-arch.sh
-      - name: Verify Arch package
-        run: |
-          FILE=$(ls releases/*.pkg.tar.zst 2>/dev/null | head -1)
-          if [ -z "$FILE" ]; then
-            echo "ERROR: No Arch package found!"
-            exit 1
-          fi
-          EXPECTED_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*=.*"\([^"]*\)".*/\1/')
-          echo "Expected version: $EXPECTED_VERSION"
-          echo "Package file: $FILE"
-          # Verify the package contains the correct binary version
-          pacman -Qip "$FILE" 2>/dev/null | grep -i version || true
       - name: Upload to Gitea Release
         if: startsWith(github.ref, 'refs/tags/')
         env:

.github/workflows/ci.yml

@@ -1,294 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [master]
-    tags: ['v*.*.*']
-  pull_request:
-    branches: [master]
-
-env:
-  CARGO_TERM_COLOR: always
-  RUST_BACKTRACE: 1
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-permissions:
-  contents: write
-
-jobs:
-  # ── Quality Gates (GitHub-hosted, all triggers) ──────────────────────────
-
-  fmt:
-    name: fmt
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt
-      - uses: Swatinem/rust-cache@v2
-      - run: cargo fmt --all -- --check
-
-  clippy:
-    name: Clippy
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy
-      - uses: Swatinem/rust-cache@v2
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y build-essential libsystemd-dev pkg-config libssl-dev
-      - run: cargo clippy --all-targets --all-features -- -D warnings
-
-  test:
-    name: Tests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y build-essential libsystemd-dev pkg-config libssl-dev
-      - run: cargo test --all-features
-
-  audit:
-    name: Security Audit
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - run: cargo install cargo-audit && cargo audit --ignore RUSTSEC-2025-0134
-
-  gitleaks:
-    name: Secret scanning
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Gitleaks
-        uses: gitleaks/gitleaks-action@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  enrollment-tests:
-    name: Enrollment Tests
-    needs: [fmt, clippy]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y build-essential libsystemd-dev pkg-config libssl-dev
-      - run: cargo test --test enroll_identity
-      - run: cargo test --test enrollment_test
-      - run: cargo test --test enrollment_e2e
-
-  # ── Release Preparation (tag push only) ───────────────────────────────────
-
-  prepare-release:
-    name: Prepare Release
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs: [fmt, clippy, test, enrollment-tests, audit]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Generate release notes
-        id: release_notes
-        run: |
-          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
-          if [ -n "$PREV_TAG" ]; then
-            NOTES=$(git log ${PREV_TAG}..HEAD --pretty=format:"- %s (%h)" --no-merges)
-          else
-            NOTES=$(git log --pretty=format:"- %s (%h)" --no-merges)
-          fi
-          echo "notes<<EOF" >> $GITHUB_OUTPUT
-          echo "$NOTES" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          body: ${{ steps.release_notes.outputs.notes }}
-
-  # ── Build Jobs (tag push only, self-hosted runners) ───────────────────────
-
-  build-deb-u2404:
-    name: Build .deb (Ubuntu 24.04)
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs: [fmt, clippy, test, enrollment-tests, audit, prepare-release]
-    runs-on: [self-hosted, linux, ubuntu-24.04]
-    steps:
-      - name: Clean previous build artifacts from root
-        run: sudo rm -rf releases/ || true
-      - uses: actions/checkout@v4
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y build-essential libsystemd-dev pkg-config libssl-dev
-      - name: Add Rust to PATH
-        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-      - name: Build .deb package
-        run: chmod +x scripts/build-package.sh && scripts/build-package.sh
-      - name: Rename package with distro suffix
-        run: |
-          FILE=$(ls linux-patch-api_*_amd64.deb 2>/dev/null | head -1)
-          if [ -n "$FILE" ]; then
-            mv "$FILE" "$(echo "$FILE" | sed 's/_amd64/_u2404_amd64/')"
-          fi
-      - name: Upload to GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: linux-patch-api_*_u2404_amd64.deb
-
-  build-deb-u2204:
-    name: Build .deb (Ubuntu 22.04)
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs: [fmt, clippy, test, enrollment-tests, audit, prepare-release]
-    runs-on: [self-hosted, linux, ubuntu-22.04]
-    steps:
-      - name: Clean previous build artifacts from root
-        run: sudo rm -rf releases/ || true
-      - uses: actions/checkout@v4
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y build-essential libsystemd-dev pkg-config libssl-dev
-      - name: Add Rust to PATH
-        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-      - name: Build .deb package
-        run: chmod +x scripts/build-package.sh && scripts/build-package.sh
-      - name: Rename package with distro suffix
-        run: |
-          FILE=$(ls linux-patch-api_*_amd64.deb 2>/dev/null | head -1)
-          if [ -n "$FILE" ]; then
-            mv "$FILE" "$(echo "$FILE" | sed 's/_amd64/_u2204_amd64/')"
-          fi
-      - name: Upload to GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: linux-patch-api_*_u2204_amd64.deb
-
-  build-deb-debian13:
-    name: Build .deb (Debian 13)
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs: [fmt, clippy, test, enrollment-tests, audit, prepare-release]
-    runs-on: [self-hosted, linux, debian-13]
-    steps:
-      - name: Clean previous build artifacts from root
-        run: sudo rm -rf releases/ || true
-      - uses: actions/checkout@v4
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y build-essential libsystemd-dev pkg-config libssl-dev
-      - name: Add Rust to PATH
-        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-      - name: Build .deb package
-        run: chmod +x scripts/build-package.sh && scripts/build-package.sh
-      - name: Rename package with distro suffix
-        run: |
-          FILE=$(ls linux-patch-api_*_amd64.deb 2>/dev/null | head -1)
-          if [ -n "$FILE" ]; then
-            mv "$FILE" "$(echo "$FILE" | sed 's/_amd64/_debian13_amd64/')"
-          fi
-      - name: Upload to GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: linux-patch-api_*_debian13_amd64.deb
-
-  build-rpm-fedora:
-    name: Build .rpm (Fedora)
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs: [fmt, clippy, test, enrollment-tests, audit, prepare-release]
-    runs-on: [self-hosted, linux, fedora]
-    steps:
-      - name: Clean previous build artifacts from root
-        run: sudo rm -rf releases/ || true
-      - uses: actions/checkout@v4
-      - name: Install system dependencies
-        run: sudo dnf install -y systemd-devel openssl-devel pkg-config gcc make
-      - name: Add Rust to PATH
-        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-      - name: Build release binary
-        run: cargo build --release
-      - name: Build RPM package
-        run: chmod +x build-rpm.sh && SKIP_CARGO_BUILD=1 sudo -E ./build-rpm.sh
-      - name: Upload to GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: releases/linux-patch-api-*.rpm
-
-  build-rpm-almalinux:
-    name: Build .rpm (AlmaLinux 10)
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs: [fmt, clippy, test, enrollment-tests, audit, prepare-release]
-    runs-on: [self-hosted, linux, almalinux-10]
-    steps:
-      - name: Clean previous build artifacts from root
-        run: sudo rm -rf releases/ || true
-      - uses: actions/checkout@v4
-      - name: Install system dependencies
-        run: sudo dnf install -y systemd-devel openssl-devel pkg-config gcc make
-      - name: Add Rust to PATH
-        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-      - name: Build release binary
-        run: cargo build --release
-      - name: Build RPM package
-        run: chmod +x build-rpm.sh && SKIP_CARGO_BUILD=1 sudo -E ./build-rpm.sh
-      - name: Upload to GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: releases/linux-patch-api-*.rpm
-
-  build-arch:
-    name: Build .pkg.tar.zst (Arch Linux)
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs: [fmt, clippy, test, enrollment-tests, audit, prepare-release]
-    runs-on: [self-hosted, linux, arch]
-    steps:
-      - name: Clean previous build artifacts from root
-        run: sudo rm -rf releases/ || true
-      - uses: actions/checkout@v4
-      - name: Install system dependencies
-        run: sudo pacman -Syu --noconfirm systemd openssl pkg-config gcc
-      - name: Add Rust to PATH
-        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-      - name: Build release binary
-        run: cargo build --release
-      - name: Build Arch package
-        run: chmod +x build-arch.sh && SKIP_CARGO_BUILD=1 ./build-arch.sh
-      - name: Upload to GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: releases/*.pkg.tar.zst
-
-  build-alpine:
-    name: Build .apk (Alpine)
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs: [fmt, clippy, test, enrollment-tests, audit, prepare-release]
-    runs-on: ubuntu-latest
-    container:
-      image: alpine:latest
-      env:
-        HOME: /root
-    steps:
-      - name: Install prerequisites for actions/checkout
-        run: apk add --no-cache bash git curl tar
-      - uses: actions/checkout@v4
-      - name: Install Alpine build dependencies
-        run: apk add --no-cache gcc musl-dev openssl-dev openssl elogind-dev alpine-sdk abuild
-      - name: Install Rust via rustup
-        run: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-      - name: Add Rust to PATH
-        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-      - name: Add musl target
-        run: rustup target add x86_64-unknown-linux-musl
-      - name: Build release binary (musl target)
-        run: cargo build --release --target x86_64-unknown-linux-musl
-      - name: Build Alpine package
-        run: |
-          chmod +x build-alpine.sh
-          SKIP_CARGO_BUILD=1 ./build-alpine.sh
-      - name: Upload to GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: releases/linux-patch-api-*.apk

.gitignore

@@ -1,25 +1 @@
 /target
-/releases/
-
-# Build artifacts
-debian/tmp/
-debian/linux-patch-api/
-debian/.debhelper/
-debian/debhelper-build-stamp
-debian/files
-debian/linux-patch-api.debhelper.log
-debian/linux-patch-api.postrm.debhelper
-debian/linux-patch-api.substvars
-*.deb
-*.buildinfo
-*.changes
-
-# Private key material - NEVER commit
-*.key
-*.key.pem
-configs/certs/*.pem
-configs/certs/*.srl
-tests/e2e/certs/*.key
-
-# Agent Zero project data
-.a0proj/

API_DOCUMENTATION.md

@@ -909,7 +909,6 @@ Enrollment endpoints enable new hosts to register with the Patch Manager and rec
 | `fqdn` | string | Yes | Fully qualified domain name of the host |
 | `ip_address` | string | Yes | Primary non-loopback IPv4 address |
 | `os_details` | object | Yes | OS metadata (free-form JSON object) |
-| `hostname` | string | No | Short hostname (without domain). Used by the manager to populate `display_name` on approval. If omitted, the manager falls back to the FQDN. |
 
 **`os_details` common fields:**
 
@@ -934,8 +933,7 @@ curl -X POST https://manager.example.com/api/v1/enroll \
       "version_id": "12",
       "kernel": "6.1.0-kali9-amd64",
       "id_like": "debian"
-    },
-    "hostname": "host-01"
+    }
   }'
 ```
 

ARCHITECTURE.md

@@ -269,37 +269,18 @@ Client → [mTLS + IP Check] → [API Layer] → [GET /jobs/{id}]
 
 ### Endpoint: GET /health
 
-**Purpose:** General service status check with package cache status
+**Purpose:** General service status check
 
 **Response (200 OK - Healthy):**
 ```json
 {
   "success": true,
   "request_id": "uuid",
-  "timestamp": "2026-05-27T14:00:00Z",
+  "timestamp": "2026-04-09T13:04:02Z",
   "data": {
     "status": "healthy",
     "uptime_seconds": 12345,
-    "version": "1.1.17",
-    "last_cache_update": "2026-05-27T13:30:00+00:00",
-    "cache_status": "fresh"
-  },
-  "error": null
-}
-```
-
-**Response (200 OK - Degraded):**
-```json
-{
-  "success": true,
-  "request_id": "uuid",
-  "timestamp": "2026-05-27T14:00:00Z",
-  "data": {
-    "status": "degraded",
-    "uptime_seconds": 12345,
-    "version": "1.1.17",
-    "last_cache_update": "2026-05-27T09:00:00+00:00",
-    "cache_status": "failed"
+    "version": "0.0.1"
   },
   "error": null
 }
@@ -310,19 +291,6 @@ Client → [mTLS + IP Check] → [API Layer] → [GET /jobs/{id}]
 - mTLS is configured and valid
 - Config file is loaded and valid
 - Package manager backend is accessible
-- Package cache is fresh (refreshed within 4 hours)
-
-**Cache Refresh on Health Check:**
-- If cache is stale (>4 hours since last update), health check triggers a cache refresh
-- If refresh succeeds: status="healthy", cache_status="fresh"
-- If refresh fails: status="degraded", cache_status="failed"
-- If cache is fresh: status="healthy", cache_status="fresh"
-
-**Cache Status Values:**
-- `fresh` - Cache was updated within the last 4 hours
-- `stale` - Cache is older than 4 hours (triggers refresh)
-- `unknown` - No cache update has occurred yet
-- `failed` - Last cache refresh attempt failed
 
 **NOT Required:**
 - Metrics collection
@@ -331,41 +299,4 @@ Client → [mTLS + IP Check] → [API Layer] → [GET /jobs/{id}]
 
 ---
 
-## Package Cache Management
-
-### Module: `src/packages/cache.rs`
-
-The package cache module manages the local package index state, ensuring that package metadata is current before performing operations.
-
-**Key Components:**
-- `PackageCacheState` - Thread-safe in-memory cache state with Mutex protection
-- `PackageCacheStatus` - Snapshot of cache state for reporting
-- `CacheStateFile` - Persistent state format for serialization
-- `is_fetch_error()` - Detects 404/fetch errors for automatic retry
-- `apply_with_cache_retry()` - Generic retry wrapper for cache-related failures
-- `run_command_with_timeout()` - Executes cache refresh commands with timeout
-
-**State Persistence:**
-- Cache state persists to `/var/lib/linux_patch_api/state/cache.json`
-- State is loaded on service startup and saved after every update
-- Persists `last_cache_update` timestamp and `last_update_success` flag
-- Parent directory is auto-created if missing
-
-**Stale Detection:**
-- Cache is considered stale after 4 hours (`STALE_THRESHOLD_SECS = 14400`)
-- Health check automatically refreshes stale cache
-- Patch apply operations always refresh cache before proceeding (mandatory)
-
-**Refresh-Before-Apply Flow:**
-1. `POST /patches/apply` creates a job and spawns background task
-2. Background task refreshes package cache (mandatory, not configurable)
-3. If refresh fails: job fails immediately with error message
-4. If refresh succeeds: job progresses to 10%, applies patches
-5. If apply fails with 404/fetch error: refresh cache and retry once
-6. If retry also fails: job fails with error
-
-**Cache Refresh Timeout:** 120 seconds (`CACHE_REFRESH_TIMEOUT_SECS`)
-
----
-
 *Following kiro spec-driven development standards*

BUILD_PACKAGES.md

@@ -1,6 +1,6 @@
 # Linux Patch API - Package Build Guide
 
-This document provides comprehensive instructions for building production-ready packages for the Linux Patch API across all supported platforms: Debian/Ubuntu (.deb), RHEL/CentOS/Fedora (.rpm), Arch Linux (.pkg.tar.zst), and Alpine Linux (.apk).
+This document provides comprehensive instructions for building production-ready Debian (.deb) and RPM (.rpm) packages for the Linux Patch API.
 
 ## Prerequisites
 
@@ -173,152 +173,6 @@ rpm -ql linux-patch-api
 rpm -e linux-patch-api
 ```
 
-## Building Arch Package (.pkg.tar.zst)
-
-### Quick Build
-
-```bash
-cd /path/to/linux_patch_api
-
-# Build release binary
-cargo build --release
-
-# Build Arch package
-chmod +x build-arch.sh
-SKIP_CARGO_BUILD=1 ./build-arch.sh
-
-# Package will be created in releases/
-ls -la releases/*.pkg.tar.zst
-```
-
-### Detailed Build Process
-
-```bash
-# 1. Install build dependencies (Arch Linux)
-sudo pacman -Syu --noconfirm rust cargo systemd git base-devel gcc
-
-# 2. Build release binary
-cargo build --release
-
-# 3. Run build script
-chmod +x build-arch.sh
-./build-arch.sh
-
-# 4. Verify package contents
-bsdtar -tf releases/linux-patch-api-*.pkg.tar.zst
-
-# 5. Verify package info
-pacman -Qi releases/linux-patch-api-*.pkg.tar.zst
-```
-
-### Install Script Hooks
-
-The Arch package includes an `.install` file (`configs/linux-patch-api.install`) that runs automatically on install:
-
-- **post_install**: Creates directories, copies example configs, enables systemd service
-- **post_upgrade**: Reloads systemd daemon
-- **pre_remove**: Stops and disables service
-- **post_remove**: Cleans up empty directories
-
-### Installation Test
-
-```bash
-# Install the package
-sudo pacman -U ./releases/linux-patch-api-*.pkg.tar.zst
-
-# Verify installation
-systemctl status linux-patch-api
-linux-patch-api --version
-
-# Check installed files
-pacman -Ql linux-patch-api
-
-# Verify config files exist
-ls -la /etc/linux_patch_api/
-
-# Remove package
-sudo pacman -R linux-patch-api
-```
-
-**Note:** The build script creates a `builduser` for `makepkg` when running as root (typical in CI environments). The `.install` hook handles directory creation, config copying, and service enablement.
-
-## Building Alpine Package (.apk)
-
-### Quick Build
-
-```bash
-cd /path/to/linux_patch_api
-
-# Build release binary (MUSL target for Alpine)
-cargo build --release --target x86_64-unknown-linux-musl
-
-# Build Alpine package
-chmod +x build-alpine.sh
-SKIP_CARGO_BUILD=1 ./build-alpine.sh
-
-# Package will be created in releases/
-ls -la releases/*.apk
-```
-
-### Detailed Build Process
-
-```bash
-# 1. Install build dependencies (Alpine Linux)
-apk add --no-cache alpine-sdk rust cargo openssl openssl-dev elogind-dev musl-dev abuild gcc
-
-# 2. Add Rust MUSL target
-rustup target add x86_64-unknown-linux-musl
-
-# 3. Build release binary
-cargo build --release --target x86_64-unknown-linux-musl
-
-# 4. Run build script
-chmod +x build-alpine.sh
-./build-alpine.sh
-
-# 5. Verify package contents
-apk verify releases/*.apk
-
-# 6. List package contents
-tar -tzf releases/*.apk
-```
-
-### Install Script Hooks
-
-The Alpine package includes an install script (`configs/linux-patch-api.apk-install`) that runs automatically on install:
-
-- **pre_install**: Creates directories, sets ownership and permissions
-- **post_install**: Copies example configs, adds service to default runlevel
-- **pre_deinstall**: Stops and removes service from runlevel
-- **post_deinstall**: Cleans up empty directories
-
-### Installation Test
-
-```bash
-# Install the package
-sudo apk add --allow-unstable ./releases/linux-patch-api-*.apk
-
-# Verify installation
-rc-service linux-patch-api status
-linux-patch-api --version
-
-# Check installed files
-apk info -L linux-patch-api
-
-# Verify config files exist
-ls -la /etc/linux_patch_api/
-
-# Remove package
-sudo apk del linux-patch-api
-```
-
-**Important:** Alpine uses **OpenRC** instead of systemd. Key differences:
-- Start service: `rc-service linux-patch-api start`
-- Stop service: `rc-service linux-patch-api stop`
-- Check status: `rc-service linux-patch-api status`
-- Service init script: `/etc/init.d/linux-patch-api`
-- The `abuild` tool generates signing keys automatically for CI builds
-
 ## Using the Interactive Installer
 
 For manual deployment without package managers:
@@ -355,17 +209,15 @@ The installer will:
 | `/var/lib/linux_patch_api/` | Data directory | 755 |
 | `/var/log/linux_patch_api/` | Log directory | 755 |
 
-### Service Account
+### System User/Group
 
 | Property | Value |
 |----------|-------|
-| User | root |
-| Group | root |
+| User | linux-patch-api |
+| Group | linux-patch-api |
 | Home | /var/lib/linux_patch_api |
-| Shell | N/A (systemd service) |
-| Type | Runs as root (required for package management) |
-
-**Note:** The service runs as root because package management operations (apt, dnf, apk, pacman) require root privileges. Security is provided by mTLS + IP whitelist, not process isolation.
+| Shell | /usr/sbin/nologin |
+| Type | System account |
 
 ## Supported Distributions
 
@@ -388,19 +240,6 @@ The installer will:
 | AlmaLinux | 8, 9 | ✅ Supported |
 | Rocky Linux | 8, 9 | ✅ Supported |
 
-### Arch Package (.pkg.tar.zst)
-
-| Distribution | Versions | Status |
-|--------------|----------|--------|
-| Arch Linux | Rolling | ✅ Supported |
-| Manjaro | Rolling | ✅ Supported |
-
-### Alpine Package (.apk)
-
-| Distribution | Versions | Status |
-|--------------|----------|--------|
-| Alpine Linux | 3.18+ | ✅ Supported |
-
 ## Troubleshooting
 
 ### Debian Package Issues
@@ -437,62 +276,9 @@ cat ~/rpmbuild/BUILDROOT/*/var/log/rpmbuild.log
 dnf install -y systemd-devel pkgconfig
 ```
 
-### Arch Package Issues
-
-**Error: `makepkg: cannot run as root`**
-```bash
-# The build script handles this automatically by creating builduser
-# If running manually:
-useradd -m builduser
-su - builduser -c "cd /path/to/repo && makepkg -f --noconfirm"
-```
-
-**Error: `install script not found`**
-```bash
-# Ensure linux-patch-api.install is in the same directory as PKGBUILD
-ls -la configs/linux-patch-api.install
-# The build script copies it automatically
-```
-
-**Error: `Permission denied` on config files**
-```bash
-# Verify ownership is root:root
-ls -la /etc/linux_patch_api/
-# Fix if needed:
-sudo chown -R root:root /etc/linux_patch_api/
-sudo chmod 750 /etc/linux_patch_api /etc/linux_patch_api/certs
-```
-
-### Alpine Package Issues
-
-**Error: `abuild: UNTRUSTED signature`**
-```bash
-# The build script handles key generation automatically
-# If running manually:
-abuild-keygen -a -n
-cp /root/.abuild/*.rsa.pub /etc/apk/keys/
-```
-
-**Error: `apk add: ERROR: failed to create directory`**
-```bash
-# Verify the install script ran correctly
-ls -la /etc/linux_patch_api/
-ls -la /var/lib/linux_patch_api/
-# Manually create if needed:
-sudo mkdir -p /etc/linux_patch_api/certs /var/lib/linux_patch_api /var/log/linux_patch_api
-```
-
-**Error: `rc-service: service not found`**
-```bash
-# Verify the init script exists
-ls -la /etc/init.d/linux-patch-api
-# Re-add to default runlevel
-sudo rc-update add linux-patch-api default
-```
-
 ### Service Issues
 
-**Service fails to start (systemd):**
+**Service fails to start:**
 ```bash
 # Check service status
 systemctl status linux-patch-api
@@ -507,22 +293,6 @@ linux-patch-api --config /etc/linux_patch_api/config.yaml --check
 ls -la /etc/linux_patch_api/certs/
 ```
 
-**Service fails to start (OpenRC/Alpine):**
-```bash
-# Check service status
-rc-service linux-patch-api status
-
-# View logs
-cat /var/log/linux_patch_api/linux-patch-api.log
-cat /var/log/linux_patch_api/linux-patch-api.err
-
-# Check configuration
-linux-patch-api --config /etc/linux_patch_api/config.yaml --check
-
-# Verify certificates
-ls -la /etc/linux_patch_api/certs/
-```
-
 ## CI/CD Integration
 
 ### GitHub Actions Example
@@ -613,7 +383,7 @@ jobs:
 - Packages are signed with maintainer GPG key for production deployments
 - All maintainer scripts run with `set -e` for fail-fast behavior
 - Configuration files are marked as conffiles to preserve user modifications
-- Service runs as root (required for package management operations)
+- System user has minimal privileges (nologin shell, no home directory)
 - Directory permissions follow principle of least privilege
 - TLS certificates should be replaced with CA-signed certs in production
 

CONTRIBUTING.md

@@ -1,79 +0,0 @@
-# Contributing to Linux-Patch-Api
-
-Thank you for your interest in contributing to Linux-Patch-Api! We appreciate every contribution — from bug reports and documentation improvements to new features and security fixes.
-
-## Code of Conduct
-
-This project follows the [Contributor Covenant v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/) code of conduct. By participating, you are expected to uphold this standard. Please report unacceptable behavior to the maintainers.
-
-## How to Contribute
-
-1. **Fork** the repository
-2. Create a **feature branch** from `main`:
-   ```bash
-   git checkout -b feat/my-feature
-   ```
-3. Make your changes
-4. Ensure all CI checks pass:
-   ```bash
-   cargo fmt --check
-   cargo clippy -- -D warnings
-   cargo test
-   ```
-5. **Commit** using conventional commit format (see below)
-6. Open a **Pull Request** against `main`
-
-## Development Setup
-
-### Prerequisites
-
-- **Rust toolchain** (stable) — [rustup](https://rustup.rs/)
-- **System dependencies**:
-  ```bash
-  sudo apt-get install build-essential libsystemd-dev pkg-config libssl-dev
-  ```
-
-### Build & Run
-
-```bash
-cargo build
-cargo test
-```
-
-## Commit Messages
-
-We use [Conventional Commits](https://www.conventionalcommits.org/):
-
-| Prefix   | Usage                  |
-|----------|------------------------|
-| `feat:`  | New feature            |
-| `fix:`   | Bug fix                |
-| `docs:`  | Documentation changes  |
-| `chore:` | Maintenance tasks      |
-| `refactor:` | Code refactoring    |
-| `test:`  | Adding or updating tests |
-| `ci:`    | CI configuration changes |
-
-Example:
-```
-feat: add endpoint for patch rollback
-```
-
-## Pull Request Requirements
-
-- All CI checks must pass (fmt, clippy, test, audit, build)
-- One feature or fix per PR — keep changes focused
-- Include a clear description of what changed and why
-- Update documentation if your change affects behavior
-
-## Reporting Issues
-
-Use [GitHub Issues](https://github.com/Draco-Lunaris/Linux-Patch-Api/issues) to report bugs, request features, or ask questions. Please include:
-
-- Steps to reproduce (for bugs)
-- Expected vs. actual behavior
-- Relevant logs or error messages
-
-## License
-
-By contributing, you agree that your contributions are licensed under the [Apache License 2.0](LICENSE), the same license as this project.

Cargo.lock

@@ -44,18 +44,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "actix-governor"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0954b0f27aabd8f56bb03f2a77b412ddf3f8c034a3c27b2086c1fc75415760df"
-dependencies = [
- "actix-http",
- "actix-web",
- "futures",
- "governor",
-]
-
 [[package]]
 name = "actix-http"
 version = "3.12.1"
@@ -402,15 +390,6 @@ version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
-[[package]]
-name = "arc-swap"
-version = "1.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a3a1fd6f75306b68087b831f025c712524bcb19aad54e557b1129cfa0a2b207"
-dependencies = [
- "rustversion",
-]
-
 [[package]]
 name = "arraydeque"
 version = "0.5.1"
@@ -842,6 +821,26 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -980,19 +979,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "dashmap"
-version = "5.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
-dependencies = [
- "cfg-if",
- "hashbrown 0.14.5",
- "lock_api",
- "once_cell",
- "parking_lot_core",
-]
-
 [[package]]
 name = "data-encoding"
 version = "2.11.0"
@@ -1207,6 +1193,15 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared 0.1.1",
+]
+
 [[package]]
 name = "foreign-types"
 version = "0.5.0"
@@ -1214,7 +1209,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
 dependencies = [
  "foreign-types-macros",
- "foreign-types-shared",
+ "foreign-types-shared 0.3.1",
 ]
 
 [[package]]
@@ -1228,6 +1223,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
 [[package]]
 name = "foreign-types-shared"
 version = "0.3.1"
@@ -1339,12 +1340,6 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
-[[package]]
-name = "futures-timer"
-version = "3.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
-
 [[package]]
 name = "futures-util"
 version = "0.3.32"
@@ -1413,26 +1408,6 @@ dependencies = [
  "wasip3",
 ]
 
-[[package]]
-name = "governor"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68a7f542ee6b35af73b06abc0dad1c1bae89964e4e253bc4b587b91c9637867b"
-dependencies = [
- "cfg-if",
- "dashmap",
- "futures",
- "futures-timer",
- "no-std-compat",
- "nonzero_ext",
- "parking_lot",
- "portable-atomic",
- "quanta",
- "rand 0.8.6",
- "smallvec",
- "spinning_top",
-]
-
 [[package]]
 name = "h2"
 version = "0.3.27"
@@ -1528,12 +1503,6 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
 
-[[package]]
-name = "hex"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
-
 [[package]]
 name = "http"
 version = "0.2.12"
@@ -1637,6 +1606,22 @@ dependencies = [
  "webpki-roots",
 ]
 
+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
+
 [[package]]
 name = "hyper-util"
 version = "0.1.20"
@@ -1655,9 +1640,11 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "socket2 0.6.3",
+ "system-configuration",
  "tokio",
  "tower-service",
  "tracing",
+ "windows-registry",
 ]
 
 [[package]]
@@ -1982,31 +1969,25 @@ dependencies = [
 
 [[package]]
 name = "linux-patch-api"
-version = "1.3.2"
+version = "0.3.12"
 dependencies = [
  "actix",
- "actix-governor",
  "actix-rt",
  "actix-tls",
  "actix-web",
  "actix-web-actors",
  "addr",
  "anyhow",
- "arc-swap",
  "async-channel",
- "base64 0.22.1",
  "chrono",
  "clap",
  "config",
  "criterion",
  "fs2",
  "futures-util",
- "hex",
  "if-addrs",
  "notify",
  "pidlock",
- "rand 0.8.6",
- "rcgen",
  "reqwest",
  "rustls",
  "rustls-pemfile",
@@ -2014,12 +1995,10 @@ dependencies = [
  "serde_json",
  "serde_yaml",
  "serial_test",
- "socket2 0.5.10",
  "sysinfo",
  "systemd",
  "tempfile",
  "thiserror 1.0.69",
- "time",
  "tokio",
  "tokio-rustls",
  "tokio-test",
@@ -2144,6 +2123,23 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "native-tls"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
 [[package]]
 name = "nix"
 version = "0.30.1"
@@ -2156,12 +2152,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "no-std-compat"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b93853da6d84c2e3c7d730d6473e8817692dd89be387eb01b94d7f108ecb5b8c"
-
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -2172,12 +2162,6 @@ dependencies = [
  "minimal-lexical",
 ]
 
-[[package]]
-name = "nonzero_ext"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38bf9645c8b145698bb0b18a4637dcacbc421ea49bef2317e4fd8065a387cf21"
-
 [[package]]
 name = "notify"
 version = "6.1.1"
@@ -2286,6 +2270,49 @@ version = "11.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
 
+[[package]]
+name = "openssl"
+version = "0.10.80"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a45fa2aa886c42762255da344f0a0d313e254066c46aad76f300c3d3da62d967"
+dependencies = [
+ "bitflags 2.11.1",
+ "cfg-if",
+ "foreign-types 0.3.2",
+ "libc",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.116"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28a22dc7140cda5f096e5e7724a6962ca81a7f8bfd2979f9b18c11af56318c4"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "ordered-multimap"
 version = "0.7.3"
@@ -2331,16 +2358,6 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
 
-[[package]]
-name = "pem"
-version = "3.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
-dependencies = [
- "base64 0.22.1",
- "serde_core",
-]
-
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -2447,12 +2464,6 @@ dependencies = [
  "plotters-backend",
 ]
 
-[[package]]
-name = "portable-atomic"
-version = "1.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
-
 [[package]]
 name = "potential_utf"
 version = "0.1.5"
@@ -2511,21 +2522,6 @@ version = "2.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33cb294fe86a74cbcf50d4445b37da762029549ebeea341421c7c70370f86cac"
 
-[[package]]
-name = "quanta"
-version = "0.12.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3ab5a9d756f0d97bdc89019bd2e4ea098cf9cde50ee7564dde6b81ccc8f06c7"
-dependencies = [
- "crossbeam-utils",
- "libc",
- "once_cell",
- "raw-cpuid",
- "wasi",
- "web-sys",
- "winapi",
-]
-
 [[package]]
 name = "quinn"
 version = "0.11.9"
@@ -2678,15 +2674,6 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
-[[package]]
-name = "raw-cpuid"
-version = "11.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
-dependencies = [
- "bitflags 2.11.1",
-]
-
 [[package]]
 name = "rayon"
 version = "1.12.0"
@@ -2707,20 +2694,6 @@ dependencies = [
  "crossbeam-utils",
 ]
 
-[[package]]
-name = "rcgen"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
-dependencies = [
- "pem",
- "ring",
- "rustls-pki-types",
- "time",
- "x509-parser",
- "yasna",
-]
-
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -2782,15 +2755,20 @@ checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
  "base64 0.22.1",
  "bytes",
+ "encoding_rs",
  "futures-core",
+ "h2 0.4.13",
  "http 1.4.0",
  "http-body",
  "http-body-util",
  "hyper",
  "hyper-rustls",
+ "hyper-tls",
  "hyper-util",
  "js-sys",
  "log",
+ "mime",
+ "native-tls",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
@@ -2801,6 +2779,7 @@ dependencies = [
  "serde_urlencoded",
  "sync_wrapper",
  "tokio",
+ "tokio-native-tls",
  "tokio-rustls",
  "tower",
  "tower-http",
@@ -2962,6 +2941,15 @@ dependencies = [
  "sdd",
 ]
 
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -2974,6 +2962,29 @@ version = "3.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
 
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags 2.11.1",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "semver"
 version = "1.0.28"
@@ -3179,15 +3190,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "spinning_top"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d96d2d1d716fb500937168cc09353ffdc7a012be8475ac7308e1bdf0e3923300"
-dependencies = [
- "lock_api",
-]
-
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -3258,6 +3260,27 @@ dependencies = [
  "windows 0.52.0",
 ]
 
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags 2.11.1",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "systemd"
 version = "0.10.1"
@@ -3265,7 +3288,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "01e9d1976a15b86245def55d20d52b5818e1a1e81aa030b6a608d3ce57709423"
 dependencies = [
  "cstr-argument",
- "foreign-types",
+ "foreign-types 0.5.0",
  "libc",
  "libsystemd-sys",
  "log",
@@ -3438,6 +3461,16 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-rustls"
 version = "0.26.4"
@@ -3790,6 +3823,12 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
@@ -4090,6 +4129,17 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.4.1"
@@ -4418,7 +4468,6 @@ dependencies = [
  "lazy_static",
  "nom",
  "oid-registry",
- "ring",
  "rusticata-macros",
  "thiserror 1.0.69",
  "time",
@@ -4435,15 +4484,6 @@ dependencies = [
  "hashlink",
 ]
 
-[[package]]
-name = "yasna"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
-dependencies = [
- "time",
-]
-
 [[package]]
 name = "yoke"
 version = "0.8.2"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "linux-patch-api"
-version = "1.3.2"
+version = "0.3.12"
 edition = "2021"
 authors = ["Echo <echo@moon-dragon.us>"]
 description = "Secure remote package management API for Linux systems"
@@ -16,9 +16,6 @@ actix-web-actors = "4"
 actix = "0.13"
 actix-tls = { version = "3", features = ["rustls-0_23"] }
 
-# Rate limiting (actix-governor for per-IP rate limiting)
-actix-governor = "0.6"
-
 # Async runtime
 tokio = { version = "1", features = ["full"] }
 
@@ -26,7 +23,7 @@ tokio = { version = "1", features = ["full"] }
 rustls = { version = "0.23", features = ["aws_lc_rs"] }
 rustls-pemfile = "2"
 tokio-rustls = "0.26"
-x509-parser = { version = "0.16", features = ["verify"] }
+x509-parser = "0.16"
 
 # WebSocket support (actix-web-actors provides WebSocket for Actix-web)
 tokio-tungstenite = "0.21"
@@ -51,7 +48,6 @@ uuid = { version = "1", features = ["v4", "serde"] }
 
 # Time/Date
 chrono = { version = "0.4", features = ["serde"] }
-time = "0.3"
 
 # Error handling
 thiserror = "1"
@@ -68,7 +64,7 @@ addr = "0.15"
 if-addrs = "0.13"
 
 # HTTP client for enrollment communication
-reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
+reqwest = { version = "0.12", features = ["json", "rustls-tls"] }
 
 # Clap for CLI arguments
 clap = { version = "4", features = ["derive", "env"] }
@@ -80,28 +76,15 @@ pidlock = "0.2"
 # URL parsing
 url = "2"
 
-# Socket options (SO_REUSEADDR)
-socket2 = { version = "0.5", features = ["all"] }
-
 # File locking for concurrent-safe whitelist modifications
 fs2 = "0.4"
 
-# Atomic swapping for CRL state updates without rebuilding ServerConfig
-arc-swap = "1"
-
-# Base64 decoding for PEM CRL parsing
-base64 = "0.22"
-
 [dev-dependencies]
 actix-rt = "2"
 tokio-test = "0.4"
 wiremock = "0.6"
 serial_test = "3"
 tempfile = "3"
-rcgen = { version = "0.13", features = ["pem", "x509-parser"] }
-rand = "0.8"
-hex = "0.4"
-time = { version = "0.3", features = ["std"] }
 criterion = { version = "0.5", features = ["html_reports"] }
 
 # Integration tests in subdirectories
@@ -117,14 +100,6 @@ path = "tests/integration/enrollment_test.rs"
 name = "enrollment_e2e"
 path = "tests/e2e/test_enrollment_e2e.rs"
 
-[[test]]
-name = "auth_test"
-path = "tests/integration/auth_test.rs"
-
-[[test]]
-name = "rate_limit_test"
-path = "tests/unit/rate_limit_test.rs"
-
 [[bench]]
 name = "api_benchmarks"
 harness = false

DEPLOYMENT_GUIDE.md

@@ -181,7 +181,7 @@ tls:
   ca_cert: "/etc/linux_patch_api/certs/ca.pem"
   server_cert: "/etc/linux_patch_api/certs/server.pem"
   server_key: "/etc/linux_patch_api/certs/server.key"
-  # TLS 1.3 is the only supported version (hardcoded, not configurable)
+  min_tls_version: "1.3"
 
 jobs:
   max_concurrent: 5
@@ -448,37 +448,15 @@ shred -u /tmp/client001.key.pem
 
 ## Self-Enrollment Deployment
 
-Self-enrollment allows a new host to automatically request and receive mTLS certificates from the `linux_patch_manager` without manual PKI distribution. The daemon supports two enrollment modes:
-
-1. **Auto-enrollment (recommended):** When `enrollment.manager_url` is configured in `config.yaml`, the daemon automatically enrolls on startup when certificates are missing or invalid. After provisioning, it continues to normal mTLS server startup.
-
-2. **Manual enrollment:** Run `linux-patch-api --enroll <manager_url>` explicitly. The process provisions certificates and **exits** — it does NOT start the server. Start the service separately after enrollment completes.
+Self-enrollment allows a new host to automatically request and receive mTLS certificates from the `linux_patch_manager` without manual PKI distribution. The daemon extracts its machine identity, registers with the manager, polls for admin approval, and provisions certificates before starting the mTLS server.
 
 ### How It Works
 
 The enrollment workflow operates in three phases:
 
 1. **Registration:** Extracts `/etc/machine-id`, FQDN, IP address, and OS details. Submits an unauthenticated `POST /api/v1/enroll` request to the manager. Receives a temporary `polling_token`.
-2. **Polling & Approval:** Enters a polling loop querying `GET /api/v1/enroll/status/{token}` (default: every 60 seconds, up to 1440 attempts = 24 hours). Aborts on HTTP 403/404 (denied/purged). The polling token is persisted to `config.yaml` for resume after service restart.
-3. **Provisioning:** On HTTP 200, downloads the PKI bundle (`ca.crt`, `server.crt`, `server.key`), writes certificates to configured mTLS paths, appends manager IP to whitelist. For auto-enrollment, transitions to standard mTLS listening mode. For `--enroll`, exits with code 0.
-
-### Certificate Validation
-
-On startup, the daemon validates all configured TLS certificates before attempting to bind the listening port:
-
-1. **Existence:** All three cert files must exist at configured paths
-2. **Parse:** Each file must be valid PEM (X.509 for certs, PKCS#8/PKCS#1 for keys)
-3. **Expiry:** Certs must not be expired. Certs expiring within `cert_renewal_threshold_days` (default 7) trigger a warning
-4. **Key match:** Server cert public key must correspond to server key private key
-5. **CA trust:** Server cert must be signed by the CA cert
-
-Validation results determine startup behavior:
-
-| Result | Action |
-|--------|--------|
-| Valid | Start normally with mTLS |
-| ExpiringSoon | Log warning, start normally, schedule re-enrollment |
-| Missing/Corrupt/Expired/KeyMismatch/Untrusted | Auto-enroll if `enrollment.manager_url` configured, otherwise exit with guidance |
+2. **Polling & Approval:** Enters a polling loop querying `GET /api/v1/enroll/status/{token}` (default: every 60 seconds, up to 1440 attempts = 24 hours). Aborts on HTTP 403/404 (denied/purged).
+3. **Provisioning:** On HTTP 200, downloads the PKI bundle (`ca.crt`, `server.crt`, `server.key`), writes certificates to configured mTLS paths, appends manager IP to whitelist, and transitions to standard mTLS listening mode.
 
 ### Prerequisites
 
@@ -502,53 +480,62 @@ nslookup manager.example.com
 curl -ks https://manager.example.com/api/v1/health
 ```
 
-### Deployment Method 1: Auto-Enrollment (Recommended)
+### Step-by-Step Enrollment Procedure
 
-The simplest deployment. Just install the package, configure the manager URL, and start the service. The daemon handles the rest.
-
-#### Step 1: Install Package
+#### Step 1: Install linux-patch-api Package
 
 ```bash
 # Debian/Ubuntu
-dpkg -i linux-patch-api_1.2.0-1_amd64.deb
+dpkg -i linux-patch-api_1.0.0-1_amd64.deb
 
 # RHEL/CentOS/Fedora
-rpm -ivh linux-patch-api-1.2.0-1.x86_64.rpm
+rpm -ivh linux-patch-api-1.0.0-1.x86_64.rpm
 ```
 
-#### Step 2: Configure Enrollment URL
+#### Step 2: Run Enrollment Command
 
 ```bash
-# Edit the config to add manager URL
-cat >> /etc/linux_patch_api/config.yaml <<EOF
+# Basic enrollment with manager URL
+sudo linux-patch-api --enroll https://manager.example.com
 
-enrollment:
-  manager_url: "https://linux-patch-manager-dev.moon-dragon.us"
-  polling_interval_seconds: 60
-  max_poll_attempts: 1440
-  cert_renewal_threshold_days: 7
-EOF
+# With verbose logging for troubleshooting
+sudo linux-patch-api --enroll https://manager.example.com --verbose
 ```
 
-#### Step 3: Start Service
+The enrollment process will:
+- Extract machine identity from `/etc/machine-id` and system properties
+- Submit registration request to manager
+- Enter polling loop (logs progress every 60 seconds)
+- Await admin approval on the manager side
+- Download and install certificates automatically
+- Update IP whitelist with manager address
+- Start mTLS server upon successful provisioning
+
+#### Step 3: Monitor Enrollment Progress
 
 ```bash
-# Enable and start
-systemctl enable linux-patch-api
-systemctl start linux-patch-api
-
-# Watch auto-enrollment progress
+# View enrollment logs in real-time
 journalctl -u linux-patch-api -f
+
+# Or if running manually:
+sudo linux-patch-api --enroll https://manager.example.com --verbose
 ```
 
-The daemon will:
-1. Validate certificates → find them missing
-2. Read `enrollment.manager_url` → begin auto-enrollment
-3. Register with manager, poll for approval
-4. Provision certificates after admin approval
-5. Continue to normal mTLS server startup
-
-**No manual `--enroll` command needed.** The service self-heals on restart if certificates are missing or invalid.
+**Expected log progression:**
+```
+INFO Enrollment mode activated - manager_url=https://manager.example.com
+INFO Phase 1: Submitting registration request
+INFO Registration submitted - polling_token=abc123...
+INFO Phase 2: Polling for approval (interval=60s, max_attempts=1440)
+INFO Poll attempt 1/1440 - status=pending
+... (admin approves on manager side) ...
+INFO Phase 3: Provisioning certificates
+INFO ca.pem written to /etc/linux_patch_api/certs/ca.pem
+INFO server.pem written to /etc/linux_patch_api/certs/server.pem
+INFO server.key written to /etc/linux_patch_api/certs/server.key
+INFO Manager IP added to whitelist
+INFO Enrollment complete - proceeding to server startup
+```
 
 #### Step 4: Admin Approval (Manager Side)
 
@@ -574,61 +561,6 @@ curl --cacert /etc/linux_patch_api/certs/ca.pem \
      https://localhost:12443/health
 ```
 
-### Deployment Method 2: Manual Enrollment
-
-For environments where auto-enrollment is not desired, or for initial setup before the service is enabled.
-
-#### Step 1: Install Package
-
-```bash
-# Debian/Ubuntu
-dpkg -i linux-patch-api_1.2.0-1_amd64.deb
-
-# RHEL/CentOS/Fedora
-rpm -ivh linux-patch-api-1.2.0-1.x86_64.rpm
-```
-
-#### Step 2: Run Enrollment Command
-
-```bash
-# Basic enrollment with manager URL
-sudo linux-patch-api --enroll https://linux-patch-manager-dev.moon-dragon.us
-
-# With verbose logging for troubleshooting
-sudo linux-patch-api --enroll https://linux-patch-manager-dev.moon-dragon.us --verbose
-```
-
-**Important:** The `--enroll` command provisions certificates and **exits**. It does NOT start the server. This prevents port conflicts with the systemd service.
-
-The enrollment process will:
-- Extract machine identity from `/etc/machine-id` and system properties
-- Submit registration request to manager
-- Enter polling loop (logs progress every 60 seconds)
-- Await admin approval on the manager side
-- Download and install certificates automatically
-- Update IP whitelist with manager address
-- Print: "Enrollment complete. Start service: systemctl start linux-patch-api"
-- Exit with code 0
-
-#### Step 3: Start Service
-
-```bash
-systemctl enable linux-patch-api
-systemctl start linux-patch-api
-systemctl status linux-patch-api
-```
-
-### Certificate Renewal
-
-Certificates can be renewed manually or automatically:
-
-```bash
-# Manual renewal
-sudo linux-patch-api --renew-certs
-
-# Auto-renewal: certs expiring within cert_renewal_threshold_days trigger re-enrollment on startup
-```
-
 ### Configuration Options
 
 Enrollment behavior can be tuned via the `enrollment` section in `/etc/linux_patch_api/config.yaml`:
@@ -636,22 +568,16 @@ Enrollment behavior can be tuned via the `enrollment` section in `/etc/linux_pat
 ```yaml
 # Enrollment Configuration
 enrollment:
-  manager_url: "https://linux-patch-manager-dev.moon-dragon.us"
   polling_interval_seconds: 60    # Time between approval polls (default: 60)
   max_poll_attempts: 1440         # Maximum poll attempts (default: 1440 = 24 hours)
-  polling_token: ""               # Auto-populated during enrollment (do not edit)
-  cert_renewal_threshold_days: 7  # Days before expiry to trigger re-enrollment
 ```
 
 **Parameter Reference:**
 
 | Parameter | Default | Description |
 |-----------|---------|-------------|
-| `manager_url` | (none) | Manager URL for auto-enrollment. Required for auto-enrollment on startup. |
 | `polling_interval_seconds` | 60 | Seconds between approval status polls. Minimum: 10 |
 | `max_poll_attempts` | 1440 | Maximum polling attempts before timeout. Effective timeout = interval × attempts |
-| `polling_token` | (empty) | Auto-populated during enrollment for resume after restart. Do not edit manually. |
-| `cert_renewal_threshold_days` | 7 | Days before cert expiry to trigger automatic re-enrollment |
 
 **Effective Timeout Calculation:**
 - Default: 60s × 1440 = 86,400 seconds (24 hours)

HARDENING_REPORT.md

@@ -20,7 +20,7 @@ This report documents the implementation of 6 security hardening fixes deferred
 | VULN-003 | LOW | Input Validation | ✅ RESOLVED | src/api/handlers/packages.rs |
 | VULN-004 | MEDIUM | Header Security | ✅ RESOLVED | src/main.rs |
 | VULN-005 | LOW | HTTP Protocol | ✅ RESOLVED | src/api/routes.rs |
-| VULN-006 | LOW | Header Security | ✅ RESOLVED | src/auth/security_headers.rs |
+| VULN-006 | LOW | Header Security | ✅ RESOLVED | src/auth/mtls.rs |
 
 ---
 
@@ -176,19 +176,20 @@ web::scope("/api/v1")
 **Finding:** Duplicate Content-Type headers were accepted.
 
 **Implementation:**
-- `has_duplicate_critical_headers()` function checks for duplicate headers on every request
+- Added `has_duplicate_critical_headers()` function to check for duplicate headers
 - Monitors critical headers: `content-type`, `authorization`, `host`
-- Implemented as `SecurityHeadersMiddleware` — a dedicated Actix-web middleware
-- Wired into the middleware pipeline in `main.rs` between WhitelistMiddleware and Logger
-- Rejects requests with duplicate critical headers with HTTP 400 Bad Request
+- Integrated into mTLS middleware `call()` method
+- Rejects requests with duplicate critical headers before further processing
 
-**Code Location:** `src/auth/security_headers.rs`
+**Code Location:** `src/auth/mtls.rs` (lines 26-49, 203-212)
 
 ```rust
-pub fn has_duplicate_critical_headers(headers: &HeaderMap) -> bool {
-    for header_name in CRITICAL_HEADERS.iter() {
+fn has_duplicate_critical_headers(req: &ServiceRequest) -> bool {
+    let critical_headers = ["content-type", "authorization", "host"];
+    
+    for header_name in critical_headers.iter() {
         let mut count = 0;
-        for (name, _value) in headers.iter() {
+        for (name, _) in req.headers().iter() {
             if name.as_str().eq_ignore_ascii_case(header_name) {
                 count += 1;
                 if count > 1 {
@@ -201,29 +202,7 @@ pub fn has_duplicate_critical_headers(headers: &HeaderMap) -> bool {
 }
 ```
 
-**Response:** HTTP 400 Bad Request with error message "Duplicate critical headers not allowed"
-
-**Architecture Note:** The duplicate-header check was originally in `MtlsMiddleware`, which was dead code (never wired into the pipeline). It has been extracted into `SecurityHeadersMiddleware`, which IS wired into the pipeline and runs on every request. Client certificate authentication is handled at the TLS handshake level by rustls via `CrlAwareVerifier` — no application-layer certificate middleware is needed. See `src/auth/mtls.rs` for the ADR documenting this decision.
-
----
-
-## Architecture Decision Record: rustls as Authoritative Client-Auth Gate
-
-**Decision:** Client certificate authentication is enforced at the TLS handshake level by rustls via `CrlAwareVerifier`, NOT by application-layer middleware.
-
-**Context:** The original `MtlsMiddleware` was never wired into the Actix-web pipeline. It contained both a duplicate-header check (VULN-006) and a `validate_client_certificate()` stub that returned `Ok(())` unconditionally. Meanwhile, the actual client certificate verification was always performed by rustls at the TLS handshake level through `CrlAwareVerifier`, which wraps `WebPkiClientVerifier`.
-
-**Rationale:**
-- rustls provides battle-tested X.509 verification at the TLS handshake level
-- Enforcing auth at the TLS layer eliminates bypass vulnerabilities (middleware ordering bugs, route-specific skips)
-- CRL revocation checking is integrated into the same handshake path via `CrlAwareVerifier`
-- Application-layer certificate validation is redundant when the TLS layer already rejects untrusted connections
-
-**Consequences:**
-- `MtlsMiddleware` (Transform/Service) and `validate_client_certificate()` have been removed as dead code
-- `build_rustls_config()` is now a free function (no longer a method on `MtlsMiddleware`)
-- `SecurityHeadersMiddleware` handles VULN-006 (duplicate critical header rejection) as a dedicated, wired middleware
-- `ClientCertInfo` struct is preserved for potential future use in extracting certificate details from TLS sessions
+**Response:** HTTP 400 Bad Request with message "Duplicate critical headers not allowed"
 
 ---
 

LICENSE

@@ -1,190 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to the Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by the Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   Copyright 2025-2026 Draco Lunaris
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

README.md

@@ -2,7 +2,7 @@
 
 **Version:** 1.0.0  
 **Status:** Production Ready  
-**License:** [Apache 2.0](LICENSE)  
+**License:** Internal Use Only  
 
 Secure REST API for remote package and patch management on Linux systems.
 
@@ -185,13 +185,6 @@ For detailed enrollment procedures, see [DEPLOYMENT_GUIDE.md - Self-Enrollment D
 
 ### Package Installation
 
-All platform packages produce identical installation results:
-- Creates `/etc/linux_patch_api/`, `/etc/linux_patch_api/certs/`, `/var/lib/linux_patch_api/`, `/var/log/linux_patch_api/`
-- Copies example configs to live configs if not already present
-- Enables the service (does not start automatically)
-- Sets correct permissions (750 on config dirs, 755 on data/log dirs)
-- Ownership: root:root (service runs as root)
-
 #### Debian/Ubuntu (.deb)
 
 ```bash
@@ -204,173 +197,52 @@ apt-get install -f -y
 # Verify installation
 systemctl status linux-patch-api
 linux-patch-api --version
-
-# Check installed files
-dpkg -L linux-patch-api
-
-# Remove package (keeping configs)
-dpkg -r linux-patch-api
-
-# Purge package (removing all configs)
-dpkg -P linux-patch-api
 ```
 
-**Prerequisites:** `systemd`, `libsystemd0`
-
-**Post-install:** The package automatically copies example configs, enables the service, and prints next steps. Configure `/etc/linux_patch_api/config.yaml` and place TLS certificates in `/etc/linux_patch_api/certs/` before starting.
-
 #### RHEL/CentOS/Fedora (.rpm)
 
 ```bash
-# Install the package (recommended - resolves dependencies automatically)
-dnf install -y ./linux-patch-api-1.0.0-1.el9.x86_64.rpm
-
-# Or with yum
-yum install -y ./linux-patch-api-1.0.0-1.el9.x86_64.rpm
-
-# Or with rpm (does NOT resolve dependencies)
-rpm -ivh linux-patch-api-1.0.0-1.el9.x86_64.rpm
+# Install the package
+rpm -ivh linux-patch-api-1.0.0-1.x86_64.rpm
 
 # Verify installation
 systemctl status linux-patch-api
 linux-patch-api --version
-
-# Check installed files
-rpm -ql linux-patch-api
-
-# Remove package
-rpm -e linux-patch-api
 ```
 
-**Prerequisites (auto-resolved with dnf/yum):** `systemd`, `libsystemd`, `openssl-libs`, `ca-certificates`
-
-**Post-install:** The package automatically creates directories, copies example configs, enables the service, and prints next steps. Configure `/etc/linux_patch_api/config.yaml` and place TLS certificates in `/etc/linux_patch_api/certs/` before starting.
-
-**Note:** Use `dnf install` or `yum install` instead of `rpm -ivh` to automatically resolve dependencies. The `rpm -ivh` command will fail if required packages are not already installed.
-
-#### Arch Linux (.pkg.tar.zst)
-
-```bash
-# Install the package
-sudo pacman -U ./linux-patch-api-1.0.0-1-x86_64.pkg.tar.zst
-
-# Verify installation
-systemctl status linux-patch-api
-linux-patch-api --version
-
-# Check installed files
-pacman -Ql linux-patch-api
-
-# Remove package
-sudo pacman -R linux-patch-api
-```
-
-**Prerequisites:** `systemd` (included by default on Arch)
-
-**Post-install:** The package automatically creates directories, copies example configs, enables the service, and prints next steps. Configure `/etc/linux_patch_api/config.yaml` and place TLS certificates in `/etc/linux_patch_api/certs/` before starting.
-
-**Note:** Arch uses systemd by default. The install hook runs `systemctl enable` but does not start the service. You must configure before starting.
-
-#### Alpine Linux (.apk)
-
-```bash
-# Install the package
-sudo apk add --allow-unstable ./linux-patch-api-1.0.0-r0.apk
-
-# Verify installation
-rc-service linux-patch-api status
-linux-patch-api --version
-
-# Check installed files
-apk info -L linux-patch-api
-
-# Remove package
-sudo apk del linux-patch-api
-```
-
-**Prerequisites:** `openrc` (included by default on Alpine)
-
-**Post-install:** The package automatically creates directories, copies example configs, adds the service to the default runlevel, and prints next steps. Configure `/etc/linux_patch_api/config.yaml` and place TLS certificates in `/etc/linux_patch_api/certs/` before starting.
-
-**Important differences from systemd-based systems:**
-- Alpine uses **OpenRC** instead of systemd. Use `rc-service` commands instead of `systemctl`
-- Start service: `rc-service linux-patch-api start`
-- Stop service: `rc-service linux-patch-api stop`
-- Check status: `rc-service linux-patch-api status`
-- The service is added to the `default` runlevel automatically on install
-- Service init script: `/etc/init.d/linux-patch-api`
-
 ### Manual Installation
 
 For systems without package manager support:
 
 ```bash
 # Run interactive installer (requires root)
-sudo ./install.sh
+./install.sh
 ```
 
 The installer will:
 - Detect operating system
-- Create directory structure (`/etc/linux_patch_api/`, `/var/lib/linux_patch_api/`, `/var/log/linux_patch_api/`)
-- Install binary to `/usr/bin/linux-patch-api`
-- Install example configs
+- Create system user and group
+- Set up directory structure
+- Install binary and configuration files
 - Configure systemd service
-- Set correct permissions
 
 ### Building from Source
 
-#### Prerequisites (all platforms)
-
-- Rust toolchain (stable channel, 1.75+)
-- OpenSSL development headers
-- systemd development headers
-- C compiler (gcc)
-
-#### Build Debian Package (.deb)
-
 ```bash
-# On Debian/Ubuntu
-apt-get install -y build-essential debhelper pkg-config libsystemd-dev libssl-dev cargo rustc
-cargo build --release
-sudo dpkg-buildpackage -us -uc -b
-```
+# Clone repository
+git clone https://gitea.internal/linux-patch-api.git
+cd linux-patch-api
 
-#### Build RPM Package (.rpm)
-
-```bash
-# On Fedora/RHEL/CentOS
-dnf install -y rpm-build cargo rust gcc openssl-devel systemd-devel pkgconfig
+# Build release binary
 cargo build --release --target x86_64-unknown-linux-gnu
-chmod +x build-rpm.sh
-./build-rpm.sh
+
+# Build Debian package
+dpkg-buildpackage -us -uc -b
+
+# Or build RPM package
+rpmbuild -ba linux-patch-api.spec
 ```
 
-**Note:** The RPM spec includes `BuildRequires` for native RPM build environments. When building in CI containers (where deps are pre-installed via apt-get), these are informational only.
-
-#### Build Arch Package (.pkg.tar.zst)
-
-```bash
-# On Arch Linux/Manjaro
-pacman -Syu --noconfirm rust cargo systemd git base-devel gcc
-cargo build --release
-chmod +x build-arch.sh
-SKIP_CARGO_BUILD=1 ./build-arch.sh
-```
-
-**Note:** The build script creates a `builduser` for `makepkg` when running as root (typical in CI). The `.install` hook handles directory creation, config copying, and service enablement.
-
-#### Build Alpine Package (.apk)
-
-```bash
-# On Alpine Linux 3.18+
-apk add --no-cache alpine-sdk rust cargo openssl openssl-dev elogind-dev musl-dev abuild gcc
-cargo build --release --target x86_64-unknown-linux-musl
-chmod +x build-alpine.sh
-SKIP_CARGO_BUILD=1 ./build-alpine.sh
-```
-
-**Important:** Alpine requires the `x86_64-unknown-linux-musl` target for static linking. The build script handles `abuild` key generation and runs as a `builduser` when executed as root.
-
 See [BUILD_PACKAGES.md](./BUILD_PACKAGES.md) for detailed build instructions.
 
 ---
@@ -395,7 +267,7 @@ tls:
   ca_cert: "/etc/linux_patch_api/certs/ca.pem"
   server_cert: "/etc/linux_patch_api/certs/server.pem"
   server_key: "/etc/linux_patch_api/certs/server.key"
-  # TLS 1.3 is the only supported version (hardcoded, not configurable)
+  min_tls_version: "1.3"
 
 # Job Configuration
 jobs:
@@ -691,9 +563,7 @@ linux-patch-api --check-config
 
 ## License
 
-This project is licensed under the [Apache License 2.0](LICENSE).
-
-Copyright 2025-2026 Draco Lunaris
+Internal Use Only - Not for external distribution
 
 **Version:** 1.0.0  
 **Release Date:** 2026-07-17

REQUIREMENTS.md

@@ -50,16 +50,6 @@
 - Log configuration changes (whitelist updates, cert renewals)
 - Log system changes made by the API
 
-### FR-007: Package Cache Refresh
-
-- The agent MUST refresh the local package index before every patch_apply operation
-- The agent MUST refresh the local package index when the health check detects stale cache (>4 hours)
-- The agent SHOULD automatically retry patch_apply once after cache refresh on 404/fetch errors
-- The agent SHOULD track and report last_cache_update timestamp in health check responses
-- Cache state persists to /var/lib/linux_patch_api/state/cache.json across service restarts
-- Cache refresh before apply is mandatory and not configurable
-- Cache refresh timeout is 120 seconds
-
 ---
 ## Non-Functional Requirements
 

SECURITY.md

@@ -1,46 +1,346 @@
-# Security Policy
+# Linux_Patch_API - Security Specification Document
 
-## Supported Versions
+## Security Overview
 
-Only the **latest release** is currently supported with security updates.
+**Philosophy:** Defense in depth with zero-trust principles for internal network.
 
-| Version | Supported |
-|---------|----------|
-| Latest  | ✅       |
-| Older   | ❌       |
+**Approach:** 
+- mTLS certificate-based authentication (required for all connections)
+- IP whitelist enforcement (deny by default, allow only listed)
+- Comprehensive audit logging for all operations
+- Systemd hardening and process isolation
+- Minimal attack surface (internal network only)
 
-## Reporting a Vulnerability
+---
 
-**Do not report security vulnerabilities through public GitHub Issues.**
+## Threat Model
 
-Instead, use GitHub's private vulnerability reporting:
+### Threat Actor Profile
 
-👉 [Report a vulnerability for Linux-Patch-Api](https://github.com/Draco-Lunaris/Linux-Patch-Api/security/advisories/new)
+| Attribute | Description |
+|-----------|-------------|
+| **Origin** | Internal network only |
+| **Skill Level** | Moderate to High |
+| **Resources** | Limited (not nation-state) |
+| **Motivation** | Unauthorized system access, privilege escalation |
+| **Access** | Must bypass mTLS + IP whitelist |
 
-This allows us to coordinate a fix before public disclosure.
+### STRIDE Threat Analysis
 
-### Response Timeline
+| Threat Category | Potential Threat | Mitigation | Status |
+|-----------------|------------------|------------|--------|
+| **Spoofing** | Attacker impersonates valid client | mTLS certificate validation, unique certs per client | ✅ Mitigated |
+| **Spoofing** | Attacker uses expired/revoked cert | Certificate expiry validation (1-year max) | ✅ Mitigated |
+| **Tampering** | API requests modified in transit | TLS 1.3 encryption | ✅ Mitigated |
+| **Tampering** | Config files modified unauthorized | File permissions (600/644), config validation before reload | ✅ Mitigated |
+| **Repudiation** | Client denies making request | Audit logging with request_id, client cert ID | ✅ Mitigated |
+| **Repudiation** | Server denies response | Comprehensive audit trail (systemd journal) | ✅ Mitigated |
+| **Information Disclosure** | Package/data info leaked to unauthorized | Silent drop for non-mTLS, IP whitelist | ✅ Mitigated |
+| **Information Disclosure** | Error messages leak system info | Detailed errors only for authenticated clients | ✅ Mitigated |
+| **Denial of Service** | Resource exhaustion via many requests | Internal network only, IP whitelist limits exposure | ⚠️ Partial |
+| **Denial of Service** | Job queue flooding | Configurable concurrent job limit (default: 5) | ✅ Mitigated |
+| **Denial of Service** | Long-running job starvation | 30-minute job timeout enforcement | ✅ Mitigated |
+| **Elevation of Privilege** | Unauthorized package installation | Root required, but mTLS + IP whitelist required | ✅ Mitigated |
+| **Elevation of Privilege** | Subprocess escape | SystemCallFilter, ProtectSystem=strict | ✅ Mitigated |
 
-- **Acknowledgment** within 48 hours
-- **Initial assessment** within 7 days
-- **Ongoing updates** on remediation progress
+### Attack Vectors & Mitigations
 
-## Disclosure Policy
+| Attack Vector | Likelihood | Impact | Mitigation |
+|---------------|------------|--------|------------|
+| Network interception | Low | Critical | TLS 1.3 only, mTLS required |
+| Certificate theft | Medium | Critical | Cert permissions (600), internal CA only |
+| IP spoofing | Low | High | IP whitelist + mTLS (both required) |
+| Config file tampering | Medium | High | File permissions, validation before reload |
+| Package manager injection | Low | Critical | Pluggable backend with input validation |
+| Job manipulation | Low | High | Job storage isolation, exclusive rollback mode |
+| Log tampering | Medium | High | systemd journal (immutable), optional remote syslog |
 
-We follow **coordinated disclosure**:
+---
 
-- We ask for **90 days** before public disclosure of a vulnerability
-- Security advisories are published via [GitHub Security Advisories](https://github.com/Draco-Lunaris/Linux-Patch-Api/security/advisories)
-- We will work with you to determine an appropriate disclosure timeline when a fix requires more time
+## Authentication & Authorization
 
-## Security Best Practices
+### Authentication Requirements
 
-This project is a security tool — we hold ourselves to a high standard:
+- **Method:** mTLS certificate-based authentication
+- **Certificate Type:** Unique client certificate per client (1-year validity)
+- **CA:** Internal self-hosted Certificate Authority
+- **TLS Version:** TLS 1.3 only
+- **Multi-factor:** Certificate + IP whitelist (dual requirement)
+- **Session Management:** Stateless (no sessions)
 
-- **Signed commits**: All commits must be signed (SSH signing)
-- **CI enforcement**: All PRs require passing CI checks (fmt, clippy, test, audit, build)
-- **Dependency auditing**: `cargo audit` runs in CI to catch known vulnerabilities
+### Authorization Model
 
-## Credit
+- **Model:** Binary authorization (all-or-nothing)
+- **Permission Levels:** Single level (full access if authenticated)
+- **Requirements:**
+  - Valid mTLS certificate (not expired, signed by internal CA)
+  - Source IP in whitelist (YAML config, instant apply)
+- **No RBAC:** All authenticated clients have full API access
 
-Contributors who responsibly report vulnerabilities will be credited in the corresponding GitHub Security Advisory.
+---
+
+## Data Security
+
+### Encryption at Rest
+
+- **Certificates:** File permissions 600 for private keys
+- **Job Storage:** `/var/lib/linux_patch_api/jobs/` (cleared on restart)
+- **Config Files:** `/etc/linux_patch_api/` (644 for config, 600 for keys)
+- **Audit Logs:** systemd journal (immutable by default)
+
+### Encryption in Transit
+
+- **Protocol:** TLS 1.3 only
+- **Port:** 12443
+- **Cipher Suites:** TLS 1.3 default (no legacy cipher support)
+- **Certificate Validation:** Mutual TLS (server + client cert required)
+
+### Key Management
+
+- **CA Private Key:** Stored securely on CA host only
+- **Server Certificates:** `/etc/linux_patch_api/certs/server.key` (600)
+- **Client Certificates:** Distributed manually to authorized clients
+- **Rotation:** 1-year certificate expiry, manual renewal process
+- **Revocation:** Not implemented (rely on expiry + physical cert retrieval)
+
+---
+
+## API Security
+
+### Input Validation
+
+- **Package Names:** Alphanumeric + standard package chars only
+- **Versions:** Semantic versioning validation
+- **IP Addresses:** IPv4 + CIDR validation for whitelist
+- **JSON Schema:** Strict schema validation for all request bodies
+- **Path Traversal:** Blocked (no `..` in paths)
+
+### Rate Limiting
+
+- **Not Required:** Internal network only with strict IP whitelist
+- **Job Concurrency:** Configurable limit (default: 5 concurrent jobs)
+- **Job Timeout:** 30-minute maximum per job
+
+### CORS Policy
+
+- **Not Applicable:** API is not browser-accessible
+- **Origin:** mTLS clients only (no browser CORS concerns)
+
+---
+
+## Audit & Logging
+
+### Security Events to Log
+
+- All API requests (endpoint, method, timestamp, client cert ID, source IP)
+- Authentication events (success/failure, cert validation result)
+- Authorization events (IP whitelist match/failure)
+- Package operations (package name, version, action, result)
+- Configuration changes (config reload, whitelist updates)
+- Job lifecycle events (create, start, complete, fail, timeout, rollback)
+- Service events (start, stop, restart, config validation failures)
+
+### Log Protection
+
+- **Primary Storage:** systemd journal (immutable, access-controlled)
+- **Secondary Storage:** Optional remote syslog
+- **Fallback:** Local file `/var/log/linux_patch_api/audit.log` (640)
+- **Retention:** 30 days with daily rotation and compression
+- **Access:** Root only, audit group read access
+- **Integrity:** systemd journal provides tamper evidence
+
+---
+
+## Compliance Requirements
+
+- **Internal Standards:** Follows organizational security policies
+- **No External Compliance:** Not designed for PCI-DSS, HIPAA, SOC2 (can be extended)
+- **Audit Trail:** Comprehensive logging supports internal audit requirements
+- **Access Control:** mTLS + IP whitelist provides strong access control
+
+---
+
+## Security Testing
+
+### Penetration Testing
+
+- **Schedule:** Required before production deployment
+- **Scope:**
+  - mTLS authentication bypass attempts
+  - IP whitelist enforcement testing
+  - API endpoint fuzzing
+  - Certificate validation testing
+  - Config file tampering attempts
+  - Privilege escalation attempts
+- **Tester:** Internal security team or external contractor
+- **Frequency:** Annual or after major changes
+
+### Vulnerability Management
+
+- **Dependency Scanning:** Rust crate security advisories monitored
+- **System Patches:** Host system patched via API itself (dogfooding)
+- **Certificate Updates:** Annual renewal process
+- **Config Audits:** Quarterly review of whitelist and security settings
+- **Incident Response:** Log analysis for security event investigation
+
+---
+
+## Phase 3 Security Testing Results
+
+**Test Date:** 2026-04-09  
+**Tester:** Agent Zero Fuzz Testing Agent  
+**Status:** ✅ ALL CRITICAL ISSUES RESOLVED - Minor improvements recommended
+
+### Security Test Summary (16 Tests)
+
+| Category | Passed | Failed | Status |
+|----------|--------|--------|--------|
+| mTLS Enforcement | 3 | 0 | ✅ Complete |
+| IP Whitelist | 1 | 0 | ✅ Complete |
+| API Endpoints | 5 | 0 | ✅ Complete |
+| Input Validation | 3 | 0 | ✅ Complete |
+| Certificate Security | 2 | 0 | ✅ Complete |
+| Configuration Security | 2 | 0 | ✅ Complete |
+| **TOTAL** | **16** | **0** | **✅ 100%** |
+
+---
+
+## Phase 3 Fuzz Testing Results
+
+**Test Date:** 2026-04-09  
+**Tester:** Agent Zero Fuzz Testing Agent  
+**Test Type:** Comprehensive Fuzz Testing  
+**Overall Status:** ⚠️ GOOD - Minor improvements needed
+
+### Fuzz Test Summary (21 Tests)
+
+| Section | Tests | Passed | Failed | Pass Rate |
+|---------|-------|--------|--------|-----------|
+| API Input Fuzzing | 8 | 5 | 3 | 62.5% |
+| Request Header Fuzzing | 5 | 2 | 3 | 40% |
+| Certificate Fuzzing | 5 | 5 | 0 | 100% |
+| Rate Limiting/DoS | 3 | 3 | 0 | 100% |
+| **TOTAL** | **21** | **15** | **6** | **71.4%** |
+
+### Vulnerabilities Identified
+
+| ID | Severity | Category | Description | Status |
+|----|----------|----------|-------------|--------|
+| VULN-001 | MEDIUM | Input Validation | Missing input length validation | 📝 Recommended |
+| VULN-002 | MEDIUM | Input Validation | Path traversal partial bypass | 📝 Recommended |
+| VULN-003 | LOW | Input Validation | Empty string validation missing | 📝 Recommended |
+| VULN-004 | MEDIUM | Header Security | Missing header size limits | 📝 Recommended |
+| VULN-005 | LOW | HTTP Protocol | Invalid methods return 404 vs 405 | 📝 Recommended |
+| VULN-006 | LOW | Header Security | Duplicate header handling | 📝 Recommended |
+
+### Security Strengths Confirmed
+
+✅ **mTLS Implementation: ROBUST**
+- All invalid certificates properly rejected at TLS layer
+- Silent drop behavior prevents information leakage
+- Certificate chain validation working correctly
+
+✅ **Injection Protection: EFFECTIVE**
+- SQL injection patterns: 4/4 blocked
+- Command injection patterns: 5/5 handled safely
+
+✅ **DoS Protection: ADEQUATE**
+- Large payloads (10MB) properly rejected with HTTP 413
+- Concurrent connections (20) handled gracefully
+- Rapid flooding (100 req) completed without service degradation
+
+### Recommendations for Phase 4
+
+**Medium Priority:**
+1. Implement input length validation (package names: 256 chars max)
+2. Enhance path traversal protection with strict normalization
+3. Configure header size limits (8KB max)
+
+**Low Priority:**
+4. Return 405 Method Not Allowed for unsupported methods
+5. Reject empty strings for required fields
+6. Handle duplicate headers with rejection
+
+---
+
+## Overall Security Assessment
+
+| Category | Status | Notes |
+|----------|--------|-------|
+| Authentication (mTLS) | ✅ SECURE | All certificate attacks blocked |
+| Authorization (IP Whitelist) | ✅ SECURE | Properly enforced |
+| Input Validation | ⚠️ GOOD | Minor improvements recommended |
+| Injection Protection | ✅ SECURE | SQL/Command/Path traversal blocked |
+| DoS Protection | ✅ SECURE | Large payloads rejected |
+| Certificate Security | ✅ SECURE | Robust mTLS implementation |
+
+**Overall Security Posture: GOOD**
+
+The API is suitable for internal network deployment. The 6 identified vulnerabilities are low-to-medium severity and represent hardening opportunities rather than critical security gaps. All critical and high severity issues from earlier testing have been resolved.
+
+
+---
+
+## Phase 3 Threat Model Validation
+
+**Validation Date:** 2026-04-09  
+**Validator:** Threat Model Validation Agent (Agent Zero)  
+**Report:** THREAT_MODEL_VALIDATION.md  
+
+### STRIDE Validation Summary
+
+| Category | Status | Confidence |
+|----------|--------|------------|
+| Spoofing | ✅ Fully Mitigated | High |
+| Tampering | ⚠️ Partially Mitigated | Medium |
+| Repudiation | ✅ Fully Mitigated | High |
+| Information Disclosure | ✅ Fully Mitigated | High |
+| Denial of Service | ⚠️ Partially Mitigated | Medium |
+| Elevation of Privilege | ✅ Fully Mitigated | High |
+
+### Key Findings
+
+**Validated Strengths:**
+- mTLS authentication robust (all certificate attacks blocked)
+- TLS 1.3 enforcement verified (plain HTTP rejected)
+- IP whitelist enforcement working correctly
+- Audit logging provides strong non-repudiation
+- Job-level DoS protection implemented
+- Injection protection effective (SQL, command, path traversal)
+- Systemd hardening in place
+
+**Identified Gaps (Medium Priority):**
+- Rate limiting not implemented (relies on network security)
+- Header size limits not configured
+- Input length validation missing
+- Config file integrity relies on permissions only
+- No certificate revocation mechanism
+
+**Recommendation:** Proceed to Phase 4 with focus on medium-priority hardening items. API suitable for internal network deployment with current mitigations.
+
+---
+
+## Test Artifacts
+
+- Fuzz test script: `/a0/usr/projects/linux_patch_api/fuzz_tests.sh`
+- Security test script: `/a0/usr/projects/linux_patch_api/security_tests.sh`
+- Fuzz test report: `/a0/usr/projects/linux_patch_api/FUZZ_TEST_REPORT.md`
+- Security findings report: `/a0/usr/projects/linux_patch_api/SECURITY_FINDINGS_REPORT.md`
+- Threat model validation: `/a0/usr/projects/linux_patch_api/THREAT_MODEL_VALIDATION.md`
+- API specification: `/a0/usr/projects/linux_patch_api/API_SPEC.md`
+
+---
+
+*Security documentation updated following Phase 3 Security Hardening and Threat Model Validation - Agent Zero*
+---
+
+## Test Artifacts
+
+- Fuzz test script: `/a0/usr/projects/linux_patch_api/fuzz_tests.sh`
+- Security test script: `/a0/usr/projects/linux_patch_api/security_tests.sh`
+- Fuzz test report: `/a0/usr/projects/linux_patch_api/FUZZ_TEST_REPORT.md`
+- API specification: `/a0/usr/projects/linux_patch_api/API_SPEC.md`
+
+---
+
+*Security documentation updated following Phase 3 Security Hardening - Agent Zero Fuzz Testing Agent*

SECURITY_CONTROLS_MATRIX.md

@@ -41,7 +41,7 @@
 | **SPEC.md Reference** | Lines 132-138 |
 | **Requirement** | Internal self-hosted CA for certificate issuance |
 | **Implementation** | OpenSSL CA infrastructure with 4096-bit RSA keys |
-| **Evidence** | `configs/CA_SETUP.md`, `scripts/generate-dev-certs.sh` (private keys generated at runtime, not committed) |
+| **Evidence** | `configs/CA_SETUP.md`, `configs/certs/ca.pem`, `configs/certs/ca.key.pem` |
 | **Test Result** | ✅ PASS - CA properly signs server and client certificates |
 | **Compliance Status** | ✅ COMPLIANT |
 
@@ -52,7 +52,7 @@
 | **SPEC.md Reference** | Line 136 |
 | **Requirement** | Unique certificate per client (no shared certs) |
 | **Implementation** | Per-client certificate generation with unique CN |
-| **Evidence** | `scripts/generate-dev-certs.sh` (certificates generated at runtime, not committed) |
+| **Evidence** | `configs/certs/client001.pem`, `SECURITY.md` line 65 |
 | **Test Result** | ✅ PASS - Each client has distinct certificate |
 | **Compliance Status** | ✅ COMPLIANT |
 
@@ -63,7 +63,7 @@
 | **SPEC.md Reference** | Line 135 |
 | **Requirement** | 1 year standard certificate expiration |
 | **Implementation** | Certificates generated with `-days 365` parameter |
-| **Evidence** | `scripts/generate-dev-certs.sh` (certificates generated at runtime, not committed) |
+| **Evidence** | `configs/certs/` certificate files, `openssl x509 -in cert.pem -noout -dates` |
 | **Test Result** | ✅ PASS - Expired certificates properly rejected (FUZZ_TEST_REPORT.md Test 3.2) |
 | **Compliance Status** | ✅ COMPLIANT |
 
@@ -137,7 +137,7 @@
 | **SPEC.md Reference** | Lines 86-89 |
 | **Requirement** | Private key permissions 600 (owner read/write only) |
 | **Implementation** | File permissions set during certificate deployment |
-| **Evidence** | Private keys generated at runtime with `chmod 600` by `scripts/generate-dev-certs.sh`, not committed to repository |
+| **Evidence** | `configs/certs/*.key.pem` (chmod 600), `DEPLOYMENT_SECURITY_GUIDE.md` Section 1 |
 | **Test Result** | ✅ PASS - Key files properly protected |
 | **Compliance Status** | ✅ COMPLIANT |
 

SECURITY_FINDINGS_REPORT.md

@@ -15,7 +15,7 @@
 | **Total Tests** | 16 |
 | **Passed** | 16 |
 | **Failed** | 0 |
-| **Critical Findings** | 1 (Issue #12 - Committed Private Keys - RESOLVED) |
+| **Critical Findings** | 0 (Previously 1 - RESOLVED) |
 | **High Findings** | 0 (Previously 2 - RESOLVED) |
 | **Medium Findings** | 3 (Unchanged) |
 | **Low Findings** | 4 (Unchanged) |
@@ -150,36 +150,6 @@ Consider storing CA key on separate, more secure host.
 
 ---
 
-### 🔴 CRITICAL: Committed Private Key Material (Issue #12)
-
-**Description:**  
-Private key files (`*.key`, `*.key.pem`) were committed to version control in:
-- `configs/certs/ca.key.pem` — CA private key
-- `configs/certs/server.key.pem` — Server private key
-- `configs/certs/client001.key.pem` — Client private key
-- `tests/e2e/certs/client.key` — E2E test client private key
-
-Committed private keys are a critical security risk: anyone with repository access
-(even read-only) can impersonate the server or clients, decrypt captured TLS traffic,
-or forge certificates signed by the CA.
-
-**Status:** ✅ RESOLVED
-
-**Remediation Applied:**
-1. Removed all private key files from git tracking (`git rm --cached`)
-2. Added `*.key`, `*.key.pem`, `configs/certs/`, and `tests/e2e/certs/*.key` to `.gitignore`
-3. Created `scripts/generate-dev-certs.sh` to generate test certificates at runtime
-4. Updated e2e tests to generate certificates on demand instead of loading from disk
-5. Added `gitleaks` secret scanning to CI pipeline
-6. Git history will be purged with `git filter-repo` after PR merge
-
-**Key Rotation:**  
-These keys were used for development/testing only. No production key rotation is needed.
-All committed keys should be considered compromised and must not be used in any
-production environment.
-
----
-
 ### 🟢 LOW: No Automated Security Scanning
 
 **Description:**  
@@ -265,39 +235,5 @@ The Linux_Patch_API Phase 3 is now **SECURE FOR DEPLOYMENT** in an internal netw
 
 ---
 
-## Architecture Decision Record: rustls as Authoritative Client-Auth Gate
-
-**Date:** 2026-06-06  
-**Status:** Accepted  
-**Context:** Issue #13
-
-### Decision
-
-Client certificate authentication is enforced at the TLS handshake level by rustls via `CrlAwareVerifier`, NOT by application-layer middleware.
-
-### Context
-
-The original `MtlsMiddleware` was never wired into the Actix-web pipeline (dead code). It contained:
-1. A duplicate-header check (VULN-006) that never ran
-2. A `validate_client_certificate()` stub that returned `Ok(())` unconditionally
-
-Meanwhile, actual client certificate verification was always performed by rustls at the TLS handshake level through `CrlAwareVerifier` (which wraps `WebPkiClientVerifier`), with CRL revocation checking integrated into the same path.
-
-### Changes Made
-
-1. **Removed dead code:** `MtlsMiddleware`, `MtlsMiddlewareService`, `validate_client_certificate()`, and the Transform/Service impls
-2. **Extracted VULN-006:** `has_duplicate_critical_headers()` moved to new `SecurityHeadersMiddleware` (wired into pipeline)
-3. **Converted `build_rustls_config()`** from method on `MtlsMiddleware` to free function
-4. **Preserved:** `CrlAwareVerifier`, `MtlsConfig`, `MtlsError`, `ClientCertInfo`, `build_rustls_config()`, and all CRL infrastructure
-
-### Rationale
-
-- rustls provides battle-tested X.509 verification at the TLS handshake level
-- Enforcing auth at the TLS layer eliminates bypass vulnerabilities (middleware ordering bugs, route-specific skips)
-- CRL revocation checking is integrated into the same handshake path
-- Application-layer certificate validation is redundant when TLS already rejects untrusted connections
-
----
-
 **Report Generated:** 2026-04-09T22:57:00Z  
 **Verified By:** Security Verification Agent (Agent Zero)

SPEC.md

@@ -3,7 +3,7 @@
 ## Project Overview
 **Title:** Linux_Patch_API  
 **Description:** API service for secure remote management of patching processes and software add/removal  
-**Version:** 1.2.0  
+**Version:** 0.0.1  
 **Status:** Draft  
 
 ## Scope
@@ -142,82 +142,23 @@
 ## Certificate Management
 
 - **CA Type:** Internal self-hosted Certificate Authority
-- **Distribution:** Automated Self-Enrollment (preferred) OR manual certificate distribution
-  - Auto-Enrollment: daemon automatically enrolls on startup when certs are missing/invalid and `enrollment.manager_url` is configured
-  - Manual Enrollment: `linux-patch-api --enroll <url>` for explicit enrollment (exits after completion, does not start server)
+- **Distribution:** Manual certificate distribution OR automated Self-Enrollment
+  - Self-Enrollment provides automatic PKI provisioning after admin approval on linux_patch_manager
   - Eliminates manual certificate copy/permission management for new hosts
 - **Scope:** Limited distribution (small number of authorized clients)
 - **Validity Period:** 1 year standard expiration
 - **Client Identity:** Unique certificate per client (no shared certs)
-- **Rotation:** Automatic re-enrollment when certs are expiring within threshold, or manual via `--renew-certs`
-
-## Certificate Validation
-
-On startup, the daemon validates all configured TLS certificates before attempting to bind the listening port. Validation checks (in order):
-
-1. **Existence**: All three cert files (`ca_cert`, `server_cert`, `server_key`) must exist at configured paths
-2. **Parse**: Each file must be valid PEM — CA and server cert must parse as X.509, server key must parse as PKCS#8 or PKCS#1
-3. **Expiry**: CA cert and server cert must not be expired (`not_after > now`). Certs expiring within `cert_renewal_threshold_days` (default 7) trigger a warning and auto-re-enrollment
-4. **Key match**: Server cert's public key must correspond to server key's private key
-5. **CA trust**: Server cert must be signed by the CA cert (or chain validates to CA)
-
-Validation results determine startup behavior:
-
-| Result | Action |
-|--------|--------|
-| Valid | Start normally with mTLS |
-| ExpiringSoon | Log warning, start normally, schedule background re-enrollment |
-| Missing/Corrupt/Expired/KeyMismatch/Untrusted | Trigger auto-enrollment if `enrollment.manager_url` configured, otherwise exit with guidance |
+- **Rotation:** Manual renewal process before expiration
 
 ## Self-Enrollment Workflow
 
-The `linux_patch_api` daemon supports automated self-enrollment to securely request identity from the `linux_patch_manager` without manual PKI distribution. Enrollment can be triggered automatically on startup or manually via CLI.
-
-### Auto-Enrollment on Startup
-
-When cert validation fails AND `enrollment.manager_url` is configured in config.yaml, the daemon automatically enters enrollment mode:
-
-1. Log: "Certs [status]. Auto-enrolling with <url>"
-2. Skip cert validation (`skip_tls_validation=true`)
-3. Register with manager (POST /api/v1/enroll)
-   - If host already exists: log warning, skip to step 5 (polling for re-provisioning)
-   - If new registration: receive polling token
-4. Poll for approval (GET /api/v1/enroll/status/{token})
-   - Persist `polling_token` to config.yaml for resume after restart
-   - Retry with exponential backoff on network errors
-5. When approved: provision certs (ca.pem, server.pem, server.key)
-6. Re-validate certs (should now be Valid)
-7. Continue to normal mTLS server startup
-
-If enrollment fails (network error, manager unreachable):
-- Log: "Auto-enrollment failed: [error]. Retrying on next restart."
-- Exit code 1 (triggers systemd restart with backoff)
-
-If no enrollment URL is configured and certs are invalid:
-- Log clear error with guidance (add URL, run --enroll, or place certs manually)
-- Exit code 0 (don't trigger restart loop)
-
-### Polling Token Resume
-
-If the service restarts during enrollment polling:
-1. Read `polling_token` from config.yaml (persisted during enrollment)
-2. If token exists and `enrollment.manager_url` is configured:
-   a. Resume polling from where left off
-   b. Don't re-register (host already has a pending request)
-3. On successful provisioning:
-   a. Clear `polling_token` from config.yaml
-   b. Continue to normal server startup
-
-### CLI Enrollment (`--enroll`)
+The `linux_patch_api` daemon supports an automated self-enrollment workflow to securely request identity from the `linux_patch_manager` without manual PKI distribution.
 
+### CLI Invocation
 ```
 linux-patch-api --enroll https://<manager_url>
 ```
-
-The enrollment flow runs and **exits after completion** — it does NOT start the server. This prevents port conflicts with the systemd service.
-
-- On success: prints "Enrollment complete. Start service: systemctl start linux-patch-api" and exits with code 0
-- On failure: exits with code 1 (triggers systemd restart if configured)
+The enrollment flow runs before mTLS server startup. On success, the daemon proceeds to normal server initialization with the newly provisioned certificates.
 
 ### Security Model
 - Initial connection uses TLS with verification disabled (`danger_accept_invalid_certs`)
@@ -228,7 +169,7 @@ The enrollment flow runs and **exits after completion** — it does NOT start th
 ### Phase 1: Registration Request
 - **Identity Extraction:**
   - `/etc/machine-id` (fallback: `/var/lib/dbus/machine-id`)
-  - FQDN from `hostname -f` (validated contains `.`) → `hostname` + `hostname -d` → `/etc/hostname` → `hostname` → `localhost`
+  - FQDN from `/etc/hostname` → `hostname -f` → `hostname` → `localhost`
   - Non-loopback IPv4 addresses via network interface enumeration
   - OS details from `/etc/os-release` (distro, version, id_like, codename) + kernel version (`uname -r`)
 - **Submission:** Unauthenticated `POST /api/v1/enroll` to manager with identity payload
@@ -255,7 +196,7 @@ The enrollment flow runs and **exits after completion** — it does NOT start th
 - **Backup Strategy:** Existing certificate files renamed to `.bak` before overwrite
 - **Target Paths:** Configured via TLS settings or defaults (`/etc/linux_patch_api/certs/{ca,server,server.key}.pem`)
 - **Whitelist Auto-Append:** Manager IP resolved (hostname → DNS or direct IP) and appended to `/etc/linux_patch_api/whitelist.yaml`
-- **Completion:** For auto-enrollment: daemon transitions to standard mTLS listening mode without requiring service restart. For `--enroll`: daemon exits with code 0.
+- **Completion:** Daemon transitions to standard mTLS listening mode without requiring service restart
 
 ## Audit Logging
 
@@ -274,8 +215,6 @@ The enrollment flow runs and **exits after completion** — it does NOT start th
   - Whitelist auto-append during enrollment (manager IP added)
   - Enrollment timeout or denial with reason
   - Signal interruption (SIGINT/SIGTERM) during polling
-  - Auto-enrollment triggered (cert status and reason)
-  - Certificate validation results on startup
 
 - **Log Storage:**
   - Primary: Distribution-appropriate logging
@@ -318,12 +257,15 @@ The enrollment flow runs and **exits after completion** — it does NOT start th
   - **mTLS:** CA cert path, server cert path, server key path
   - **Logging:** log level, log retention, remote syslog server (optional)
   - **Security:** job timeout, max concurrent jobs, rate limiting
-  - **Enrollment:** manager_url, polling_interval_seconds, max_poll_attempts, polling_token (auto-populated), cert_renewal_threshold_days
 
 - **Hard-Coded Paths (not configurable):**
   - Whitelist file: `/etc/linux_patch_api/whitelist.yaml`
   - Data directory: `/var/lib/linux_patch_api/`
   - Job storage: `/var/lib/linux_patch_api/jobs/`
+- Hard-Coded Paths (not configurable):
+  - Whitelist file: `/etc/linux_patch_api/whitelist.yaml`
+  - Data directory: `/var/lib/linux_patch_api/`
+  - Job storage: `/var/lib/linux_patch_api/jobs/`
   - Log directory: `/var/log/linux_patch_api/`
 
 ## Testing Requirements
@@ -344,25 +286,15 @@ The enrollment flow runs and **exits after completion** — it does NOT start th
 |------|-------------|
 | `--config <PATH>` or `-c` | Path to configuration file (default: `/etc/linux_patch_api/config.yaml`) |
 | `--verbose` or `-v` | Enable verbose (DEBUG-level) logging |
-| `--enroll <MANAGER_URL>` | Run self-enrollment flow with manager at URL, then EXIT (does not start server) |
-| `--renew-certs` | Validate existing certs and re-enroll if expiring within threshold or invalid |
+| `--enroll <MANAGER_URL>` | Run self-enrollment flow with manager at URL, then start mTLS server |
 | `--version` or `-V` | Print version information and exit |
 | `--help` or `-h` | Display help information and exit |
 
 ### Enrollment Mode Behavior
-
-- **`--enroll <URL>`**: Executes enrollment flow, provisions certs, then **exits with code 0**. Does NOT start server or bind port. Print guidance message on completion.
-- **Auto-enrollment (startup)**: Triggered when cert validation fails and `enrollment.manager_url` is configured. After provisioning, continues to normal server startup.
-- **`--renew-certs`**: Validates existing certs. If expiring within threshold or invalid, re-enrolls using `enrollment.manager_url` from config. Exits with code 0 after completion.
-- TLS verification is disabled on initial manager connection (manager approval workflow provides security)
-
-### Exit Codes
-
-| Code | Meaning | systemd Behavior |
-|------|---------|------------------|
-| 0 | Clean exit: no certs and no enrollment URL configured, or --enroll/--renew-certs success | No restart |
-| 1 | Error: config error, enrollment network failure, cert validation error | Restart with backoff |
-| 2 | Certs invalid, auto-enrollment in progress (will retry) | Restart with backoff |
+- When `--enroll` is specified, the daemon executes the self-enrollment flow before starting the mTLS server
+- On enrollment success: proceeds to normal server startup with provisioned certificates
+- On enrollment failure: exits immediately with error code (no server started)
+- TLS verification disabled on initial manager connection (manager approval workflow provides security)
 
 - **Phase 1 Acceptance Criteria:**
   - All endpoints functional with mTLS authentication

build-alpine.sh

@@ -22,22 +22,10 @@ fi
 # Generate abuild signing keys
 echo "Generating abuild signing keys..."
 apk add --no-cache abuild
-
-# Force HOME to /root for consistent key generation location
-export HOME=/root
-mkdir -p "$HOME/.abuild"
 abuild-keygen -a -n 2>&1 | tee /tmp/keygen.log
-
-# Find the generated key using find (ls fails on dash-prefixed filenames)
-KEYFILE=$(find "$HOME/.abuild" -name "*.rsa" ! -name "*.pub" -type f 2>/dev/null | head -1)
+KEYFILE=$(ls /root/.abuild/*.rsa 2>/dev/null | head -1)
 if [ -z "$KEYFILE" ]; then
-    # Fallback: check other common locations where keys might end up
-    KEYFILE=$(find /github/home/.abuild -name "*.rsa" ! -name "*.pub" -type f 2>/dev/null | head -1)
-fi
-if [ -z "$KEYFILE" ]; then
-    echo "ERROR: No abuild signing key found!"
-    echo "Searched: $HOME/.abuild, /github/home/.abuild"
-    exit 1
+    KEYFILE=$(ls /root/.abuild/-*.rsa 2>/dev/null | head -1)
 fi
 echo "Found key: $KEYFILE"
 echo "PACKAGER_PRIVKEY=\"$KEYFILE\"" > /etc/abuild.conf
@@ -56,51 +44,27 @@ else
     echo "Skipping cargo build (SKIP_CARGO_BUILD is set)"
 fi
 
-# Get version from Cargo.toml
-VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*=.*"\([^"]*\)".*/\1/')
-
-# Create package directory structure
-PKGDIR=$(pwd)/apk-package
-rm -rf "$PKGDIR"
+# Create package directory in /home/builduser (accessible by builduser)
+PKGDIR=/home/builduser/apk-package
 mkdir -p "$PKGDIR"/usr/bin
-mkdir -p "$PKGDIR"/etc/linux_patch_api/certs
+mkdir -p "$PKGDIR"/etc/linux_patch_api
 mkdir -p "$PKGDIR"/etc/init.d
-mkdir -p "$PKGDIR"/var/lib/linux_patch_api
-mkdir -p "$PKGDIR"/var/log/linux_patch_api
 
-# Copy binary
-chmod 755 target/x86_64-unknown-linux-musl/release/linux-patch-api
+# Copy files
 cp target/x86_64-unknown-linux-musl/release/linux-patch-api "$PKGDIR"/usr/bin/
-
-# Copy OpenRC init script
+chmod 755 "$PKGDIR"/usr/bin/linux-patch-api
 cp configs/linux-patch-api-openrc "$PKGDIR"/etc/init.d/linux-patch-api
 chmod 755 "$PKGDIR"/etc/init.d/linux-patch-api
+cp configs/whitelist.yaml.example "$PKGDIR"/etc/linux_patch_api/whitelist.yaml
 
-# Copy example configs (as .example files - install script creates live configs)
-cp configs/config.yaml.example "$PKGDIR"/etc/linux_patch_api/config.yaml.example
-cp configs/whitelist.yaml.example "$PKGDIR"/etc/linux_patch_api/whitelist.yaml.example
+# Use /home/builduser as workspace for APKBUILD
+WORKSPACE_DIR=/home/builduser
 
-# Prepare workspace for abuild
-WORKSPACE_DIR=/home/builduser/repo
-rm -rf "$WORKSPACE_DIR"
-mkdir -p "$WORKSPACE_DIR"
-
-# Copy package directory to workspace
-cp -r "$PKGDIR" "$WORKSPACE_DIR"/apk-package
-
-# Copy install scripts to workspace (must be co-located with APKBUILD)
-# Alpine abuild requires SEPARATE files with valid suffixes:
-#   pkgname.pre-install, pkgname.post-install, pkgname.pre-deinstall, pkgname.post-deinstall
-cp configs/linux-patch-api.pre-install "$WORKSPACE_DIR"/linux-patch-api.pre-install
-cp configs/linux-patch-api.post-install "$WORKSPACE_DIR"/linux-patch-api.post-install
-cp configs/linux-patch-api.pre-deinstall "$WORKSPACE_DIR"/linux-patch-api.pre-deinstall
-cp configs/linux-patch-api.post-deinstall "$WORKSPACE_DIR"/linux-patch-api.post-deinstall
-
-# Create APKBUILD in workspace directory (co-located with install scripts)
+# Create APKBUILD
 echo "Creating APKBUILD..."
-cat > "$WORKSPACE_DIR"/APKBUILD << EOF
+cat > APKBUILD << EOF
 pkgname=linux-patch-api
-pkgver=${VERSION}
+pkgver=1.0.0
 pkgrel=1
 pkgdesc="Secure remote package management API for Linux systems"
 url="https://gitea.moon-dragon.us/echo/linux_patch_api"
@@ -108,77 +72,78 @@ arch="x86_64"
 license="MIT"
 makedepends=""
 depends="openrc"
-install="linux-patch-api.pre-install linux-patch-api.post-install linux-patch-api.pre-deinstall linux-patch-api.post-deinstall"
-subpackages=""
 source=""
 
 package() {
     install -d "\$pkgdir"/usr/bin
-    install -d "\$pkgdir"/etc/linux_patch_api/certs
+    install -d "\$pkgdir"/etc/linux_patch_api
     install -d "\$pkgdir"/etc/init.d
-    install -d "\$pkgdir"/var/lib/linux_patch_api
-    install -d "\$pkgdir"/var/log/linux_patch_api
-
-    install -Dm755 "\$startdir"/apk-package/usr/bin/linux-patch-api "\$pkgdir"/usr/bin/linux-patch-api
-    install -Dm755 "\$startdir"/apk-package/etc/init.d/linux-patch-api "\$pkgdir"/etc/init.d/linux-patch-api
-    install -Dm644 "\$startdir"/apk-package/etc/linux_patch_api/config.yaml.example "\$pkgdir"/etc/linux_patch_api/config.yaml.example
-    install -Dm644 "\$startdir"/apk-package/etc/linux_patch_api/whitelist.yaml.example "\$pkgdir"/etc/linux_patch_api/whitelist.yaml.example
+    cp -r ${WORKSPACE_DIR}/apk-package/usr/bin/* "\$pkgdir"/usr/bin/
+    cp -r ${WORKSPACE_DIR}/apk-package/etc/linux_patch_api/* "\$pkgdir"/etc/linux_patch_api/
+    cp -r ${WORKSPACE_DIR}/apk-package/etc/init.d/* "\$pkgdir"/etc/init.d/
 }
 EOF
 
+# Generate checksums for APKBUILD sources
+echo "Generating checksums..."
+
 # Build APK package
 echo "Building APK package..."
 
-# Determine the directory where abuild keys were generated
-KEY_DIR=$(dirname "$KEYFILE" 2>/dev/null || echo "$HOME/.abuild")
-echo "Key directory: $KEY_DIR"
-
 # For CI environments where we may run as root or as a build user
 if [ "$(id -u)" = "0" ]; then
     echo "Running as root - creating build user for abuild..."
     adduser -D -s /bin/sh builduser 2>/dev/null || true
     addgroup builduser abuild 2>/dev/null || usermod -aG abuild builduser
     
-    # Set ownership of workspace
-    chown -R builduser:builduser "$WORKSPACE_DIR"
+    # Copy repo contents to builduser home (accessible directory)
+    cp -r . /home/builduser/repo/
+    chown -R builduser:builduser /home/builduser/repo/
+    chown -R builduser:builduser /home/builduser/apk-package/
     
     # Set up builduser home directory for abuild
-    # Copy keys from wherever abuild-keygen put them (KEY_DIR)
     mkdir -p /home/builduser/.abuild
-    cp "$KEY_DIR"/* /home/builduser/.abuild/ 2>/dev/null || true
+    cp /root/.abuild/* /home/builduser/.abuild/ 2>/dev/null || true
     chown -R builduser:builduser /home/builduser/.abuild
     
-    BUILDUSER_KEYFILE=$(ls /home/builduser/.abuild/*.rsa 2>/dev/null | head -1)
-    if [ -z "$BUILDUSER_KEYFILE" ]; then
-        BUILDUSER_KEYFILE=$(ls /home/builduser/.abuild/-*.rsa 2>/dev/null | head -1)
+    KEYFILE=$(ls /home/builduser/.abuild/*.rsa 2>/dev/null | head -1)
+    if [ -z "$KEYFILE" ]; then
+        KEYFILE=$(ls /home/builduser/.abuild/-*.rsa 2>/dev/null | head -1)
     fi
     
-    echo "Builduser key file: $BUILDUSER_KEYFILE"
-    echo "PACKAGER_PRIVKEY=\"$BUILDUSER_KEYFILE\"" > /home/builduser/.abuild/abuild.conf
+    echo "Key file: $KEYFILE"
+    echo "PACKAGER_PRIVKEY=\"$KEYFILE\"" > /home/builduser/.abuild/abuild.conf
     chown builduser:builduser /home/builduser/.abuild/abuild.conf
     
+    # Copy APKBUILD and checksums to builduser home for abuild
+    cp APKBUILD /home/builduser/
+    cp .checksums /home/builduser/ 2>/dev/null || true
+    
     # Install public key BEFORE abuild (fixes UNTRUSTED signature)
     cp /home/builduser/.abuild/*.rsa.pub /etc/apk/keys/ 2>/dev/null || true
     
-    # Run abuild as builduser in workspace directory
-    su - builduser -c "cd $WORKSPACE_DIR && abuild checksum && abuild -d"
+    # Run abuild as builduser in /home/builduser where APKBUILD exists
+    # Use || true because index update may fail but APK is still created
+    su - builduser -c "cd /home/builduser && abuild checksum && abuild -d -F" || true
     
     # Copy APK from builduser packages to releases
-    # Note: abuild outputs to /home/builduser/packages/builduser/x86_64/ not /home/builduser/packages/home/x86_64/
     mkdir -p releases
-    cp /home/builduser/packages/builduser/x86_64/*.apk releases/ 2>/dev/null || find /home/builduser/packages -name "*.apk" -exec cp {} releases/ \; 2>/dev/null || true
+    cp /home/builduser/packages/x86_64/*.apk releases/ 2>/dev/null || cp /home/builduser/packages/*.apk releases/ 2>/dev/null || find /home/builduser/packages -name "*.apk" -exec cp {} releases/ \; 2>/dev/null || true
 else
-    cd "$WORKSPACE_DIR"
     abuild checksum
-    abuild -r
-    cd -
-    mkdir -p releases
+    abuild -F -r
     cp ~/packages/x86_64/*.apk releases/ 2>/dev/null || cp ~/packages/*.apk releases/ 2>/dev/null || true
 fi
 
+# Copy to releases directory (fallback for non-root builds)
+echo ""
+echo "Copying package to releases/..."
+mkdir -p releases
+cp ~/packages/x86_64/*.apk releases/ 2>/dev/null || cp ~/packages/*.apk releases/ 2>/dev/null || find ~/packages -name "*.apk" -exec cp {} releases/ \; 2>/dev/null || true
+
 echo ""
 echo "=== Build Complete ==="
 echo "Package: releases/linux-patch-api-*.apk"
 echo ""
 echo "Install with:"
-echo "  sudo apk add ./releases/linux-patch-api-*.apk"
+echo "  sudo apk add --allow-unstable ./releases/linux-patch-api-*.apk"

build-arch.sh

@@ -14,11 +14,6 @@ if ! command -v makepkg &> /dev/null; then
     exit 1
 fi
 
-# Clean stale packages from previous builds
-rm -f releases/linux-patch-api-*.pkg.tar.zst 2>/dev/null || true
-rm -f /home/builduser/repo/releases/linux-patch-api-*.pkg.tar.zst 2>/dev/null || true
-rm -f /home/builduser/repo/*.pkg.tar.zst 2>/dev/null || true
-
 # Build release binary
 if [ -z "$SKIP_CARGO_BUILD" ]; then
     echo "Building release binary..."
@@ -27,68 +22,43 @@ else
     echo "Skipping cargo build (SKIP_CARGO_BUILD is set)"
 fi
 
-# Create package directory structure
+# Create package directory
 PKGDIR=$(pwd)/arch-package
-rm -rf "$PKGDIR"
 mkdir -p "$PKGDIR"/usr/bin
-mkdir -p "$PKGDIR"/etc/linux_patch_api/certs
+mkdir -p "$PKGDIR"/etc/linux_patch_api
 mkdir -p "$PKGDIR"/usr/lib/systemd/system
-mkdir -p "$PKGDIR"/var/lib/linux_patch_api
-mkdir -p "$PKGDIR"/var/log/linux_patch_api
 
-# Copy binary
-chmod 755 target/release/linux-patch-api
+# Copy files
 cp target/release/linux-patch-api "$PKGDIR"/usr/bin/
-
-# Copy systemd service
+chmod 755 "$PKGDIR"/usr/bin/linux-patch-api
 cp configs/linux-patch-api.service "$PKGDIR"/usr/lib/systemd/system/
-
-# Copy example configs (as .example files - install script creates live configs)
-cp configs/config.yaml.example "$PKGDIR"/etc/linux_patch_api/config.yaml.example
-cp configs/whitelist.yaml.example "$PKGDIR"/etc/linux_patch_api/whitelist.yaml.example
-
-# Copy install script to current directory (must be co-located with PKGBUILD)
-cp configs/linux-patch-api.install linux-patch-api.install
-
-# Get version from Cargo.toml
-VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*=.*"\([^"]*\)".*/\1/')
+cp configs/config.yaml.example "$PKGDIR"/etc/linux_patch_api/config.yaml
+cp configs/whitelist.yaml.example "$PKGDIR"/etc/linux_patch_api/whitelist.yaml
 
 # Create PKGBUILD with quoted heredoc to prevent $pkgdir expansion
 # $pkgdir must be literal for makepkg to expand at runtime
 echo "Creating PKGBUILD..."
 cat > PKGBUILD << 'EOF'
 pkgname=linux-patch-api
-pkgver=VERSION_PLACEHOLDER
+pkgver=1.0.0
 pkgrel=1
 pkgdesc="Secure remote package management API for Linux systems"
 url="https://gitea.moon-dragon.us/echo/linux_patch_api"
 arch=('x86_64')
 license=('MIT')
 depends=('systemd')
-install=linux-patch-api.install
-source=()
-backup=(
-    'etc/linux_patch_api/config.yaml'
-    'etc/linux_patch_api/whitelist.yaml'
-)
 
 package() {
-    # Use $startdir because arch-package is co-located with PKGBUILD, not in sources
-    cp -r "$startdir"/arch-package/* "$pkgdir"/
-
-    # Ensure directories exist with proper structure
-    mkdir -p "$pkgdir"/etc/linux_patch_api/certs
-    mkdir -p "$pkgdir"/var/lib/linux_patch_api
-    mkdir -p "$pkgdir"/var/log/linux_patch_api
+    cp -r /home/builduser/repo/arch-package/* "$pkgdir"/
 }
 EOF
 
-# Replace version placeholder with actual version
-sed -i "s/VERSION_PLACEHOLDER/$VERSION/" PKGBUILD
-
-echo "PKGBUILD version: $VERSION"
+# Create .SRCINFO
+echo "Creating .SRCINFO..."
 
 # Build package
+echo "Building Arch package..."
+
 # For CI environments where we may run as root
 if [ "$(id -u)" = "0" ]; then
     echo "Running as root - creating build user for makepkg..."
@@ -99,22 +69,12 @@ if [ "$(id -u)" = "0" ]; then
     cp -r . /home/builduser/repo/
     chown -R builduser:builduser /home/builduser/repo/
     
-    # Create source tarball for makepkg
-    # makepkg expects sources to be in $srcdir after extraction
-    # We create a tarball of arch-package so %autosetup or prepare can extract it
-    cd /home/builduser/repo
-    
     su - builduser -c "cd /home/builduser/repo && makepkg --printsrcinfo > .SRCINFO"
     su - builduser -c "cd /home/builduser/repo && makepkg -f --noconfirm"
     
     # Copy package to releases
-    mkdir -p /home/builduser/repo/releases
-    cp /home/builduser/repo/*.pkg.tar.zst /home/builduser/repo/releases/ 2>/dev/null || true
-    cd -
-    
-    # Copy releases back to original directory
     mkdir -p releases
-    cp /home/builduser/repo/releases/*.pkg.tar.zst releases/ 2>/dev/null || true
+    cp /home/builduser/repo/*.pkg.tar.zst releases/
 else
     makepkg --printsrcinfo > .SRCINFO
     makepkg -f --noconfirm

build-rpm.sh

@@ -2,128 +2,51 @@
 # Build RPM Package for RHEL/CentOS/Fedora
 # Run on: RHEL 8/9, CentOS 8/9, Fedora 38+
 # Designed for native Gitea Actions runner execution
-#
-# Build pattern: Pre-build binary BEFORE creating tarball (like Alpine/Arch)
-# The binary is included in the source tarball so rpmbuild's %build
-# section is a no-op. This avoids PATH issues where rpmbuild can't find
-# cargo installed via rustup.
 
 set -e
 
 echo "=== Linux Patch API - RPM Build Script ==="
 echo ""
 
-# Source cargo environment (for rustup-installed toolchain in CI)
-if [ -f "$HOME/.cargo/env" ]; then
-    . "$HOME/.cargo/env"
-fi
-
 # Check if running on RPM-based system
 if ! command -v rpmbuild &> /dev/null; then
     echo "Installing RPM build tools..."
     if command -v dnf &> /dev/null; then
-        dnf install -y rpm-build
+        dnf install -y rpm-build cargo rust gcc systemd-devel
     elif command -v yum &> /dev/null; then
-        yum install -y rpm-build
+        yum install -y rpm-build cargo rust gcc systemd-devel
     else
         echo "Error: Cannot install rpm-build. Please install manually."
         exit 1
     fi
 fi
 
-# Get version from Cargo.toml
-VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*=.*"\([^"]*\)".*/\1/')
-if [ -z "$VERSION" ]; then
-    echo "Error: Could not determine version from Cargo.toml"
-    exit 1
-fi
-echo "Building version: $VERSION"
-
-# Remove stale RPM artifacts to prevent uploading cached/old packages
-echo "Cleaning stale RPM artifacts..."
-rm -f ~/rpmbuild/RPMS/x86_64/linux-patch-api-*.rpm
-rm -f releases/linux-patch-api-*.rpm
-
-# Build release binary (skip if already built by CI)
-if [ -z "$SKIP_CARGO_BUILD" ]; then
-    echo "Building release binary..."
-    cargo build --release
-else
-    echo "Skipping cargo build (SKIP_CARGO_BUILD is set)"
-fi
-
-# Verify binary exists
-if [ ! -f "target/release/linux-patch-api" ]; then
-    echo "Error: Pre-built binary not found at target/release/linux-patch-api"
-    echo "Run 'cargo build --release' first or unset SKIP_CARGO_BUILD"
-    exit 1
-fi
-
 # Setup RPM build directory structure
 mkdir -p ~/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}
 
-# Create source tarball with pre-built binary included
-# (required by %autosetup in spec file)
-echo "Creating source tarball with pre-built binary..."
+# Create source tarball (required by %autosetup in spec file)
+echo "Creating source tarball..."
+VERSION="1.0.0"
 TMPDIR=$(mktemp -d)
 mkdir -p "$TMPDIR/linux-patch-api-${VERSION}"
-
-# Copy files excluding unnecessary directories
+# Copy files excluding unwanted directories using find
 cp -r . "$TMPDIR/linux-patch-api-${VERSION}/"
-
-# Remove unnecessary directories from tarball
 rm -rf "$TMPDIR/linux-patch-api-${VERSION}/target"
 rm -rf "$TMPDIR/linux-patch-api-${VERSION}/.git"
 rm -rf "$TMPDIR/linux-patch-api-${VERSION}/releases"
 rm -rf "$TMPDIR/linux-patch-api-${VERSION}/.github"
 rm -rf "$TMPDIR/linux-patch-api-${VERSION}/debian"
-rm -rf "$TMPDIR/linux-patch-api-${VERSION}/arch-package"
-rm -rf "$TMPDIR/linux-patch-api-${VERSION}/.abuild"
-rm -rf "$TMPDIR/linux-patch-api-${VERSION}/apk-package"
-rm -rf "$TMPDIR/linux-patch-api-${VERSION}/.a0proj"
-
-# Re-create target/release with just the pre-built binary
-# This is the key change: binary is in the tarball so %build is a no-op
-mkdir -p "$TMPDIR/linux-patch-api-${VERSION}/target/release"
-cp target/release/linux-patch-api "$TMPDIR/linux-patch-api-${VERSION}/target/release/"
-chmod 755 "$TMPDIR/linux-patch-api-${VERSION}/target/release/linux-patch-api"
-
 tar -czf ~/rpmbuild/SOURCES/linux-patch-api-${VERSION}.tar.gz -C "$TMPDIR" "linux-patch-api-${VERSION}"
 rm -rf "$TMPDIR"
 
-# Prepare spec file with dynamic version
+# Copy spec file
 echo "Preparing spec file..."
-sed "s/VERSION_PLACEHOLDER/$VERSION/" linux-patch-api.spec > ~/rpmbuild/SPECS/linux-patch-api.spec
-
-# Verify VERSION replacement succeeded
-if grep -q 'VERSION_PLACEHOLDER' ~/rpmbuild/SPECS/linux-patch-api.spec; then
-    echo "Error: VERSION_PLACEHOLDER not replaced in spec file!"
-    exit 1
-fi
-echo "Spec file version verified: $VERSION"
+cp linux-patch-api.spec ~/rpmbuild/SPECS/
 
 # Build RPM
 echo "Building RPM package..."
 rpmbuild -ba ~/rpmbuild/SPECS/linux-patch-api.spec
 
-# Verify RPM was actually built
-RPM_FILE=$(ls ~/rpmbuild/RPMS/x86_64/linux-patch-api-${VERSION}-*.rpm 2>/dev/null | head -1)
-if [ -z "$RPM_FILE" ]; then
-    echo "Error: RPM package not found after build!"
-    echo "Looking for: ~/rpmbuild/RPMS/x86_64/linux-patch-api-${VERSION}-*.rpm"
-    ls -la ~/rpmbuild/RPMS/x86_64/ 2>/dev/null || echo "Directory empty or missing"
-    exit 1
-fi
-
-# Verify RPM contains the correct version
-RPM_VERSION=$(rpm -qp --queryformat '%{VERSION}' "$RPM_FILE" 2>/dev/null || true)
-echo "RPM built: $RPM_FILE"
-echo "RPM version: $RPM_VERSION"
-if [ "$RPM_VERSION" != "$VERSION" ]; then
-    echo "Error: RPM version ($RPM_VERSION) does not match expected version ($VERSION)!"
-    exit 1
-fi
-
 # Copy to releases directory
 echo ""
 echo "Copying package to releases/..."

configs/certs/README.md

@@ -1,33 +0,0 @@
-# Development Certificates
-
-**⚠️ Private keys are NOT committed to version control.**
-
-This directory is used for local development certificates only. Private key
-files (`*.key`, `*.key.pem`) are excluded from git via `.gitignore`.
-
-## Generating Development Certificates
-
-Run the generation script from the repository root:
-
-```bash
-./scripts/generate-dev-certs.sh
-```
-
-This creates:
-- `ca.pem` / `ca.key.pem` — Internal CA certificate and key
-- `server.pem` / `server.key.pem` — Server certificate and key
-- `client001.pem` / `client001.key.pem` — Client certificate and key
-- `tests/e2e/certs/` — E2E test certificates
-
-## Production Deployments
-
-Production deployments should use certificates issued by the organisation's
-internal CA. The `install.sh` script and systemd unit handle production
-certificate paths at `/etc/linux_patch_api/certs/`.
-
-## Security
-
-- **Never commit private keys** (`*.key`, `*.key.pem`) to version control
-- Private keys must have `0600` permissions in production
-- The `gitleaks` CI check scans for accidentally committed secrets
-- See `SECURITY_FINDINGS_REPORT.md` and `SECURITY.md` for full details

configs/certs/ca.key.pem

@@ -0,0 +1,54 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIJtTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQOJY6BZQMTvXCEBl6
+Rv+0fQICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEJwoQf7hSIurtiBM
+nm+YEhwEgglQiyNTxNNkeZ8hikGe3m+2cfXtAituVJYgs4V+bgTJXnrJVaFyPoRw
+Nde/m9vJU4EGaRwS7Sb89XsjFK+Qbc6+2mvBqhkoBIjXBjYsiqNlLStLUIf1IPdU
+HHHxrOSnkNIXaiEojEIb4SLHYsmwSGbHPCmr+sIvzRDo/tuc0ugTDJFoS4lhDy6r
+VsPuDsV3XTnyPTWlHgROr1DmwqhTa87PXkpiomFxw1/Jy+2D0tQ+PuhTlGh87q2r
+T+ZHOLf8GLMKxKL7Elup/ugT+qfK0FekKJV+1Pw8EL+vWmJMLvhk+tlO9b4WxOlD
+UiW98mf6ospzpbmVf/AkaI5mkeAaikp7XMim57bUDBbNT3YQWBgwjVR01n7nCKk/
+2hYcaDEJGv6KuU3utlVhSIF1OuIJR42q7AJuOmM22yAHJ7KOkcoXFcNsJuVqAeDc
+BcVMMEgrHuLdnlHTzUy+0ETFAiTTQE/8+RYHPi0t0LOgalJBVZN4kR8OvCXiTrfw
+J6Ex7BvRM7MisS9lNfzCoMaN84/tEdwVTc0USEYvY4mQGV5xINN9ehNgfnw5leMW
+n0+oFtNXeslV84xVVz/X0pSD5G4NiyOAVBD44jHowRHJqPMaWs38xFVNStjCyThX
+L6lq8ZcFMOLzswvPjBKpb+XlSwETDMGEXbhiOop/CYT2YLwjWH7Vu7rZ1kL553pp
+DUOmGRgSfeabKZeyePxh3Pz5uqmKtuX3WGmyeCX/bneDXVASJwCAe+HGFC0cy5JL
+8c82b28AdijALlqcEi4S4xsSyL3eMGWlwedfMKN1JdkxrqqWDworfuK+vMUvBa55
+GZKlZaYG7rs6nim3XgabnIS+bx08QteMHM9KnEGHggkUd4crSWU9vno+Fkkus1kG
+RqO9hSya/s3CqXGyvK4VTB+ThkAHtMdcFg2fbUtgFW4JluysgosFNCBoI1DYlHqF
+4O9H6zf90sjX02m4fxt/zl4sRffMbbpxk1gPlahxR/smPSu6LSpmgKMpHwQZKpHc
+r4ZYSC2ITVC+wb3+LxGDcZvoWFP6CKpcqJ3u2OwGHrSroA9gz6BMOLhhJIqClaDe
+qYLpCZ2GKUl6GZApEd9mQtrGZyG9qfn4i0+jysUCYq4WRVMJhIitXdmLYUjM+6mP
+ZUl8P0KIdMjxLf/be2RofokCF8/PmmjfMdxXSwQ4v3wqx8/GvmuY/gM0nPnC4jMQ
+CgiJNpnOMLSMEM2c3w32206zjSMPYfR7JsB4d+bp3UMsqGfvv6xOShky+XNU/2ft
+AAeMmvvm39RNePoq9owFDFiID2QEmI61ZSOK2ndXbueX0pslYKXdjgtnygL2w19t
+BxshEfXGxqu7ImztyO/TLhY5Szu9E+zwaJzGhSR4vPq3emO3M3dGRa/6RbbXB5BC
+N9efMeIlEi/mVtdnu0jdgbrR7TbFCOrjhdrDgmEo4DKX4BEQZdeHpO/czF6gz4i8
+bGtMGjYKL3xpYfk0yhycx5Q2iZQFbt3W90YPHz9SLrv4U3rJy7OQQmJ4upsaz0a8
+lFIKzsGTczojwuYBVG7YNGqyxQtDLxQsjhK1j11pGBNKqGeFxOpvzw694XgLv/a8
+785B7c66OJD1H04wndFeR/ruRZpMda8Cw6gwNkzFiWZ1SwwIeqg364wmvhB/VhVC
+H6Pr9k4jgFYimM7DgGdrf1+RKOo7bDpyVPAOXNzmPINikxvZLT+ps++usXH4xOdi
+YiCq2DR7zjF301ojyAuP4K10c8p3FAu8SerJ+lS9HRLJQ0z4cXnkbtAvIMs3C88Z
+9bNWCs8bRH54HJiBgHVKkx00A0rAftMKzn3mKBcKnXvbfL/Qb+sKun0Z6hzWkld5
+yEsDnI4B6gxUk+R78kmc2xIzorHHYjdmq07rITKk23QPHgDrrr26NppNMRGVds/9
+DpV5yethMOGVNu8njiqU98uK4rQv1r7YSOvNVGkpvDKHjSDqe+N4bal5tQEnLEXw
+GzdNB/ECJm0ij/98W8I+AzyGOVmoa0XqJKNfQQGXDigSM3HeYZhPu2JotleddkCT
+/l0qpMDlxeTsf6Uhe/47I5iirJCUO6G7RSV9bOh2Pmnbp7PQPkFW79WOf8MPCnCL
+XyR4GkyCQ4FjTMLIiDkeV9ReBykuNWohLN6NTwSrJZ5s/032oF+I0WZ5vbePL2zP
+z/0X6fKTpVeyT1FMIFE+XH0v06awsq0gG1FlrMMQEO3xLPfF/NNqdJN49lD+AnPh
+m/0b/pJ4+NwlEWLsQUdkGAyYD/ZgMHDZQryFxCwrBAFLRtj4NzaaDT5QOgxZUIbQ
+VIpPZtAahy1463Pb3Oc7zIiuf7v1RvWipN05QtgepREXNJkOOVXjP0Nyrq98fS2T
+oZNZMqr47YeyErztUudKMZ1MCT1jb20y4+y2OSG5lDbKS2gQWo0EIRveFT82QSQa
+12gmQMVhAdoRUYBqdQoo98nLix4JftgKYc691pf9gQJIJ8P48uOQEIW6nNc8eXF6
+L7QyYidqrqnSzpwRwTv9+LmiXm52lg4Ft3aq7GKq237Mz8Thx3YXamaFBdMYSu3p
+5/nNorChQSnnCEmAMdNYej94OUwun5HSTGwh1/JloHCZUMsOqJ20xn3YRQS3E0Vo
+uF6aqbZbKbZbJrY+NBrQae0onUNQLbFUX56rMXT9fJJmt/KeFKtI6kKWBs41vp0N
+TqOORrtkwyu/AU3qWg4iUINRqFjI76MzzH1XZ9A/2qokAZduHgDoFGcOKkpRFT/9
+F6P1SXfoeE8DtUpBhu5XlJyIwcWANkstATrXxyZLA7IdLLgSPZXSwAWxLwCN0ypM
+Jnscfvkr2SW8OwpJ8/mA/SX88ZC28Uvp1egsgnM1k9Z7Oinxgk9a7LNUv0qxBc7k
+SuooMBJvuiqHOzTr3IJvpCkZykvbnYbDgtypxVOeWO257yxer/ora9NVX84pfprU
+7JbOpBGMY6FUAcONmBYikGyGeNsF9zsPcdSOdUKP7tlrncYughORsb/FkNq7LSbo
+ll+tRCu/7Xb+VEctDQhk1fJ+ojFzC0P9duRWcskIVWFbSj6r21hzdhKOMX6bXLhA
+NcNpSk3EHqDij4rMbaAqSs5W2Q4JTUJ6L0/OOy9aeckbXw/j31OdYnR5wM7nvXrH
+tv89sXX/ObNJFD5uPRMPvoACv2oTsgWtm4sNkapAeiOcovPCWSroyzc=
+-----END ENCRYPTED PRIVATE KEY-----

configs/certs/ca.pem

@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFVzCCAz+gAwIBAgIUO/u3nWWJUG+i/cwM8o/1fkLzfbAwDQYJKoZIhvcNAQEL
+BQAwOzEZMBcGA1UEAwwQTGludXhQYXRjaEFQSSBDQTERMA8GA1UECgwISW50ZXJu
+YWwxCzAJBgNVBAYTAlVTMB4XDTI2MDQwOTIwMTM1MloXDTM2MDQwNjIwMTM1Mlow
+OzEZMBcGA1UEAwwQTGludXhQYXRjaEFQSSBDQTERMA8GA1UECgwISW50ZXJuYWwx
+CzAJBgNVBAYTAlVTMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAt+Li
+R5RFcfgnm7fHHPg+csakg/C7+Pkb99mCTb+sBGodxNdlryFz3k/c6hFwUJWwfbPL
+hsZo8JSxPIrXMhu8n6pDygUSqOx43dkqXURI40FfOaEkSHwYIF73eOV+qUBPTqQZ
+udMc0BGYndpaLk+Lb6rKtEA4r0HkP2fLdO8wOqr68kYiMhhVP3Dw0k1JmtUY3k/k
+RcBPQ7C/n+Pr4a0xdIr2TwzNyH+JOp/3oCZW5mZdfaZWXMZhObtT3a8hW0qfc/P5
+3PM1C5jxTBRJiQTQlHsM6EpDS1vZLLU0R5PNRw2U7HgOPhY6iItZDN9NUNo5uGpT
+5jBR3CumpkCxoGnLuV8+VBngjaovpzp245ERYYU7rox5CrHj1yybw6HuaXXqQncO
+zDYJwEUINcGiSTlnWyy9iFqA3PInOtAE4YCyscKHH60CxY+/6WvE8yVgTE2SM/At
+l2UmZhSDIZBMx2GUmRob9FmQCsyb9AnIytkXXBbJtX6wVi0S7TGKixYObnudb6k+
+DEP/HA7BLRChR/XyDjeHNnsE/cqQeNcGOqP6UHS3rf4L3lIDCLvvKhid73C6/N8r
+Mz4FvwbwMdw4MHn/WNQBe5+1xkgLLoNRHPXUFwpKcA2ev4JEchb9w9IWiuftJ9BM
+zzGKlwT9rCw7A0rQMzsaaEMdCF1VPecoTyIxb2kCAwEAAaNTMFEwHQYDVR0OBBYE
+FGfp3Y5/keT0TeQin1GfU3LalfuWMB8GA1UdIwQYMBaAFGfp3Y5/keT0TeQin1Gf
+U3LalfuWMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBAG7Tkj2S
+SisI7ggjFXmferutk25v62dLeXJ9eBjnXHQkk6oMJo4TFWgLbo66gb+0mq9c7/rC
+XsQY3mEnQ3lcujMXoEYGcOM7TOHENj0UX0GiQLexCSZF14IOsf0KGXvB649AhscC
+N83mdk6GSP2gB8I3wGngbgCtZf/9sq4z6pXVNva+xNskWA7YidY/3pGIMkvRb21v
+iTXsTGUC4U2/wjohYVLcyu36Dk2YbdAl0gY7JsNGXbT0a/zpo2aY4ogDMXe/828Q
+gW2ZJWGXeJJKHOgBQw+zmBO+Zgm2vdWWBYCsJVLeVE2SE+LngJGfwgJT7tNb20e6
+7UBJzhJHIcu73ODNF1TPCNIREVELC4iBXIMvoi3h8Yp7Wo6S8CGk9DY68fXSAkfb
+oagvxe/rKRgljX70pRl6YOhpMVpl4yUc4BuRlfopRAIDS3AQdNyp9hvMUyj64Gan
+UIkVXLoDA+7KGw/RPCtC18HWw19nmooh73cWSmGrOjtKu2L5ZsSuD3G6vnmFZaSv
+HqK08pX+zv2NpYVhiE39zRQ37u9xVjNQsJ/1gnLQ3zOXyidpB8eH+1r5pR7dVjMf
+wnhnLlm8nty7O0sOy2kiYp1YqosCitOgnLR1U/cgzGX6j0mHUuciY/fRyK1Yifa5
+UM+xJs/yTc33DYhd4oYQHxqRkletlx2XDW9d
+-----END CERTIFICATE-----

configs/certs/ca.srl

@@ -0,0 +1 @@
+790CDB9FA2002BF59B3EE88AF326CB060353D111

configs/certs/client001.csr.pem

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICeTCCAWECAQAwNDESMBAGA1UEAwwJY2xpZW50MDAxMREwDwYDVQQKDAhJbnRl
+cm5hbDELMAkGA1UEBhMCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQC9Tida4so5qerRjEQXQQJb/W4jCsRwZg6lSvvd9qEtqWuwxX+SFfNbcpDOOZTh
++CWmmCq9v5ZO+XyO/s9xKLnyudnkT/nymB6KFN3XywfDE2iiGshNVNd5d0B4nF7e
+nXeoF938GF5/ny4dkGgg+HoXXrQJ1WGjODXJsXtiiMZPI08kZL4vuYW64VojHvUf
+AQdEjGqlIZzNW909g0uaQEizpZwJvH7YGvWuQDx9ywbWrs1t3hHu2ahA+myVXL3Y
+C7+jAmROQ61FHW2F4swS+uRQDTEr9qQs256JCryzHCTma8IWmYqphM9wn18f5Tm7
+EXw4EHCz5FVL7HPL1vZnQdsrAgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAH46n
+SxI9O21jO1q2cmFlZano5JWAo3eb424+3jCYgAJDBUtlzTLfdkADvttaTtAjI8sh
+GqbUFsCtO4UlPD5SWFnPdUQqJ+zv1lXDyef0D694mUjgrjtdB27l9wmTnHZVwgcL
+GEr8nfuhqNNjARmWUJUv629slt0RDZxGm0IXGJBrx39t31oh0q1ll4rPvd9TEiLZ
+sP8r5WdC2PdFLh13J6erLkoMOOLmM/mXj1egz+ivgqo2uXDX1crBlNH0H1KM05ot
+c5wJo3mzbRC/3PWLLJHKwQ6ObI88AviGEMevIw54jdz2UHXPv0aK2SSoIDr6GhUi
+0OBKrqsjBII7l+w+Rw==
+-----END CERTIFICATE REQUEST-----

configs/certs/client001.key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC9Tida4so5qerR
+jEQXQQJb/W4jCsRwZg6lSvvd9qEtqWuwxX+SFfNbcpDOOZTh+CWmmCq9v5ZO+XyO
+/s9xKLnyudnkT/nymB6KFN3XywfDE2iiGshNVNd5d0B4nF7enXeoF938GF5/ny4d
+kGgg+HoXXrQJ1WGjODXJsXtiiMZPI08kZL4vuYW64VojHvUfAQdEjGqlIZzNW909
+g0uaQEizpZwJvH7YGvWuQDx9ywbWrs1t3hHu2ahA+myVXL3YC7+jAmROQ61FHW2F
+4swS+uRQDTEr9qQs256JCryzHCTma8IWmYqphM9wn18f5Tm7EXw4EHCz5FVL7HPL
+1vZnQdsrAgMBAAECggEAAL6K9Cq4oA4Pv/kbRskIdNNct38SLiOZnn8UVWfbvj9A
+BpC+KZllhwoAyxsrf3ZnV8B45WNBxwERy2bpdwzznrsl4uGZfXg9+Au6HmiB89JF
+x27vp1LUZYphluZDZiGT+x7kIO9swT3Eh78pvDqMU/S+VeTaThHa5VFHx23aPeKR
+utc/dW1+1rT2rGZXTEF86xQkHQaKSYa4MPpxAhZ/Azc28sYtcGeJ6NEjqQyDEYHn
+hlFLBs9RpvyYkmMx+s0xkdtEE9+v2cTnw04MseE/MMBzSS4Y3EBFmVSJvvpKmyox
+DibwJtxhMa8atT5LOroBpPwYbmelAKbF85yxHtRE4QKBgQDjk/rkTOud3mUTiKt4
++26YgtpcEjTJ7Rgiq8F0McveRUnGRGwI2ML+nQZ0mBsroCdQjqBbyIGVYY9EZJfB
+pRYLGHEUHcS94mkwpXyGZXzNwjKPo6bmOh3dLOO4J1fgIyBx1UIKS8HLaNR+gg5Q
+N6iAvkiDj5Ucqy5+iCNjJhQbRwKBgQDU8ojlhW4Cc9ITQP2Xjlg4eymxoRT9XrAC
+6ebWoDK2q9uLPPPzXkKQzRM7ydOBZR9EgNknwQyfQpXFVrB+gn27o2A3iKtvacXQ
+/He04/fVPdWYF8t4su4rMYVCbl+aOwCdeFfGwFOP45oo0/eEH/ys/64I6UQEKNk9
+oXnNSezq/QKBgBv3tZ+U7GfMSvOpmhkWHTNU8WzbN+2Q26R3IyEadYltTnG1Oumj
+aeNMfNybTMuBtRMrU/2zmGk5QhgPnK7JkPnwGQV12xXS20aFL9Z8ZmgK85e/buVg
+QwdJWvroqt36syQKJ0GIqdpLmcGqTgQBsw2PVO4GGTcaum4GYQLwTQxFAoGAZpED
+GvnviMLcdmWhP3RSTbIU3PenMnp+8IhUpR+4DYAtWJ1dKuVFzpTYJL4LX5GjQ82D
+ysATIkph9RDSJb0Ybl48o8LyP9GEdCqGRdxfrJgB3yXm3RXh3XAWrW6YIaM1oqMq
+NBLCrNWFlRCzcTIu8+yamLQyDIbYS/UQw65NrMkCgYEAjM5Z6XJ3FuRjnEZaV6V4
+evz0TyHTpHnNAKx1NRzut4wN684X81l1IgUAVp2xkbiYK/V/F2qXWAQjuA3ucyN3
+svnXIsQqhnBilkcDbQg5TZtaIk58IDzENXF8TAtPQiAD478AyBcfzMrtqLhKgaBu
+P7wqdvyaMVPLek9tuUINQ4o=
+-----END PRIVATE KEY-----

configs/certs/client001.pem

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEPzCCAiegAwIBAgIUeQzbn6IAK/WbPuiK8ybLBgNT0REwDQYJKoZIhvcNAQEL
+BQAwOzEZMBcGA1UEAwwQTGludXhQYXRjaEFQSSBDQTERMA8GA1UECgwISW50ZXJu
+YWwxCzAJBgNVBAYTAlVTMB4XDTI2MDQwOTIwMTQwM1oXDTI3MDQwOTIwMTQwM1ow
+NDESMBAGA1UEAwwJY2xpZW50MDAxMREwDwYDVQQKDAhJbnRlcm5hbDELMAkGA1UE
+BhMCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC9Tida4so5qerR
+jEQXQQJb/W4jCsRwZg6lSvvd9qEtqWuwxX+SFfNbcpDOOZTh+CWmmCq9v5ZO+XyO
+/s9xKLnyudnkT/nymB6KFN3XywfDE2iiGshNVNd5d0B4nF7enXeoF938GF5/ny4d
+kGgg+HoXXrQJ1WGjODXJsXtiiMZPI08kZL4vuYW64VojHvUfAQdEjGqlIZzNW909
+g0uaQEizpZwJvH7YGvWuQDx9ywbWrs1t3hHu2ahA+myVXL3YC7+jAmROQ61FHW2F
+4swS+uRQDTEr9qQs256JCryzHCTma8IWmYqphM9wn18f5Tm7EXw4EHCz5FVL7HPL
+1vZnQdsrAgMBAAGjQjBAMB0GA1UdDgQWBBStUuU9Si2VnMMQ4VkYyf2pttMhezAf
+BgNVHSMEGDAWgBRn6d2Of5Hk9E3kIp9Rn1Ny2pX7ljANBgkqhkiG9w0BAQsFAAOC
+AgEAqWQEAwpW45LWprkr4zpz66azUVkc2I/kuNWLiDEw9Ex4i/5e+ND6Ia7Ayk+T
+j3rodJA1rn64gJZOzABTb3mpWwNH/DxjF/XGohixl/kn81sNCydimc3qOKL5joUb
+PDtK9QLTCJmGsYk5lV9K89pR7kBR2rXD70d1GM6KjyBeknEH4oA9/BqMYL5DkeHu
+v2QWYoECno43eI+Ve4oow5MN/83+VhFLeayCd/JWBYjYi55tqI8QDBn7AY4UAO2C
+77msurPEqaZn5OtzEW9El/M3/+bDeYfpERgYn2X7bw0oOUZw8g5L9dfc1UxjGY8J
+NPJAXUKtsDBKzN8nlvrCVmHVrR19vquH7qfh/aKu58MGu3Ovzjz57T/gooi2wmnY
+4+NJDXZ7ncc7T+40svi7tbLA7MgExuGM+pq/Bxn/PHLPbhyyp7p8EPUFf5KIiqr5
+GiWL1re8gfe8CAxKDKs5ERtexgoldY1TsMbQ6wjP59rRN3ZbUBGtPsi8bKTEZBpo
+cM+9bg44ndODpoB8B9NKYCU/n3Uvs+mZMYtAAkLiCUrYplIiCSvUrcDOQWVn1CD1
+WbuvTTtlIi55NMUi1pvgaFi0PW6Gfin1wRHjt3iLU/i+3Q/b0V+pEL7wgf5bd3U5
+F6xxNMRjNh1kbZVR0WywzPignBiK9cW+z3d9rPW2FgVoXcI=
+-----END CERTIFICATE-----

configs/certs/server.csr.pem

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICfzCCAWcCAQAwOjEYMBYGA1UEAwwPbGludXgtcGF0Y2gtYXBpMREwDwYDVQQK
+DAhJbnRlcm5hbDELMAkGA1UEBhMCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQCu+RZd6OHxdGJdI+C9rS8rowzsYF/qr3p6+Yvp9ySvBzJ20TVWQSrK
+Fo1VcDgg7rkTYuRxzxehO0R7pTkxnWqLY6VAA39w5nyVzTwFPv7UovdAZx/U7hnJ
+Zj7ndtxuqYk1tkx94NLjYXUCWqy48/tKQXobQh3qXeQ6HfwFSI5xpy61quQBZkJz
+VAatcOv/fhn3K+TrgBaKKkXFNQ3jjKhzrH3Z0son1+GNyhHvQlvCJ+jdWDpzDvSP
+XpqEDmxCQvdBdzGVAPrv3fmBMyOQFnHOTHmKtJ806jBFsYEUwnXKA4/xtaihl1OL
+bz85Z6MicH1PwTo4v0Z7ngIcyoxlgX/RAgMBAAGgADANBgkqhkiG9w0BAQsFAAOC
+AQEAPaBJ7ryKBUuKoUGsgb+fc9GIbGomCbWZnPFx3ZJcUZfeb4/Qi1glhe1GiiUt
+np5x0cjgw5he6zd13lgylglsYrSHEJDV2MqVoHqCwFH+m+ODnZvnQkrgxW4t+JEK
+wEwp0dRGLXsshDPWg5Xe/SaFBfvuCWEkWkcQ4NYwg5SOVn0TCAVy2VKmdDW1KHtf
+GkqHdUiIs5FX6kXIMryQpIG6OXyJCQ3pGv+kSlfaeobnqUUASWwBAaubZBxnqTIl
+Daj2End8iYQ9Fiv7z0YFxJrULSt5qhtRivmUHjSOyv0tlPs+aG9mP9j14ND2/ZIA
+ihOZrIUTTxaaVL9IxIVnTt7tFw==
+-----END CERTIFICATE REQUEST-----

configs/certs/server.key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCu+RZd6OHxdGJd
+I+C9rS8rowzsYF/qr3p6+Yvp9ySvBzJ20TVWQSrKFo1VcDgg7rkTYuRxzxehO0R7
+pTkxnWqLY6VAA39w5nyVzTwFPv7UovdAZx/U7hnJZj7ndtxuqYk1tkx94NLjYXUC
+Wqy48/tKQXobQh3qXeQ6HfwFSI5xpy61quQBZkJzVAatcOv/fhn3K+TrgBaKKkXF
+NQ3jjKhzrH3Z0son1+GNyhHvQlvCJ+jdWDpzDvSPXpqEDmxCQvdBdzGVAPrv3fmB
+MyOQFnHOTHmKtJ806jBFsYEUwnXKA4/xtaihl1OLbz85Z6MicH1PwTo4v0Z7ngIc
+yoxlgX/RAgMBAAECggEAEkGfGdFQsdbI5Jr3uhK110G9+XPczindB7O9632D8Fc5
+5rfRbtyB0HAl8wIweQ8vdFxfJZjMCGCctqH4o7qfAUg2V8WFqIwD98VgO9Pk1t7i
+GXApHBhzzFXEvnXibhF2ZYpN1Nx+ZIcopEQ9vVaHo6nNScbOREPjqkSypQJ7ClSQ
+vCzezzIhjeRTlttQvQv11oU/qolqVxL/GqGWtcI9I7onY5FP7qGNhnLrVJtDltcX
+71mbpjKS0NquLQimcDBwgVdhH1Ie+1hYJBLYgR8vE3J4d5a21NhtCeqTIHJo5SO/
+sKkZBVhD7OzP2qmQU4Hh99FK6648U6YdiBbKuumPgQKBgQDw1c5rf4jUlJaTk7wG
+/p6hSaMKVsM/JcrZgKZCCLS7fJ6M9DslCPQoOWTqh5Xq8Yh0gZ+FB/mo6nexMkgJ
+cpQhdBWgX6GXJhTK2M8A7FvA7IT3ZS7G4lzOFg9qsDjbKPI6F9JjqkOmeqLulJ/z
+Sr9stH2lN/+hGxwrqUs26c49uQKBgQC5/ZoE5ZBty1oIu43TGDU+7kLptsP/Ifub
+YOjlfJ1DrCFd7SDpL059p1c8PPjhphFi5UkIFp102OJ0higxgvo1gGnJQ6CYXvam
+qvmQyG4V8MV9bVv5SMV4QvcunTxbYEawz00BfI60lWAXKKhtPOpwdWeR0lt2SNR0
+zjwQm8+e2QKBgQC59o5eqWrRoy6mI8RjrkZ1CjQv7pDy+M6qplE62hgcUXzoIEpv
+LXvCd5b6FdnoQbr5I4I2qdLY4LutgsLnMKc7MbTlUhKncMtLWqB0+Q1cagW+Nk4p
+Wm8I3zXmTs6IRBTOUMivFrEIItge23qq1UP8v13prtTf5Nwaxq2CaIVNWQKBgC/B
+ypaPS7KlkIzFe/lEMgfirhPM9i7AzxZqn+KtSMRjon23sceuef0RxviUv2NRfQ1j
+yojlJbEnL560BAYSl6S9QGyJjOcTG0pYhJSEop/Hny5BsmgkI3Bp4YZ6oVDlO8GS
+uTc0gIAmCvJnYjgKeDhALUPoO8v3j3YerpWlLH6hAoGAazgCnV9WSWo3WmgVo7xw
+km2tt2mp7QgAAs8t3OSMvN7jC5uyRBJ+asH3ih9rDvtu4ZPwIYNEpoMkh9IKNoK+
+vtbJPqs6rrzBqQMJrfnTXm6o8gxHuSMQWXe/8tSlnbvuZhH7iFRyHH2Zv3SWoOaO
+pLYlvvPbeUK7Ue1jXJ8i4yE=
+-----END PRIVATE KEY-----

configs/certs/server.pem

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIERTCCAi2gAwIBAgIUeQzbn6IAK/WbPuiK8ybLBgNT0RAwDQYJKoZIhvcNAQEL
+BQAwOzEZMBcGA1UEAwwQTGludXhQYXRjaEFQSSBDQTERMA8GA1UECgwISW50ZXJu
+YWwxCzAJBgNVBAYTAlVTMB4XDTI2MDQwOTIwMTQwM1oXDTI3MDQwOTIwMTQwM1ow
+OjEYMBYGA1UEAwwPbGludXgtcGF0Y2gtYXBpMREwDwYDVQQKDAhJbnRlcm5hbDEL
+MAkGA1UEBhMCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCu+RZd
+6OHxdGJdI+C9rS8rowzsYF/qr3p6+Yvp9ySvBzJ20TVWQSrKFo1VcDgg7rkTYuRx
+zxehO0R7pTkxnWqLY6VAA39w5nyVzTwFPv7UovdAZx/U7hnJZj7ndtxuqYk1tkx9
+4NLjYXUCWqy48/tKQXobQh3qXeQ6HfwFSI5xpy61quQBZkJzVAatcOv/fhn3K+Tr
+gBaKKkXFNQ3jjKhzrH3Z0son1+GNyhHvQlvCJ+jdWDpzDvSPXpqEDmxCQvdBdzGV
+APrv3fmBMyOQFnHOTHmKtJ806jBFsYEUwnXKA4/xtaihl1OLbz85Z6MicH1PwTo4
+v0Z7ngIcyoxlgX/RAgMBAAGjQjBAMB0GA1UdDgQWBBTgNxkszZsl/UI2Kri5QJb8
+VrHASzAfBgNVHSMEGDAWgBRn6d2Of5Hk9E3kIp9Rn1Ny2pX7ljANBgkqhkiG9w0B
+AQsFAAOCAgEALx4MmEyFsmmpFS9JvKnkRi3AMn7ePRdg0nONEd735z1grnKNTjmH
+PJLErX3aD4lCxqyBhyqJaCCZRF1CRkE3wWTGyXSlab9RgXHTU9AiSvopEdgSiISt
+CI3X7uGqss3cERZcKLuM7JDTVdhtOouNbfwvG40hz6lm+OcQo7F3/z/boqKkFd+o
+yXLDJFCVaXgslCp1+fts7aFXpqAwj7tedzB2a7M1ncTOwvP//bnYjm/FygOhj0No
+4tNX2liUnfjbMqNFszxYl+ZtYYjrt23YwNPdVhF0oY2ludh16lluJHZECji2DzH0
+275M5DsgQcQpZmA77px0i+piNuCoS4wFJQDeQmtp2loGHa123zJra/kAINayf0WF
+S0dPAqXwBGj2WGP1uBNOLghV4MZaYuav0xWSMuTv2TW3ZsOYzYXQk0hMe7W7oIuZ
+VAcaw9ZT8wAFwo+unvzGIWtxSZ3sykK6thBEo8lqRkmqDCkDE86mb6BviQj1NBSP
++KrmZJ8vuvqfr1Oav/7Vk5qYoNprqZand6A1hnLxS9q/JZcr0Fj+Z7OS1G3hLrjd
+3oN6SdNWAVkznIBe0J+Ry29My/GniBbytJgXVi+4ROO5GGmtuDCMkFqOZcm6f8BW
+faPQWiWB5EY6ZuqgLgydGQ3qf1a5b8z1EzmiDZf5qRUdfddOCsljgiw=
+-----END CERTIFICATE-----

configs/config.yaml.example

@@ -14,7 +14,7 @@ tls:
   ca_cert: "/etc/linux_patch_api/certs/ca.pem"
   server_cert: "/etc/linux_patch_api/certs/server.pem"
   server_key: "/etc/linux_patch_api/certs/server.key"
-  # TLS 1.3 is the only supported version (hardcoded, not configurable)
+  min_tls_version: "1.3"
 
 # Job Configuration
 jobs:
@@ -57,17 +57,3 @@ package_manager:
 #   # Maximum number of polling attempts before giving up
 #   # Default: 1440 (24 hours at 60s intervals = 86400 seconds total)
 #   max_poll_attempts: 1440
-#   # Network interface whose IPv4 address is reported to the manager.
-#   # Overrides auto-detection when the wrong IP is selected (e.g., Docker bridge).
-#   # Example: "eth0", "ens192", "enp0s3"
-#   report_interface: "eth0"
-#   # Explicit IPv4 address reported to the manager.
-#   # Highest priority — overrides both report_interface and route-based selection.
-#   # Useful when the host has multiple IPs or runs inside a container.
-#   report_ip: "192.168.3.36"
-#   # Route-based IP selection is enabled by default when manager_url is set.
-#   The agent resolves the manager hostname to an IP, then uses `ip route get <manager_ip>`
-#   to determine which local source IP the kernel would use to reach the manager.
-#   This is the most accurate method for multi-homed hosts because it queries
-#   the kernel routing table directly.
-#   Priority order: report_ip > report_interface > route-based > auto-detect

configs/linux-patch-api-openrc

@@ -17,10 +17,10 @@ depend() {
 
 # Create required directories before starting
 start_pre() {
-    checkpath --directory --owner root:root --mode 0755 \
+    checkpath --directory --owner linux-patch-api:linux-patch-api --mode 0755 \
         /run/linux-patch-api \
-        /var/log/linux_patch_api \
-        /var/lib/linux_patch_api \
+        /var/log/linux-patch-api \
+        /var/lib/linux-patch-api \
         /etc/linux_patch_api/certs
     
     # Ensure config files exist

configs/linux-patch-api.install

@@ -1,81 +0,0 @@
-# Arch Linux install hooks for linux-patch-api
-# Matches Debian preinst/postinst behavior: no system user, root:root ownership
-
-post_install() {
-    # Create required directories
-    mkdir -p /etc/linux_patch_api/certs
-    mkdir -p /var/lib/linux_patch_api
-    mkdir -p /var/log/linux_patch_api
-
-    # Set proper ownership (service runs as root)
-    chown -R root:root /var/lib/linux_patch_api
-    chown -R root:root /var/log/linux_patch_api
-
-    # Set secure permissions
-    chmod 750 /etc/linux_patch_api
-    chmod 750 /etc/linux_patch_api/certs
-    chmod 755 /var/lib/linux_patch_api
-    chmod 755 /var/log/linux_patch_api
-
-    # Copy example configs if they don't exist
-    if [ ! -f "/etc/linux_patch_api/config.yaml" ]; then
-        cp /etc/linux_patch_api/config.yaml.example /etc/linux_patch_api/config.yaml
-        chmod 640 /etc/linux_patch_api/config.yaml
-        chown root:root /etc/linux_patch_api/config.yaml
-    fi
-
-    if [ ! -f "/etc/linux_patch_api/whitelist.yaml" ]; then
-        cp /etc/linux_patch_api/whitelist.yaml.example /etc/linux_patch_api/whitelist.yaml
-        chmod 640 /etc/linux_patch_api/whitelist.yaml
-        chown root:root /etc/linux_patch_api/whitelist.yaml
-    fi
-
-    # Reload systemd daemon
-    systemctl daemon-reload
-
-    # Enable the service (but don't start automatically - admin should configure first)
-    systemctl enable linux-patch-api.service
-
-    echo ""
-    echo "linux-patch-api installed successfully!"
-    echo ""
-    echo "Next steps:"
-    echo "  1. Configure /etc/linux_patch_api/config.yaml with your settings"
-    echo "  2. Place TLS certificates in /etc/linux_patch_api/certs/"
-    echo "  3. Configure IP whitelist in /etc/linux_patch_api/whitelist.yaml"
-    echo "  4. Start the service: systemctl start linux-patch-api"
-    echo "  5. Check status: systemctl status linux-patch-api"
-    echo ""
-}
-
-post_upgrade() {
-    # Reload systemd daemon on upgrade
-    systemctl daemon-reload
-}
-
-pre_remove() {
-    # Stop the service before removal
-    if systemctl is-active --quiet linux-patch-api.service; then
-        systemctl stop linux-patch-api.service
-        echo "Service stopped successfully"
-    else
-        echo "Service was not running"
-    fi
-
-    # Disable the service
-    if systemctl is-enabled --quiet linux-patch-api.service 2>/dev/null; then
-        systemctl disable linux-patch-api.service
-        echo "Service disabled"
-    fi
-}
-
-post_remove() {
-    # Reload systemd to remove service file
-    systemctl daemon-reload 2>/dev/null || true
-
-    # Remove directories only if empty (preserve user data on upgrade/reinstall)
-    rmdir --ignore-fail-on-non-empty /var/lib/linux_patch_api 2>/dev/null || true
-    rmdir --ignore-fail-on-non-empty /var/log/linux_patch_api 2>/dev/null || true
-
-    echo "linux-patch-api removed"
-}

configs/linux-patch-api.post-deinstall

@@ -1,10 +0,0 @@
-#!/bin/sh
-# Alpine Linux post-deinstall script for linux-patch-api
-# Runs after package files are removed
-# Matches Debian postrm behavior: clean up empty directories
-
-# Remove directories only if empty (preserve user data on reinstall)
-rmdir /var/lib/linux_patch_api 2>/dev/null || true
-rmdir /var/log/linux_patch_api 2>/dev/null || true
-
-echo "linux-patch-api removed"

configs/linux-patch-api.post-install

@@ -1,35 +0,0 @@
-#!/bin/sh
-# Alpine Linux post-install script for linux-patch-api
-# Runs after package files are laid down
-# Matches Debian postinst behavior: copy example configs, enable service
-
-# Copy example configs if they don't exist
-if [ ! -f "/etc/linux_patch_api/config.yaml" ]; then
-    if [ -f "/etc/linux_patch_api/config.yaml.example" ]; then
-        cp /etc/linux_patch_api/config.yaml.example /etc/linux_patch_api/config.yaml
-        chmod 640 /etc/linux_patch_api/config.yaml
-        chown root:root /etc/linux_patch_api/config.yaml
-    fi
-fi
-
-if [ ! -f "/etc/linux_patch_api/whitelist.yaml" ]; then
-    if [ -f "/etc/linux_patch_api/whitelist.yaml.example" ]; then
-        cp /etc/linux_patch_api/whitelist.yaml.example /etc/linux_patch_api/whitelist.yaml
-        chmod 640 /etc/linux_patch_api/whitelist.yaml
-        chown root:root /etc/linux_patch_api/whitelist.yaml
-    fi
-fi
-
-# Enable the service (but don't start automatically - admin should configure first)
-rc-update add linux-patch-api default
-
-echo ""
-echo "linux-patch-api installed successfully!"
-echo ""
-echo "Next steps:"
-echo "  1. Configure /etc/linux_patch_api/config.yaml with your settings"
-echo "  2. Place TLS certificates in /etc/linux_patch_api/certs/"
-echo "  3. Configure IP whitelist in /etc/linux_patch_api/whitelist.yaml"
-echo "  4. Start the service: rc-service linux-patch-api start"
-echo "  5. Check status: rc-service linux-patch-api status"
-echo ""

configs/linux-patch-api.pre-deinstall

@@ -1,15 +0,0 @@
-#!/bin/sh
-# Alpine Linux pre-deinstall script for linux-patch-api
-# Runs before package files are removed
-# Matches Debian prerm behavior: stop and disable service
-
-# Stop the service if running
-if rc-service linux-patch-api status >/dev/null 2>&1; then
-    rc-service linux-patch-api stop
-    echo "Service stopped"
-else
-    echo "Service was not running"
-fi
-
-# Disable the service
-rc-update del linux-patch-api default 2>/dev/null || true

configs/linux-patch-api.pre-install

@@ -1,33 +0,0 @@
-#!/bin/sh
-# Alpine Linux pre-install script for linux-patch-api
-# Runs before package files are laid down
-# Matches Debian preinst behavior: create directories, set permissions
-
-# Create required directories
-mkdir -p /etc/linux_patch_api/certs
-mkdir -p /var/lib/linux_patch_api
-mkdir -p /var/log/linux_patch_api
-
-# Generate machine-id if not present (required for enrollment)
-# Alpine Linux does not include /etc/machine-id by default
-if [ ! -f /etc/machine-id ] || [ ! -s /etc/machine-id ]; then
-    if command -v uuidgen > /dev/null 2>&1; then
-        uuidgen | tr -d '-' > /etc/machine-id
-    elif [ -f /proc/sys/kernel/random/uuid ]; then
-        cat /proc/sys/kernel/random/uuid | tr -d '-' > /etc/machine-id
-    else
-        # Fallback: generate from /dev/urandom
-        od -x -N4 /dev/urandom | head -1 | awk '{print $2$3}' > /etc/machine-id
-    fi
-    chmod 444 /etc/machine-id
-fi
-
-# Set proper ownership (service runs as root)
-chown -R root:root /var/lib/linux_patch_api
-chown -R root:root /var/log/linux_patch_api
-
-# Set secure permissions
-chmod 750 /etc/linux_patch_api
-chmod 750 /etc/linux_patch_api/certs
-chmod 755 /var/lib/linux_patch_api
-chmod 755 /var/log/linux_patch_api

configs/linux-patch-api.service

@@ -9,9 +9,7 @@ Type=simple
 NotifyAccess=all
 ExecStart=/usr/bin/linux-patch-api --config /etc/linux_patch_api/config.yaml
 Restart=on-failure
-RestartSec=10s
-StartLimitBurst=5
-StartLimitIntervalSec=300
+RestartSec=5s
 TimeoutStopSec=30s
 
 # Process management

debian/.debhelper/generated/linux-patch-api/dh_installchangelogs.dch.trimmed

@@ -0,0 +1,11 @@
+linux-patch-api (1.0.0-1) stable; urgency=medium
+
+  * Initial production release
+  * Secure mTLS-authenticated REST API for remote package management
+  * 15 API endpoints for package install/remove, patch application, system management
+  * Asynchronous job processing with WebSocket status streaming
+  * IP whitelist enforcement and comprehensive audit logging
+  * Systemd integration with security hardening
+  * Supports Debian 11/12, Ubuntu 20.04/22.04/24.04
+
+ -- Echo <echo@moon-dragon.us>  Thu, 09 Apr 2026 18:57:12 -0500

debian/.debhelper/generated/linux-patch-api/installed-by-dh_install

@@ -0,0 +1,4 @@
+debian/tmp/usr/bin/linux-patch-api
+debian/tmp/lib/systemd/system/linux-patch-api.service
+debian/tmp/etc/linux_patch_api/config.yaml
+debian/tmp/etc/linux_patch_api/whitelist.yaml

debian/.debhelper/generated/linux-patch-api/postinst.service

@@ -0,0 +1,30 @@
+# Automatically added by dh_installsystemd/13.31
+if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
+	# The following line should be removed in trixie or trixie+1
+	deb-systemd-helper unmask 'linux-patch-api.service' >/dev/null || true
+
+	# was-enabled defaults to true, so new installations run enable.
+	if deb-systemd-helper --quiet was-enabled 'linux-patch-api.service'; then
+		# Enables the unit on first installation, creates new
+		# symlinks on upgrades if the unit file has changed.
+		deb-systemd-helper enable 'linux-patch-api.service' >/dev/null || true
+	else
+		# Update the statefile to add new symlinks (if any), which need to be
+		# cleaned up on purge. Also remove old symlinks.
+		deb-systemd-helper update-state 'linux-patch-api.service' >/dev/null || true
+	fi
+fi
+# End automatically added section
+# Automatically added by dh_installsystemd/13.31
+if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
+	if [ -d /run/systemd/system ]; then
+		systemctl --system daemon-reload >/dev/null || true
+		if [ -n "$2" ]; then
+			_dh_action=restart
+		else
+			_dh_action=start
+		fi
+		deb-systemd-invoke $_dh_action 'linux-patch-api.service' >/dev/null || true
+	fi
+fi
+# End automatically added section

debian/.debhelper/generated/linux-patch-api/prerm.service

@@ -0,0 +1,5 @@
+# Automatically added by dh_installsystemd/13.31
+if [ -z "$DPKG_ROOT" ] && [ "$1" = remove ] && [ -d /run/systemd/system ] ; then
+	deb-systemd-invoke stop 'linux-patch-api.service' >/dev/null || true
+fi
+# End automatically added section

debian/changelog

@@ -1,22 +1,76 @@
-linux-patch-api (1.2.0) unstable; urgency=medium
+linux-patch-api (0.3.12-1) unstable; urgency=low
 
-  * Add auto-enrollment on startup when certs are missing/invalid
-  * Add cert validation (existence, parse, expiry, key match, CA trust)
-  * Add --renew-certs CLI flag for manual cert renewal
-  * Fix --enroll to exit after completion (no port conflict)
-  * Add SO_REUSEADDR to prevent Address already in use errors
-  * Add polling token persistence for enrollment resume after restart
-  * Add exit code strategy (0=clean, 1=error, 2=enrollment in progress)
-  * Increase RestartSec to 10s and add StartLimitBurst=5
-  * Add cert and enrollment URL check in postinst
-  * Fix misleading "Listening on" log before actual bind
+  * Fix socket activation detection to use resolved service name
+  * Queries like "sshd" now correctly resolve to "ssh.socket" for socket activation
 
- -- Echo <echo@moon-dragon.us>  Thu, 29 May 2026 10:20:00 -0500
+ -- Echo <echo@moon-dragon.us>  Tue, 06 May 2026 20:42:00 -0500
 
-linux-patch-api (1.1.17) unstable; urgency=medium
+linux-patch-api (0.3.10-1) unstable; urgency=low
 
-  * Add mandatory package cache refresh before patch_apply
-  * Add health check cache refresh when stale (>4h)
-  * Add cache status fields to health response
+  * Fix socket activation detection for service status healthy logic
+  * When service is inactive but enabled, check if .socket unit is active
 
- -- Echo <echo@moon-dragon.us>  Thu, 22 May 2026 12:00:00 -0500
+ -- Echo <echo@moon-dragon.us>  Mon, 05 May 2026 13:10:00 -0500
+
+linux-patch-api (0.3.9-1) unstable; urgency=low
+
+  * Fix socket activation detection for service status healthy logic
+  * When service is inactive but enabled, check if .socket unit is active
+  * Mark service healthy if socket is listening (e.g., ssh.socket for ssh.service)
+
+ -- Echo <echo@moon-dragon.us>  Mon, 05 May 2026 11:25:00 -0500
+
+linux-patch-api (0.3.8-1) unstable; urgency=low
+
+  * Add GET /api/v1/system/services/{name} endpoint for service health checks
+  * Add ServiceStatus struct with systemd and OpenRC support
+  * Add get_service_status() to PackageManagerBackend trait
+  * Implement systemd service status via systemctl
+  * Implement OpenRC service status via rc-service
+  * Add E2E test for service status endpoint
+
+ -- Echo <echo@moon-dragon.us>  Mon, 04 May 2026 23:44:00 -0500
+
+linux-patch-api (0.3.5-1) unstable; urgency=low
+
+  * Remove CapabilityBoundingSet and AmbientCapabilities - apt needs full root capabilities
+  * Remove ProtectSystem=strict, NoNewPrivileges, RestrictSUIDSGID - block core functionality
+  * Remove ReadWritePaths - unnecessary without ProtectSystem=strict
+  * Fix E2E test: properly FAIL on status=failed package operations
+  * Fix E2E test: require status=completed for install/update/remove lifecycle
+  * Update service file Type=notify -> Type=simple
+  * Add DEBIAN_FRONTEND=noninteractive environment variable
+
+ -- Echo <echo@moon-dragon.us>  Sat, 03 May 2026 03:15:00 -0500
+
+linux-patch-api (0.3.4-1) unstable; urgency=low
+
+  * Fix CI workflow: prevent recursive tag triggers (v* -> v*.*.*)
+  * Fix CI workflow: upload u2204 deb to same release (no -u2204 suffix)
+  * Remove sudo from apt commands (service runs as root)
+  * Remove NoNewPrivileges and RestrictSUIDSGID from service file
+  * Update service file Type=notify -> Type=simple
+  * Add DEBIAN_FRONTEND=noninteractive environment variable
+
+ -- Echo <echo@moon-dragon.us>  Fri, 02 May 2026 22:00:00 -0500
+
+linux-patch-api (0.3.3-1) unstable; urgency=low
+
+  * Fix dpkg packaging: remove linux-patch-api user creation
+  * Change ownership to root:root in preinst/postinst scripts
+  * Bump version to 0.3.3
+
+ -- Echo <echo@moon-dragon.us>  Fri, 02 May 2026 21:45:00 -0500
+
+linux-patch-api (0.3.2-1) unstable; urgency=low
+
+  * Remove sudo from apt commands in source code
+  * Remove NoNewPrivileges=true from service file
+  * Remove RestrictSUIDSGID=true from service file
+  * Add DEBIAN_FRONTEND=noninteractive to service file
+  * Fix TLS 1.3 enforcement in mtls.rs
+  * Add client_disconnect_timeout to main.rs
+  * Optimize RwLock usage in jobs/manager.rs
+  * Bump version to 0.3.2
+
+ -- Echo <echo@moon-dragon.us>  Fri, 02 May 2026 21:30:00 -0500

debian/control

@@ -14,8 +14,6 @@ Vcs-Browser: https://gitea.moon-dragon.us/echo/linux_patch_api
 
 Package: linux-patch-api
 Architecture: amd64
-Version: 1.2.0-1
-Installed-Size: 0
 Depends: systemd,
          libsystemd0,
          ${shlibs:Depends},

debian/debhelper-build-stamp

@@ -0,0 +1 @@
+linux-patch-api

debian/files

@@ -0,0 +1,2 @@
+linux-patch-api_1.0.0-1_amd64.buildinfo admin optional
+linux-patch-api_1.0.0-1_amd64.deb admin optional

debian/linux-patch-api.debhelper.log

@@ -0,0 +1 @@
+dh_auto_install

debian/linux-patch-api.postrm.debhelper

@@ -0,0 +1,12 @@
+# Automatically added by dh_installsystemd/13.31
+if [ "$1" = remove ] && [ -d /run/systemd/system ] ; then
+	systemctl --system daemon-reload >/dev/null || true
+fi
+# End automatically added section
+# Automatically added by dh_installsystemd/13.31
+if [ "$1" = "purge" ]; then
+	if [ -x "/usr/bin/deb-systemd-helper" ]; then
+		deb-systemd-helper purge 'linux-patch-api.service' >/dev/null || true
+	fi
+fi
+# End automatically added section

debian/linux-patch-api.substvars

@@ -0,0 +1,3 @@
+shlibs:Depends=libc6 (>= 2.39), libgcc-s1 (>= 4.2)
+misc:Depends=
+misc:Pre-Depends=

debian/linux-patch-api/DEBIAN/conffiles

@@ -0,0 +1,4 @@
+/etc/linux_patch_api/config.yaml
+/etc/linux_patch_api/whitelist.yaml
+/etc/linux_patch_api/config.yaml
+/etc/linux_patch_api/whitelist.yaml

debian/linux-patch-api/DEBIAN/control

@@ -0,0 +1,23 @@
+Package: linux-patch-api
+Version: 1.0.0-1
+Architecture: amd64
+Maintainer: Echo <echo@moon-dragon.us>
+Installed-Size: 8897
+Depends: systemd, libsystemd0, libc6 (>= 2.39), libgcc-s1 (>= 4.2)
+Section: admin
+Priority: optional
+Homepage: https://gitea.moon-dragon.us/echo/linux_patch_api
+Description: Secure remote package management API for Linux systems
+ Linux Patch API provides a secure, mTLS-authenticated REST API for
+ remote package management operations including:
+  - Package installation and removal
+  - Security patch application
+  - System health monitoring
+  - Job queue management with WebSocket status streaming
+ .
+ Features:
+  - Mutual TLS (mTLS) authentication
+  - IP whitelist enforcement
+  - Asynchronous job processing
+  - Comprehensive audit logging
+  - Systemd integration with security hardening

debian/linux-patch-api/DEBIAN/md5sums

@@ -0,0 +1,5 @@
+23b89eecc51f46c6813658dd615d13a9  lib/systemd/system/linux-patch-api.service
+d64a80e2a796561c39c6941c6b9e268c  usr/bin/linux-patch-api
+154c7ae7e01ae22cdc8ceea1fd0956e2  usr/share/doc/linux-patch-api/changelog.Debian.gz
+978478c6c7f1e9dcb38eb1f2454535c0  usr/share/doc/linux-patch-api/changelog.gz
+c2fab316c94aa61adb70d79365cfe08f  usr/share/doc/linux-patch-api/copyright

debian/linux-patch-api/DEBIAN/postinst

@@ -0,0 +1,49 @@
+#!/bin/bash
+# postinst script for linux-patch-api
+# Created by package build system
+
+set -e
+
+# Configure with debhelper
+if [ "$1" = "configure" ]; then
+    echo "Configuring linux-patch-api..."
+    
+    # Copy example configs if they don't exist
+    if [ ! -f "/etc/linux_patch_api/config.yaml" ]; then
+        echo "Creating default config.yaml..."
+        cp /etc/linux_patch_api/config.yaml.example /etc/linux_patch_api/config.yaml
+        chmod 640 /etc/linux_patch_api/config.yaml
+        chown root:root /etc/linux_patch_api/config.yaml
+    fi
+    
+    if [ ! -f "/etc/linux_patch_api/whitelist.yaml" ]; then
+        echo "Creating default whitelist.yaml..."
+        cp /etc/linux_patch_api/whitelist.yaml.example /etc/linux_patch_api/whitelist.yaml
+        chmod 640 /etc/linux_patch_api/whitelist.yaml
+        chown root:root /etc/linux_patch_api/whitelist.yaml
+    fi
+    
+    # Reload systemd daemon to pick up new service file
+    systemctl daemon-reload
+    
+    # Enable the service (but don't start automatically - admin should configure first)
+    systemctl enable linux-patch-api.service
+    
+    echo ""
+    echo "linux-patch-api installed successfully!"
+    echo ""
+    echo "Next steps:"
+    echo "  1. Configure /etc/linux_patch_api/config.yaml with your settings"
+    echo "  2. Place TLS certificates in /etc/linux_patch_api/certs/"
+    echo "  3. Configure IP whitelist in /etc/linux_patch_api/whitelist.yaml"
+    echo "  4. Start the service: systemctl start linux-patch-api"
+    echo "  5. Check status: systemctl status linux-patch-api"
+    echo ""
+fi
+
+# Handle upgrade
+if [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-remove" ] || [ "$1" = "abort-deconfigure" ]; then
+    echo "Installation aborted - service remains in previous state"
+fi
+
+exit 0

debian/linux-patch-api/DEBIAN/postrm

@@ -0,0 +1,52 @@
+#!/bin/bash
+# postrm script for linux-patch-api
+# Created by package build system
+
+set -e
+
+# Handle purge - remove all configuration and data
+if [ "$1" = "purge" ]; then
+    echo "Purging linux-patch-api configuration and data..."
+    
+    # Stop service if still running
+    if systemctl is-active --quiet linux-patch-api.service 2>/dev/null; then
+        systemctl stop linux-patch-api.service
+    fi
+    
+    # Disable service
+    if systemctl is-enabled --quiet linux-patch-api.service 2>/dev/null; then
+        systemctl disable linux-patch-api.service
+    fi
+    
+    # Reload systemd to remove service file
+    systemctl daemon-reload
+    
+    # Remove configuration directory (preserved by conffiles during normal remove)
+    if [ -d "/etc/linux_patch_api" ]; then
+        echo "Removing /etc/linux_patch_api..."
+        rm -rf /etc/linux_patch_api
+    fi
+    
+    # Remove data directory
+    if [ -d "/var/lib/linux_patch_api" ]; then
+        echo "Removing /var/lib/linux_patch_api..."
+        rm -rf /var/lib/linux_patch_api
+    fi
+    
+    # Remove log directory
+    if [ -d "/var/log/linux_patch_api" ]; then
+        echo "Removing /var/log/linux_patch_api..."
+        rm -rf /var/log/linux_patch_api
+    fi
+    
+    echo "linux-patch-api purged successfully"
+fi
+
+# Handle upgrade/remove - just ensure service is disabled
+if [ "$1" = "remove" ] || [ "$1" = "upgrade" ]; then
+    # Service should already be stopped by prerm
+    # Just reload systemd to remove the service file
+    systemctl daemon-reload 2>/dev/null || true
+fi
+
+exit 0

debian/linux-patch-api/DEBIAN/preinst

@@ -0,0 +1,29 @@
+#!/bin/bash
+# preinst script for linux-patch-api
+# Created by package build system
+
+set -e
+
+# Check if this is an upgrade
+if [ -d "/etc/linux_patch_api" ]; then
+    echo "Detected existing installation - performing upgrade"
+fi
+
+# Create required directories
+mkdir -p /etc/linux_patch_api/certs
+mkdir -p /var/lib/linux_patch_api
+mkdir -p /var/log/linux_patch_api
+
+# Set proper ownership (service runs as root)
+chown -R root:root /var/lib/linux_patch_api
+chown -R root:root /var/log/linux_patch_api
+
+# Set secure permissions
+chmod 750 /etc/linux_patch_api
+chmod 750 /etc/linux_patch_api/certs
+chmod 755 /var/lib/linux_patch_api
+chmod 755 /var/log/linux_patch_api
+
+echo "Pre-installation checks completed successfully"
+
+exit 0

debian/linux-patch-api/DEBIAN/prerm

@@ -0,0 +1,33 @@
+#!/bin/bash
+# prerm script for linux-patch-api
+# Created by package build system
+
+set -e
+
+# Stop the service before removal/upgrade
+if [ "$1" = "remove" ] || [ "$1" = "upgrade" ]; then
+    echo "Stopping linux-patch-api service..."
+    
+    if systemctl is-active --quiet linux-patch-api.service; then
+        systemctl stop linux-patch-api.service
+        echo "Service stopped successfully"
+    else
+        echo "Service was not running"
+    fi
+    
+    # Disable the service
+    if systemctl is-enabled --quiet linux-patch-api.service 2>/dev/null; then
+        systemctl disable linux-patch-api.service
+        echo "Service disabled"
+    fi
+fi
+
+# Handle failed upgrade
+if [ "$1" = "failed-upgrade" ]; then
+    echo "Upgrade failed - attempting to restore previous state"
+    # Previous version should handle restoration
+fi
+
+echo "Pre-removal script completed"
+
+exit 0

debian/linux-patch-api/etc/linux_patch_api/config.yaml

@@ -0,0 +1,46 @@
+# Linux Patch API Configuration
+# Example configuration file - copy to /etc/linux_patch_api/config.yaml
+
+# Server Configuration
+server:
+  port: 12443
+  bind: "0.0.0.0"
+  timeout_seconds: 30
+
+# TLS/mTLS Configuration
+tls:
+  enabled: true
+  port: 12443
+  ca_cert: "/etc/linux_patch_api/certs/ca.pem"
+  server_cert: "/etc/linux_patch_api/certs/server.pem"
+  server_key: "/etc/linux_patch_api/certs/server.key"
+  min_tls_version: "1.3"
+
+# Job Configuration
+jobs:
+  max_concurrent: 5
+  timeout_minutes: 30
+  storage_path: "/var/lib/linux_patch_api/jobs"
+
+# Logging Configuration
+logging:
+  level: "info"
+  journal_enabled: true
+  syslog_enabled: false
+  # syslog_server: "udp://localhost:514"
+  file_path: "/var/log/linux_patch_api/audit.log"
+  retention_days: 30
+
+# IP Whitelist Configuration
+whitelist:
+  path: "/etc/linux_patch_api/whitelist.yaml"
+  # Entries can be:
+  # - Individual IPs: "192.168.1.100"
+  # - CIDR subnets: "192.168.1.0/24"
+  # - Hostnames: "admin-server.internal"
+
+# Package Manager Backend
+package_manager:
+  # Primary backend (auto-detected if not specified)
+  # Options: apt, dnf, yum, apk, pacman
+  backend: "auto"

debian/linux-patch-api/etc/linux_patch_api/whitelist.yaml

@@ -0,0 +1,14 @@
+# Linux Patch API - IP Whitelist Configuration
+# Copy to /etc/linux_patch_api/whitelist.yaml
+# Block all by default - only listed IPs can access the API
+
+# Supported entry types:
+# - Individual IPs: "192.168.1.100"
+# - CIDR subnets: "192.168.1.0/24"
+# - Hostnames: "admin-server.internal" (resolved at startup)
+
+# Example entries:
+entries:
+  - "192.168.1.0/24"      # Management network
+  - "10.0.0.50"          # Specific admin workstation
+  # - "admin-server.internal"  # Hostname example (uncomment to use)

debian/linux-patch-api/lib/systemd/system/linux-patch-api.service

@@ -0,0 +1,62 @@
+[Unit]
+Description=Linux Patch API - Secure Remote Package Management
+Documentation=man:linux-patch-api(8)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+NotifyAccess=all
+ExecStart=/usr/bin/linux-patch-api --config /etc/linux_patch_api/config.yaml
+Restart=on-failure
+RestartSec=5s
+TimeoutStopSec=30s
+
+# Process management
+RuntimeDirectory=linux-patch-api
+RuntimeDirectoryMode=0755
+
+# Security hardening
+# NOTE: Package management requires extensive system access. The following
+# restrictions have been removed because they block core functionality:
+#   - ProtectSystem=strict: Blocks writes to /usr, /etc, /lib where packages install
+#   - NoNewPrivileges: Blocks sudo/setuid which apt needs for _apt sandbox
+#   - RestrictSUIDSGID: Blocks setuid/setgid which apt needs for _apt sandbox
+#   - CapabilityBoundingSet: Drops capabilities that apt needs (SETUID, SETGID, CHOWN, etc.)
+#   - AmbientCapabilities: Same issue as CapabilityBoundingSet
+# Network security is provided by mTLS + IP whitelist. The service runs as root
+# and MUST be able to install/remove/update packages system-wide.
+ProtectHome=true
+PrivateTmp=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=false
+RestrictRealtime=true
+
+# System call filtering (whitelist approach)
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+# Environment
+Environment="RUST_BACKTRACE=1"
+Environment="DEBIAN_FRONTEND=noninteractive"
+Environment="RUST_LOG=info"
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=linux-patch-api
+SyslogFacility=daemon
+SyslogLevel=info
+
+# Resource limits
+LimitNOFILE=65536
+LimitNPROC=4096
+
+[Install]
+WantedBy=multi-user.target

debian/linux-patch-api/usr/share/doc/linux-patch-api/copyright

@@ -0,0 +1,31 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: linux-patch-api
+Upstream-Contact: Echo <echo@moon-dragon.us>
+Source: https://gitea.moon-dragon.us/echo/linux_patch_api
+
+Files: *
+Copyright: 2024-2026 Echo <echo@moon-dragon.us>
+License: MIT
+
+License: MIT
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ THE SOFTWARE.
+
+Files: debian/*
+Copyright: 2024-2026 Echo <echo@moon-dragon.us>
+License: MIT

debian/postinst

@@ -29,60 +29,16 @@ if [ "$1" = "configure" ]; then
     # Enable the service (but don't start automatically - admin should configure first)
     systemctl enable linux-patch-api.service
     
-    # Check for TLS certificates and enrollment URL
-    CERT_DIR="/etc/linux_patch_api/certs"
-    CA_CERT="$CERT_DIR/ca.pem"
-    SERVER_CERT="$CERT_DIR/server.pem"
-    SERVER_KEY="$CERT_DIR/server.key.pem"
-    CONFIG_FILE="/etc/linux_patch_api/config.yaml"
-    
-    CERTS_MISSING=false
-    if [ ! -f "$CA_CERT" ] || [ ! -f "$SERVER_CERT" ] || [ ! -f "$SERVER_KEY" ]; then
-        CERTS_MISSING=true
-    fi
-    
-    if [ "$CERTS_MISSING" = true ]; then
-        echo ""
-        echo "⚠ TLS certificates are missing. The service will not start without them."
-        echo ""
-        
-        # Check if enrollment.manager_url is configured
-        if [ -f "$CONFIG_FILE" ]; then
-            # Check for manager_url in config (handles both old String format and new Option format)
-            MANAGER_URL=$(grep -E '^\s*manager_url:' "$CONFIG_FILE" 2>/dev/null | sed 's/^\s*manager_url:\s*//' | tr -d '"' | tr -d "'" | xargs)
-            if [ -n "$MANAGER_URL" ] && [ "$MANAGER_URL" != "" ]; then
-                echo "✓ Auto-enrollment is configured (manager_url: $MANAGER_URL)"
-                echo "  Auto-enrollment will run on first service start."
-                echo "  The service will automatically request and provision certificates."
-            else
-                echo "⚠ No enrollment.manager_url found in config.yaml."
-                echo ""
-                echo "To enable automatic certificate enrollment, add the manager URL:"
-                echo "  1. Edit /etc/linux_patch_api/config.yaml"
-                echo "  2. Add enrollment.manager_url: https://<your-manager-url>"
-                echo "  3. Start the service: systemctl start linux-patch-api"
-                echo ""
-                echo "Or enroll manually:"
-                echo "  linux-patch-api --enroll https://<your-manager-url>"
-                echo ""
-                echo "Or place certificates manually:"
-                echo "  - CA certificate: $CA_CERT"
-                echo "  - Server certificate: $SERVER_CERT"
-                echo "  - Server key: $SERVER_KEY"
-            fi
-        else
-            echo "⚠ Config file not found at $CONFIG_FILE"
-            echo "  Please configure the service before starting."
-        fi
-    else
-        echo ""
-        echo "✓ TLS certificates found. The service is ready to start."
-        echo "  Start the service: systemctl start linux-patch-api"
-    fi
-    
     echo ""
     echo "linux-patch-api installed successfully!"
     echo ""
+    echo "Next steps:"
+    echo "  1. Configure /etc/linux_patch_api/config.yaml with your settings"
+    echo "  2. Place TLS certificates in /etc/linux_patch_api/certs/"
+    echo "  3. Configure IP whitelist in /etc/linux_patch_api/whitelist.yaml"
+    echo "  4. Start the service: systemctl start linux-patch-api"
+    echo "  5. Check status: systemctl status linux-patch-api"
+    echo ""
 fi
 
 # Handle upgrade

debian/rules

@@ -8,7 +8,7 @@ export DEB_CARGO_BUILD_FLAGS=--release
 	dh $@
 
 override_dh_auto_build:
-	cargo build --release --target x86_64-unknown-linux-gnu
+	. "$$HOME/.cargo/env" && cargo build --release --target x86_64-unknown-linux-gnu
 
 override_dh_auto_install:
 	dh_auto_install

debian/tmp/etc/linux_patch_api/config.yaml

@@ -0,0 +1,46 @@
+# Linux Patch API Configuration
+# Example configuration file - copy to /etc/linux_patch_api/config.yaml
+
+# Server Configuration
+server:
+  port: 12443
+  bind: "0.0.0.0"
+  timeout_seconds: 30
+
+# TLS/mTLS Configuration
+tls:
+  enabled: true
+  port: 12443
+  ca_cert: "/etc/linux_patch_api/certs/ca.pem"
+  server_cert: "/etc/linux_patch_api/certs/server.pem"
+  server_key: "/etc/linux_patch_api/certs/server.key"
+  min_tls_version: "1.3"
+
+# Job Configuration
+jobs:
+  max_concurrent: 5
+  timeout_minutes: 30
+  storage_path: "/var/lib/linux_patch_api/jobs"
+
+# Logging Configuration
+logging:
+  level: "info"
+  journal_enabled: true
+  syslog_enabled: false
+  # syslog_server: "udp://localhost:514"
+  file_path: "/var/log/linux_patch_api/audit.log"
+  retention_days: 30
+
+# IP Whitelist Configuration
+whitelist:
+  path: "/etc/linux_patch_api/whitelist.yaml"
+  # Entries can be:
+  # - Individual IPs: "192.168.1.100"
+  # - CIDR subnets: "192.168.1.0/24"
+  # - Hostnames: "admin-server.internal"
+
+# Package Manager Backend
+package_manager:
+  # Primary backend (auto-detected if not specified)
+  # Options: apt, dnf, yum, apk, pacman
+  backend: "auto"

debian/tmp/etc/linux_patch_api/whitelist.yaml

@@ -0,0 +1,14 @@
+# Linux Patch API - IP Whitelist Configuration
+# Copy to /etc/linux_patch_api/whitelist.yaml
+# Block all by default - only listed IPs can access the API
+
+# Supported entry types:
+# - Individual IPs: "192.168.1.100"
+# - CIDR subnets: "192.168.1.0/24"
+# - Hostnames: "admin-server.internal" (resolved at startup)
+
+# Example entries:
+entries:
+  - "192.168.1.0/24"      # Management network
+  - "10.0.0.50"          # Specific admin workstation
+  # - "admin-server.internal"  # Hostname example (uncomment to use)

debian/tmp/lib/systemd/system/linux-patch-api.service

@@ -0,0 +1,57 @@
+[Unit]
+Description=Linux Patch API - Secure Remote Package Management
+Documentation=man:linux-patch-api(8)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=notify
+ExecStart=/usr/bin/linux-patch-api --config /etc/linux_patch_api/config.yaml
+Restart=on-failure
+RestartSec=5s
+TimeoutStopSec=30s
+
+# Process management
+RuntimeDirectory=linux-patch-api
+RuntimeDirectoryMode=0755
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/linux_patch_api /var/log/linux_patch_api
+PrivateTmp=true
+PrivateDevices=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=false
+RestrictRealtime=true
+RestrictSUIDSGID=true
+RemoveIPC=true
+
+# System call filtering (whitelist approach)
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+# Environment
+Environment="RUST_BACKTRACE=1"
+Environment="RUST_LOG=info"
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=linux-patch-api
+SyslogFacility=daemon
+SyslogLevel=info
+
+# Resource limits
+LimitNOFILE=65536
+LimitNPROC=4096
+
+[Install]
+WantedBy=multi-user.target

linux-patch-api.spec

@@ -1,7 +1,7 @@
 %global debug_package %{nil}
 
 Name:           linux-patch-api
-Version:        VERSION_PLACEHOLDER
+Version:        1.0.0
 Release:        1%{?dist}
 Summary:        Secure remote package management API for Linux systems
 License:        MIT
@@ -10,21 +10,19 @@ Source0:        linux-patch-api-%{version}.tar.gz
 BuildArch:      x86_64
 
 # Build requirements
-# NOTE: CI uses rustup to install cargo/rust, so they are NOT available as RPM packages.
-# Only uncomment BuildRequires for native RPM build environments where cargo/rust
-# are installed via dnf/yum package manager.
+# NOTE: Building in Debian container (node:18) - apt packages don't register in RPM db
+# Build tools ARE available (installed via apt-get in ci.yml), just won't validate
 # BuildRequires:  cargo >= 1.75
 # BuildRequires:  rust >= 1.75
-# BuildRequires:  gcc
-# BuildRequires:  openssl-devel
-# BuildRequires:  systemd-devel
+# BuildRequires:  systemd-rpm-macros  # Handling systemd manually
 # BuildRequires:  pkgconfig(systemd)
+# BuildRequires:  gcc
 
 # Runtime requirements
-Requires:       systemd-libs
-Requires:       openssl-libs
-Requires:       ca-certificates
+Requires:       systemd
+Requires:       libsystemd
 
+# Description
 %description
 Linux Patch API provides a secure, mTLS-authenticated REST API for
 remote package management operations including:
@@ -44,11 +42,10 @@ Features:
 %prep
 %autosetup -n linux-patch-api-%{version}
 
-# Build - no-op, binary is pre-built and included in source tarball
-# The binary is built by build-rpm.sh BEFORE creating the tarball,
-# so cargo does not need to be in rpmbuild's PATH.
+# Build
 %build
-# Binary already built - nothing to do
+export RUSTFLAGS="-C target-cpu=native"
+cargo build --release --target x86_64-unknown-linux-gnu
 
 # Install
 %install
@@ -59,8 +56,8 @@ mkdir -p %{buildroot}/lib/systemd/system
 mkdir -p %{buildroot}/var/log/linux_patch_api
 mkdir -p %{buildroot}/var/lib/linux_patch_api
 
-# Install binary (pre-built, included in tarball at target/release/)
-cp target/release/linux-patch-api %{buildroot}/usr/bin/
+# Install binary
+cp target/x86_64-unknown-linux-gnu/release/linux-patch-api %{buildroot}/usr/bin/
 chmod 755 %{buildroot}/usr/bin/linux-patch-api
 
 # Install systemd service
@@ -72,16 +69,28 @@ cp configs/config.yaml.example %{buildroot}/etc/linux_patch_api/config.yaml.exam
 cp configs/whitelist.yaml.example %{buildroot}/etc/linux_patch_api/whitelist.yaml.example
 chmod 644 %{buildroot}/etc/linux_patch_api/*.example
 
-# Pre-installation script - create directories (matches Debian preinst)
+# Pre-installation script
 %pre
+# Create system group
+getent group linux-patch-api > /dev/null || groupadd --system linux-patch-api
+
+# Create system user
+getent passwd linux-patch-api > /dev/null || useradd --system \
+    --gid linux-patch-api \
+    --home-dir /var/lib/linux_patch_api \
+    --no-create-home \
+    --shell /usr/sbin/nologin \
+    --comment "Linux Patch API Service" \
+    linux-patch-api
+
 # Create required directories
 mkdir -p /etc/linux_patch_api/certs
 mkdir -p /var/lib/linux_patch_api
 mkdir -p /var/log/linux_patch_api
 
-# Set proper ownership (service runs as root)
-chown -R root:root /var/lib/linux_patch_api
-chown -R root:root /var/log/linux_patch_api
+# Set proper ownership
+chown -R linux-patch-api:linux-patch-api /var/lib/linux_patch_api
+chown -R linux-patch-api:linux-patch-api /var/log/linux_patch_api
 
 # Set secure permissions
 chmod 750 /etc/linux_patch_api
@@ -89,19 +98,19 @@ chmod 750 /etc/linux_patch_api/certs
 chmod 755 /var/lib/linux_patch_api
 chmod 755 /var/log/linux_patch_api
 
-# Post-installation script - copy configs, enable service (matches Debian postinst)
+# Post-installation script
 %post
 # Copy example configs if they don't exist
 if [ ! -f "/etc/linux_patch_api/config.yaml" ]; then
     cp /etc/linux_patch_api/config.yaml.example /etc/linux_patch_api/config.yaml
     chmod 640 /etc/linux_patch_api/config.yaml
-    chown root:root /etc/linux_patch_api/config.yaml
+    chown linux-patch-api:linux-patch-api /etc/linux_patch_api/config.yaml
 fi
 
 if [ ! -f "/etc/linux_patch_api/whitelist.yaml" ]; then
     cp /etc/linux_patch_api/whitelist.yaml.example /etc/linux_patch_api/whitelist.yaml
     chmod 640 /etc/linux_patch_api/whitelist.yaml
-    chown root:root /etc/linux_patch_api/whitelist.yaml
+    chown linux-patch-api:linux-patch-api /etc/linux_patch_api/whitelist.yaml
 fi
 
 # Reload systemd daemon
@@ -149,13 +158,10 @@ fi
 
 # Files
 %files
-%defattr(-,root,root,-)
 /usr/bin/linux-patch-api
 /lib/systemd/system/linux-patch-api.service
 %config(noreplace) /etc/linux_patch_api/config.yaml.example
 %config(noreplace) /etc/linux_patch_api/whitelist.yaml.example
-%ghost %config(noreplace) /etc/linux_patch_api/config.yaml
-%ghost %config(noreplace) /etc/linux_patch_api/whitelist.yaml
 %dir /etc/linux_patch_api
 %dir /etc/linux_patch_api/certs
 %dir /var/lib/linux_patch_api
@@ -163,71 +169,11 @@ fi
 
 # Changelog
 %changelog
-* Tue May 27 2026 Echo <echo@moon-dragon.us> - 1.1.17-1
-- Add mandatory package cache refresh before patch_apply
-- Add health check cache refresh when stale (>4h)
-- Add cache status fields to health response
-- Add 404/fetch error retry with cache refresh
-- Add degraded health status on cache failure
-- New src/packages/cache.rs module
-
-* Tue May 20 2026 Echo <echo@moon-dragon.us> - 1.1.16-1
-- Add Pacman package manager backend for Arch Linux
-- Fix: Pacman backend not yet implemented error on Arch systems
-- Support pacman -Q for package listing, pacman -Qi for package details
-- Support pacman -Qu for patch/update detection
-- Fix Arch CI: add stale package cleanup and version verification
-
-* Tue May 20 2026 Echo <echo@moon-dragon.us> - 1.1.15-1
-- Add DNF package manager backend for Fedora/RHEL/CentOS 8+
-- Add YUM package manager backend for RHEL/CentOS 7
-- Fix: DNF backend not yet implemented error on Fedora systems
-- Support rpm -qa for package listing, rpm -qi for package details
-- Support dnf check-update (exit code 100) for patch detection
-- Support yum check-update (exit code 100) for patch detection
-
-* Tue May 20 2026 Echo <echo@moon-dragon.us> - 1.1.14-1
-- Fix RPM packaging: pre-build binary before tarball (like Alpine/Arch pattern)
-- Fix rpmbuild can't find cargo in PATH - binary now included in source tarball
-- Fix config file ownership: add %defattr(-,root,root,-) in %files section
-- Fix Requires: libsystemd -> systemd-libs for Fedora compatibility
-- Remove Requires: systemd (not needed, may not exist in containers)
-- Add stale RPM cleanup and version verification to build-rpm.sh
-- Support SKIP_CARGO_BUILD=1 like Alpine/Arch builds
-
-* Wed May 20 2026 Echo <echo@moon-dragon.us> - 1.1.12-1
-- Add APK (Alpine Linux) package manager backend
-- Add machine-id generation to Alpine pre-install script
-- Fix OpenRC init script ownership (root:root)
-
-
-* Wed May 20 2026 Echo <echo@moon-dragon.us> - 1.1.10-1
-- Fix Alpine install scripts: use separate files with valid abuild suffixes
-- Root cause: .apk-install is not a valid abuild suffix (abuild silently fails)
-- Correct format: pkgname.pre-install, .post-install, .pre-deinstall, .post-deinstall
-- Verified on actual Alpine runner: install script suffixes now pass abuild validation
-
-* Tue May 19 2026 Echo <echo@moon-dragon.us> - 1.1.9-1
-- Fix non-Ubuntu packages: align Arch, RPM, Alpine with Debian baseline
-- Remove system user creation (service runs as root)
-- Fix ownership to root:root across all platforms
-- Fix Alpine: co-locate install script with APKBUILD
-- Fix Arch: correct $startdir path in PKGBUILD
-- Fix RPM: add runtime deps, comment BuildRequires for CI
-- Add comprehensive installation docs for all platforms
-
-* Tue May 19 2026 Echo <echo@moon-dragon.us> - 1.1.8-1
-- Fix RPM packaging: runtime deps, match Debian install behavior, comment BuildRequires for CI
-- Remove system user creation (service runs as root per systemd unit)
-- Fix ownership to root:root matching Debian package
-- Add openssl-libs and ca-certificates runtime dependencies
-
-* Mon May 18 2026 Echo <echo@moon-dragon.us> - 1.1.8-1
-- Fix FQDN resolution: prioritize hostname -f over /etc/hostname
-- Fix display_name blank: add hostname field to enrollment request
-- Fix Arch/Alpine/RPM packaging: install scripts, user creation, directory creation
-
-* Thu Apr 09 2026 Echo <echo@moon-dragon.us> - 1.1.7-1
+* Thu Apr 09 2026 Echo <echo@moon-dragon.us> - 1.0.0-1
 - Initial production release
 - Secure mTLS-authenticated REST API for remote package management
 - 15 API endpoints for package install/remove, patch application, system management
+- Asynchronous job processing with WebSocket status streaming
+- IP whitelist enforcement and comprehensive audit logging
+- Systemd integration with security hardening
+- Supports RHEL 8/9, CentOS 8/9, Fedora 38+

releases/linux-patch-api_1.0.0-1_amd64.buildinfo

@@ -0,0 +1,209 @@
+Format: 1.0
+Source: linux-patch-api
+Binary: linux-patch-api
+Architecture: amd64
+Version: 1.0.0-1
+Checksums-Md5:
+ a64eb068fd021dd3a559bf1429960165 2624992 linux-patch-api_1.0.0-1_amd64.deb
+Checksums-Sha1:
+ 29bfe7427b42f05b4c0fd886d02b2550289df356 2624992 linux-patch-api_1.0.0-1_amd64.deb
+Checksums-Sha256:
+ 353b49ef3f83c0bf2c556bcfc1b3e8bb46b8e629a34659d4d5b63ac25c5a80c0 2624992 linux-patch-api_1.0.0-1_amd64.deb
+Build-Origin: Kali
+Build-Architecture: amd64
+Build-Date: Fri, 10 Apr 2026 01:50:29 +0000
+Build-Tainted-By:
+ usr-local-has-programs
+Installed-Build-Depends:
+ autoconf (= 2.72-6),
+ automake (= 1:1.18.1-4),
+ autopoint (= 0.23.2-2),
+ autotools-dev (= 20240727.1),
+ base-files (= 1:2026.1.0),
+ base-passwd (= 3.6.8),
+ bash (= 5.3-1),
+ binutils (= 2.45.50.20251209-1+b1),
+ binutils-common (= 2.45.50.20251209-1+b1),
+ binutils-x86-64-linux-gnu (= 2.45.50.20251209-1+b1),
+ bsdextrautils (= 2.41.3-4),
+ build-essential (= 12.12),
+ bzip2 (= 1.0.8-6+b1),
+ cargo (= 1.92.0+dfsg1-2),
+ coreutils (= 9.7-3),
+ cpp (= 4:15.2.0-4),
+ cpp-15 (= 15.2.0-12),
+ cpp-15-x86-64-linux-gnu (= 15.2.0-12),
+ cpp-x86-64-linux-gnu (= 4:15.2.0-4),
+ dash (= 0.5.12-12),
+ debconf (= 1.5.91),
+ debhelper (= 13.31),
+ debianutils (= 5.23.2),
+ dh-autoreconf (= 22),
+ dh-strip-nondeterminism (= 1.15.0-1),
+ diffutils (= 1:3.12-1),
+ dpkg (= 1.23.3+kali1),
+ dpkg-dev (= 1.23.3+kali1),
+ dwz (= 0.16-4),
+ file (= 1:5.46-5+b1),
+ findutils (= 4.10.0-3),
+ g++ (= 4:15.2.0-4),
+ g++-15 (= 15.2.0-12),
+ g++-15-x86-64-linux-gnu (= 15.2.0-12),
+ g++-x86-64-linux-gnu (= 4:15.2.0-4),
+ gcc (= 4:15.2.0-4),
+ gcc-15 (= 15.2.0-12),
+ gcc-15-base (= 15.2.0-12),
+ gcc-15-x86-64-linux-gnu (= 15.2.0-12),
+ gcc-x86-64-linux-gnu (= 4:15.2.0-4),
+ gettext (= 0.23.2-2),
+ gettext-base (= 0.23.2-2),
+ grep (= 3.12-1),
+ groff-base (= 1.23.0-10),
+ gzip (= 1.13-1),
+ hostname (= 3.25),
+ init-system-helpers (= 1.69+kali1),
+ intltool-debian (= 0.35.0+20060710.6),
+ libacl1 (= 2.3.2-2+b2),
+ libarchive-zip-perl (= 1.68-1),
+ libasan8 (= 15.2.0-12),
+ libatomic1 (= 15.2.0-12),
+ libattr1 (= 1:2.5.2-3+b1),
+ libaudit-common (= 1:4.1.2-1),
+ libaudit1 (= 1:4.1.2-1+b1),
+ libbinutils (= 2.45.50.20251209-1+b1),
+ libblkid1 (= 2.41.3-4),
+ libbrotli1 (= 1.1.0-2+b9),
+ libbsd0 (= 0.12.2-2+b1),
+ libbz2-1.0 (= 1.0.8-6+b1),
+ libc-bin (= 2.42-5),
+ libc-dev-bin (= 2.42-5),
+ libc-gconv-modules-extra (= 2.42-5),
+ libc6 (= 2.42-5),
+ libc6-dev (= 2.42-5),
+ libcap-ng0 (= 0.8.5-4+b2),
+ libcap2 (= 1:2.75-10+b5),
+ libcc1-0 (= 15.2.0-12),
+ libcom-err2 (= 1.47.2-3+b8),
+ libcrypt-dev (= 1:4.5.1-1),
+ libcrypt1 (= 1:4.5.1-1),
+ libctf-nobfd0 (= 2.45.50.20251209-1+b1),
+ libctf0 (= 2.45.50.20251209-1+b1),
+ libcurl4t64 (= 8.18.0-2),
+ libdb5.3t64 (= 5.3.28+dfsg2-11),
+ libdebconfclient0 (= 0.282+b2),
+ libdebhelper-perl (= 13.31),
+ libdpkg-perl (= 1.23.3+kali1),
+ libedit2 (= 3.1-20251016-1),
+ libelf1t64 (= 0.194-4),
+ libffi8 (= 3.5.2-3+b1),
+ libfile-stripnondeterminism-perl (= 1.15.0-1),
+ libgcc-15-dev (= 15.2.0-12),
+ libgcc-s1 (= 15.2.0-12),
+ libgdbm-compat4t64 (= 1.26-1+b1),
+ libgdbm6t64 (= 1.26-1+b1),
+ libgit2-1.9 (= 1.9.2+ds-6),
+ libgmp10 (= 2:6.3.0+dfsg-5+b1),
+ libgnutls30t64 (= 3.8.11-3),
+ libgomp1 (= 15.2.0-12),
+ libgprofng0 (= 2.45.50.20251209-1+b1),
+ libgssapi-krb5-2 (= 1.22.1-2),
+ libhogweed6t64 (= 3.10.2-1),
+ libhwasan0 (= 15.2.0-12),
+ libidn2-0 (= 2.3.8-4+b1),
+ libisl23 (= 0.27-1+b1),
+ libitm1 (= 15.2.0-12),
+ libjansson4 (= 2.14-2+b4),
+ libk5crypto3 (= 1.22.1-2),
+ libkeyutils1 (= 1.6.3-6+b1),
+ libkrb5-3 (= 1.22.1-2),
+ libkrb5support0 (= 1.22.1-2),
+ libldap2 (= 2.6.10+dfsg-1+b1),
+ libllhttp9.3 (= 9.3.3~really9.3.0+~cs12.11.8-3),
+ libllvm21 (= 1:21.1.8-1+b1),
+ liblsan0 (= 15.2.0-12),
+ liblzma5 (= 5.8.2-2),
+ libmagic-mgc (= 1:5.46-5+b1),
+ libmagic1t64 (= 1:5.46-5+b1),
+ libmbedcrypto16 (= 3.6.5-0.1),
+ libmbedtls21 (= 3.6.5-0.1),
+ libmbedx509-7 (= 3.6.5-0.1),
+ libmd0 (= 1.1.0-2+b2),
+ libmount1 (= 2.41.3-4),
+ libmpc3 (= 1.3.1-2+b1),
+ libmpfr6 (= 4.2.2-2+b1),
+ libnettle8t64 (= 3.10.2-1),
+ libnghttp2-14 (= 1.64.0-1.1+b1),
+ libnghttp3-9 (= 1.12.0-1),
+ libngtcp2-16 (= 1.16.0-1),
+ libngtcp2-crypto-ossl0 (= 1.16.0-1),
+ libp11-kit0 (= 0.25.10-1+b1),
+ libpam-modules (= 1.7.0-5+b1),
+ libpam-modules-bin (= 1.7.0-5+b1),
+ libpam-runtime (= 1.7.0-5),
+ libpam0g (= 1.7.0-5+b1),
+ libpcre2-8-0 (= 10.46-1+b1),
+ libperl5.40 (= 5.40.1-7),
+ libpipeline1 (= 1.5.8-2),
+ libpkgconf7 (= 2.5.1-4),
+ libpsl5t64 (= 0.21.2-1.1+b2),
+ libquadmath0 (= 15.2.0-12),
+ librtmp1 (= 2.4+20151223.gitfa8646d.1-3+b1),
+ libsasl2-2 (= 2.1.28+dfsg1-10),
+ libsasl2-modules-db (= 2.1.28+dfsg1-10),
+ libseccomp2 (= 2.6.0-2+b1),
+ libselinux1 (= 3.9-4+b1),
+ libsframe2 (= 2.45.50.20251209-1+b1),
+ libsmartcols1 (= 2.41.3-4),
+ libsqlite3-0 (= 3.46.1-9),
+ libssh2-1t64 (= 1.11.1-1+b1),
+ libssl3t64 (= 3.5.4-1+b1),
+ libstd-rust-1.92 (= 1.92.0+dfsg1-2),
+ libstd-rust-dev (= 1.92.0+dfsg1-2),
+ libstdc++-15-dev (= 15.2.0-12),
+ libstdc++6 (= 15.2.0-12),
+ libsystemd-dev (= 259.1-1),
+ libsystemd0 (= 259.1-1),
+ libtasn1-6 (= 4.21.0-2),
+ libtinfo6 (= 6.6+20251231-1),
+ libtool (= 2.5.4-10),
+ libtsan2 (= 15.2.0-12),
+ libubsan1 (= 15.2.0-12),
+ libuchardet0 (= 0.0.8-2+b1),
+ libudev1 (= 259-1),
+ libunistring5 (= 1.3-2+b1),
+ libuuid1 (= 2.41.3-4),
+ libxml2-16 (= 2.15.1+dfsg-2+b1),
+ libz3-4 (= 4.13.3-1+b1),
+ libzstd1 (= 1.5.7+dfsg-3+b1),
+ linux-libc-dev (= 6.18.5-1kali1),
+ m4 (= 1.4.21-1),
+ make (= 4.4.1-3),
+ man-db (= 2.13.1-1),
+ mawk (= 1.3.4.20250131-2),
+ ncurses-base (= 6.6+20251231-1),
+ ncurses-bin (= 6.6+20251231-1),
+ openssl-provider-legacy (= 3.5.4-1+b1),
+ patch (= 2.8-2),
+ perl (= 5.40.1-7),
+ perl-base (= 5.40.1-7),
+ perl-modules-5.40 (= 5.40.1-7),
+ pkg-config (= 2.5.1-4),
+ pkgconf (= 2.5.1-4),
+ pkgconf-bin (= 2.5.1-4),
+ po-debconf (= 1.0.22),
+ rpcsvc-proto (= 1.4.3-1),
+ rustc (= 1.92.0+dfsg1-2),
+ sed (= 4.9-2),
+ sensible-utils (= 0.0.26),
+ sysvinit-utils (= 3.15-6),
+ tar (= 1.35+dfsg-3.1),
+ util-linux (= 2.41.3-4),
+ xz-utils (= 5.8.2-2),
+ zlib1g (= 1:1.3.dfsg+really1.3.1-1+b2)
+Environment:
+ DEB_BUILD_OPTIONS="parallel=12"
+ LANG="en_US.UTF-8"
+ LANGUAGE="en_US:en"
+ LC_ALL="en_US.UTF-8"
+ SOURCE_DATE_EPOCH="1775779032"
+ TZ="UTC"

releases/linux-patch-api_1.0.0-1_amd64.changes

@@ -0,0 +1,31 @@
+Format: 1.8
+Date: Thu, 09 Apr 2026 18:57:12 -0500
+Source: linux-patch-api
+Binary: linux-patch-api
+Architecture: amd64
+Version: 1.0.0-1
+Distribution: stable
+Urgency: medium
+Maintainer: Echo <echo@moon-dragon.us>
+Changed-By: Echo <echo@moon-dragon.us>
+Description:
+ linux-patch-api - Secure remote package management API for Linux systems
+Changes:
+ linux-patch-api (1.0.0-1) stable; urgency=medium
+ .
+   * Initial production release
+   * Secure mTLS-authenticated REST API for remote package management
+   * 15 API endpoints for package install/remove, patch application, system management
+   * Asynchronous job processing with WebSocket status streaming
+   * IP whitelist enforcement and comprehensive audit logging
+   * Systemd integration with security hardening
+   * Supports Debian 11/12, Ubuntu 20.04/22.04/24.04
+Checksums-Sha1:
+ 6eacada3e35f2b5d4e76ca6d0dfa2d12588e235a 6044 linux-patch-api_1.0.0-1_amd64.buildinfo
+ 29bfe7427b42f05b4c0fd886d02b2550289df356 2624992 linux-patch-api_1.0.0-1_amd64.deb
+Checksums-Sha256:
+ 1d7c683fa9bb147f11cc4b8dc949b34d2bd7bdef0e2ba0f04e66e74bab955acc 6044 linux-patch-api_1.0.0-1_amd64.buildinfo
+ 353b49ef3f83c0bf2c556bcfc1b3e8bb46b8e629a34659d4d5b63ac25c5a80c0 2624992 linux-patch-api_1.0.0-1_amd64.deb
+Files:
+ ab758ad6130467303e536c3aacc901a1 6044 admin optional linux-patch-api_1.0.0-1_amd64.buildinfo
+ a64eb068fd021dd3a559bf1429960165 2624992 admin optional linux-patch-api_1.0.0-1_amd64.deb

scripts/build-package.sh

@@ -1,147 +0,0 @@
-#!/usr/bin/env bash
-# =============================================================================
-# Linux Patch API — Build .deb Package for Ubuntu 24.04
-# =============================================================================
-# Produces: linux-patch-api_<version>-1_amd64.deb
-# Prerequisites:
-#   - Rust toolchain (cargo, rustc >= 1.75)
-#   - dpkg-deb
-# =============================================================================
-
-set -euo pipefail
-
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-CYAN='\033[0;36m'
-NC='\033[0m'
-
-info()  { echo -e "${GREEN}[INFO]${NC}  $*"; }
-warn()  { echo -e "${YELLOW}[WARN]${NC} $*"; }
-error() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
-
-PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-VERSION="1.2.0"
-RELEASE="1"
-PKG_NAME="linux-patch-api"
-DEB_NAME="${PKG_NAME}_${VERSION}-${RELEASE}_amd64.deb"
-BUILD_DIR="${PROJECT_ROOT}/package-build"
-
-info "=== Linux Patch API — Package Build ==="
-info "Version: ${VERSION}-${RELEASE}"
-info "Target:  Ubuntu 24.04 (noble) amd64"
-echo
-
-# ---------------------------------------------------------------------------
-# 1. Build Rust binary (release mode)
-# ---------------------------------------------------------------------------
-info "Step 1/4: Building Rust binary (release mode)..."
-cd "${PROJECT_ROOT}"
-cargo build --release 2>&1 | tail -5
-
-# Verify binary exists
-[[ -f "${PROJECT_ROOT}/target/release/linux-patch-api" ]] || error "linux-patch-api not found in target/release/"
-info "Rust binary built successfully."
-
-# Strip debug symbols for smaller package
-strip "${PROJECT_ROOT}/target/release/linux-patch-api" 2>/dev/null || warn "strip failed (may already be stripped)"
-info "Binary stripped."
-
-# ---------------------------------------------------------------------------
-# 2. Assemble package directory structure
-# ---------------------------------------------------------------------------
-info "Step 2/4: Assembling package structure..."
-rm -rf "${BUILD_DIR}"
-mkdir -p "${BUILD_DIR}/DEBIAN"
-mkdir -p "${BUILD_DIR}/usr/bin"
-mkdir -p "${BUILD_DIR}/etc/linux_patch_api"
-mkdir -p "${BUILD_DIR}/etc/linux_patch_api/certs"
-mkdir -p "${BUILD_DIR}/lib/systemd/system"
-mkdir -p "${BUILD_DIR}/var/log/linux_patch_api"
-mkdir -p "${BUILD_DIR}/var/lib/linux_patch_api"
-
-# Binary
-cp "${PROJECT_ROOT}/target/release/linux-patch-api" "${BUILD_DIR}/usr/bin/linux-patch-api"
-chmod 755 "${BUILD_DIR}/usr/bin/linux-patch-api"
-
-# Systemd service
-cp "${PROJECT_ROOT}/configs/linux-patch-api.service" "${BUILD_DIR}/lib/systemd/system/"
-
-# Configuration files (live configs for admin editing)
-cp "${PROJECT_ROOT}/configs/config.yaml.example" "${BUILD_DIR}/etc/linux_patch_api/config.yaml"
-cp "${PROJECT_ROOT}/configs/whitelist.yaml.example" "${BUILD_DIR}/etc/linux_patch_api/whitelist.yaml"
-
-# Example config files (referenced by postinst for first-run setup)
-cp "${PROJECT_ROOT}/configs/config.yaml.example" "${BUILD_DIR}/etc/linux_patch_api/config.yaml.example"
-cp "${PROJECT_ROOT}/configs/whitelist.yaml.example" "${BUILD_DIR}/etc/linux_patch_api/whitelist.yaml.example"
-
-# Calculate installed size BEFORE generating control file
-INSTALLED_SIZE=$(du -sk "${BUILD_DIR}" | cut -f1)
-
-# Generate DEBIAN/control from scratch for dpkg-deb --build
-# (debian/control uses dpkg-buildpackage substitution variables like
-#  ${shlibs:Depends} that dpkg-deb cannot resolve)
-cat > "${BUILD_DIR}/DEBIAN/control" <<EOF
-Package: linux-patch-api
-Version: ${VERSION}-${RELEASE}
-Architecture: amd64
-Maintainer: Echo <echo@moon-dragon.us>
-Installed-Size: ${INSTALLED_SIZE}
-Depends: systemd, libsystemd0
-Section: admin
-Priority: optional
-Homepage: https://github.com/Draco-Lunaris/Linux-Patch-Api
-Description: Secure remote package management API for Linux systems
- Linux Patch API provides a secure, mTLS-authenticated REST API for
- remote package management operations including package installation
- and removal, security patch application, system health monitoring,
- and job queue management with WebSocket status streaming.
-EOF
-
-# Conffiles
-cat > "${BUILD_DIR}/DEBIAN/conffiles" << 'EOF'
-/etc/linux_patch_api/config.yaml
-/etc/linux_patch_api/whitelist.yaml
-EOF
-
-# Maintainer scripts
-cp "${PROJECT_ROOT}/debian/postinst" "${BUILD_DIR}/DEBIAN/postinst"
-cp "${PROJECT_ROOT}/debian/prerm" "${BUILD_DIR}/DEBIAN/prerm"
-cp "${PROJECT_ROOT}/debian/postrm" "${BUILD_DIR}/DEBIAN/postrm"
-chmod 755 "${BUILD_DIR}/DEBIAN/postinst" "${BUILD_DIR}/DEBIAN/prerm" "${BUILD_DIR}/DEBIAN/postrm"
-
-info "Package structure assembled (${INSTALLED_SIZE} KB)."
-
-# ---------------------------------------------------------------------------
-# 3. Build .deb package
-# ---------------------------------------------------------------------------
-info "Step 3/4: Building .deb package..."
-dpkg-deb --build "${BUILD_DIR}" "${PROJECT_ROOT}/${DEB_NAME}"
-info ".deb package created: ${DEB_NAME}"
-
-# ---------------------------------------------------------------------------
-# 4. Verify and summarize
-# ---------------------------------------------------------------------------
-info "Step 4/4: Verifying package..."
-dpkg-deb --info "${PROJECT_ROOT}/${DEB_NAME}"
-echo
-dpkg-deb --contents "${PROJECT_ROOT}/${DEB_NAME}" | head -20 || true
-echo
-
-PKG_SIZE=$(du -h "${PROJECT_ROOT}/${DEB_NAME}" | cut -f1)
-
-info "=== Package Build Complete ==="
-info "Package: ${DEB_NAME}"
-info "Size:   ${PKG_SIZE}"
-echo
-echo -e "${CYAN}Installation instructions:${NC}"
-echo "  1. Copy ${DEB_NAME} to the target Ubuntu 24.04 host"
-echo "  2. Install:  sudo dpkg -i ${DEB_NAME}"
-echo "  3. Or with auto-deps:  sudo apt install ./${DEB_NAME}"
-echo "  4. Configure:  /etc/linux_patch_api/config.yaml"
-echo "  5. Start:  systemctl enable --now linux-patch-api.service"
-echo
-
-# Cleanup build directory
-rm -rf "${BUILD_DIR}"
-info "Build directory cleaned up."

scripts/bump-version.sh

@@ -1,67 +0,0 @@
-#!/bin/bash
-# Bump version across all version source files for linux_patch_api
-# Usage: ./scripts/bump-version.sh <new_version> <old_version>
-# Example: ./scripts/bump-version.sh 1.1.18 1.1.17
-set -euo pipefail
-
-NEW_VERSION="${1:?Usage: bump-version.sh <new_version> <old_version>}"
-OLD_VERSION="${2:?Usage: bump-version.sh <new_version> <old_version>}"
-
-REPO_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-cd "$REPO_DIR"
-
-echo "=== Bumping version from $OLD_VERSION to $NEW_VERSION ==="
-echo ""
-
-# 1. Cargo.toml (PRIMARY)
-sed -i "s/^version = \"$OLD_VERSION\"/version = \"$NEW_VERSION\"/" Cargo.toml
-echo "[1/3] Cargo.toml: $OLD_VERSION -> $NEW_VERSION"
-
-# 2. debian/changelog - Prepend new entry using temp file
-TEMP_CHANGELOG=$(mktemp)
-echo "linux-patch-api ($NEW_VERSION) unstable; urgency=low" > "$TEMP_CHANGELOG"
-echo "" >> "$TEMP_CHANGELOG"
-echo "  * Release v$NEW_VERSION" >> "$TEMP_CHANGELOG"
-echo "" >> "$TEMP_CHANGELOG"
-echo " -- git-echo <git-echo@moon-dragon.us>  $(date -R)" >> "$TEMP_CHANGELOG"
-echo "" >> "$TEMP_CHANGELOG"
-cat debian/changelog >> "$TEMP_CHANGELOG"
-mv "$TEMP_CHANGELOG" debian/changelog
-echo "[2/3] debian/changelog: Added entry for $NEW_VERSION"
-
-# 3. install.sh - Use generic pattern to match any VERSION value
-if [ -f install.sh ]; then
-    sed -i "s/^VERSION=\".*\"/VERSION=\"$NEW_VERSION\"/" install.sh
-    echo "[3/3] install.sh: -> $NEW_VERSION"
-else
-    echo "[3/3] install.sh: Not found, skipping"
-fi
-
-# 4. linux-patch-api.spec (uses VERSION_PLACEHOLDER, no update needed)
-if grep -q 'VERSION_PLACEHOLDER' linux-patch-api.spec 2>/dev/null; then
-    echo "[4/4] linux-patch-api.spec: Uses VERSION_PLACEHOLDER (derived at build time)"
-else
-    echo "[4/4] linux-patch-api.spec: WARNING - does not use VERSION_PLACEHOLDER"
-fi
-
-echo ""
-echo "=== Version bump complete ==="
-echo ""
-echo "Verification:"
-echo "  Cargo.toml:        $(grep '^version' Cargo.toml)"
-echo "  debian/changelog:  $(head -1 debian/changelog)"
-if [ -f install.sh ]; then
-    echo "  install.sh:        $(grep '^VERSION=' install.sh)"
-fi
-
-echo ""
-echo "Stale references check:"
-grep -r "$OLD_VERSION" --include='*.toml' --include='*.sh' --include='*.json' --include='changelog' --include='control' --include='*.spec' . 2>/dev/null | grep -v 'target/' | grep -v '.git/' | grep -v 'bump-version.sh' || echo "  No stale references found"
-
-echo ""
-echo "Next steps:"
-echo "  1. Review changes: git diff"
-echo "  2. Commit: git commit -am 'chore: bump version to $NEW_VERSION'"
-echo "  3. Push: git push origin master"
-echo "  4. Tag: git tag v$NEW_VERSION && git push origin v$NEW_VERSION"
-echo "  5. Create release via Gitea API"

scripts/generate-dev-certs.sh

@@ -1,82 +0,0 @@
-#!/usr/bin/env bash
-# Generate development/test certificates for Linux Patch API.
-#
-# This script creates a self-signed CA, server certificate, and client
-# certificate suitable for local development and testing.  It is NOT
-# intended for production use.
-#
-# Usage:
-#   ./scripts/generate-dev-certs.sh [OUTPUT_DIR]
-#
-# If OUTPUT_DIR is omitted, certificates are written to configs/certs/
-# relative to the repository root.  The e2e Python test certs are also
-# regenerated under tests/e2e/certs/.
-#
-# Private keys (*.key, *.key.pem) are excluded from git via .gitignore
-# and must NEVER be committed to version control.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-
-OUTPUT_DIR="${1:-$REPO_ROOT/configs/certs}"
-E2E_DIR="$REPO_ROOT/tests/e2e/certs"
-
-DAYS_CA=3650
-DAYS_CERT=365
-
-echo "Generating development certificates..."
-echo "  Output dir: $OUTPUT_DIR"
-echo "  E2E dir:    $E2E_DIR"
-
-mkdir -p "$OUTPUT_DIR"
-mkdir -p "$E2E_DIR"
-
-# CA
-echo "[1/6] Generating CA key and certificate..."
-openssl genrsa -out "$OUTPUT_DIR/ca.key.pem" 4096 2>/dev/null
-chmod 600 "$OUTPUT_DIR/ca.key.pem"
-openssl req -x509 -new -nodes -key "$OUTPUT_DIR/ca.key.pem" -sha256 -days "$DAYS_CA" -out "$OUTPUT_DIR/ca.pem" -subj "/CN=LinuxPatchAPI Dev CA/O=Internal/C=US"
-
-# Server certificate
-echo "[2/6] Generating server key and certificate..."
-openssl genrsa -out "$OUTPUT_DIR/server.key.pem" 2048 2>/dev/null
-chmod 600 "$OUTPUT_DIR/server.key.pem"
-openssl req -new -key "$OUTPUT_DIR/server.key.pem" -out "$OUTPUT_DIR/server.csr.pem" -subj "/CN=localhost/O=Internal/C=US"
-openssl x509 -req -in "$OUTPUT_DIR/server.csr.pem" -CA "$OUTPUT_DIR/ca.pem" -CAkey "$OUTPUT_DIR/ca.key.pem" -CAcreateserial -out "$OUTPUT_DIR/server.pem" -days "$DAYS_CERT" -sha256
-
-# Client certificate
-echo "[3/6] Generating client key and certificate..."
-openssl genrsa -out "$OUTPUT_DIR/client001.key.pem" 2048 2>/dev/null
-chmod 600 "$OUTPUT_DIR/client001.key.pem"
-openssl req -new -key "$OUTPUT_DIR/client001.key.pem" -out "$OUTPUT_DIR/client001.csr.pem" -subj "/CN=client001/O=Internal/C=US"
-openssl x509 -req -in "$OUTPUT_DIR/client001.csr.pem" -CA "$OUTPUT_DIR/ca.pem" -CAkey "$OUTPUT_DIR/ca.key.pem" -CAcreateserial -out "$OUTPUT_DIR/client001.pem" -days "$DAYS_CERT" -sha256
-
-# E2E test certificates
-echo "[4/6] Generating e2e test CA certificate..."
-cp "$OUTPUT_DIR/ca.pem" "$E2E_DIR/ca.crt"
-
-echo "[5/6] Generating e2e test client certificate..."
-openssl genrsa -out "$E2E_DIR/client.key" 2048 2>/dev/null
-chmod 600 "$E2E_DIR/client.key"
-openssl req -new -key "$E2E_DIR/client.key" -out "$E2E_DIR/client.csr" -subj "/CN=e2e-test-client/O=Internal/C=US"
-openssl x509 -req -in "$E2E_DIR/client.csr" -CA "$OUTPUT_DIR/ca.pem" -CAkey "$OUTPUT_DIR/ca.key.pem" -CAcreateserial -out "$E2E_DIR/client.crt" -days "$DAYS_CERT" -sha256
-
-# Cleanup CSR files
-echo "[6/6] Cleaning up CSR files..."
-rm -f "$OUTPUT_DIR/server.csr.pem" "$OUTPUT_DIR/client001.csr.pem" "$E2E_DIR/client.csr"
-
-echo
-echo "Development certificates generated successfully."
-echo "  CA cert:         $OUTPUT_DIR/ca.pem"
-echo "  Server cert:     $OUTPUT_DIR/server.pem"
-echo "  Server key:      $OUTPUT_DIR/server.key.pem"
-echo "  Client cert:     $OUTPUT_DIR/client001.pem"
-echo "  Client key:      $OUTPUT_DIR/client001.key.pem"
-echo "  E2E CA cert:     $E2E_DIR/ca.crt"
-echo "  E2E client cert: $E2E_DIR/client.crt"
-echo "  E2E client key:  $E2E_DIR/client.key"
-echo
-echo "⚠  WARNING: These are development-only certificates. Do NOT use in production."
-echo "⚠  Private keys (*.key, *.key.pem) are excluded from git via .gitignore."

scripts/upload-release.sh

@@ -13,7 +13,7 @@ TAG_NAME="${1:?Usage: upload-release.sh <tag_name> <file_path>}"
 FILE_PATH="${2}"
 
 GITEA_API="${GITEA_API:-https://gitea-lxc.moon-dragon.us/api/v1}"
-REPO="git-echo/linux_patch_api"
+REPO="echo/linux_patch_api"
 
 if [ -z "$GITEA_TOKEN" ]; then
     echo "Error: GITEA_TOKEN environment variable not set"

src/api/handlers/jobs.rs

@@ -190,19 +190,6 @@ pub async fn rollback_job(
 
     info!(request_id = %request_id, job_id = %job_id_str, "Initiating job rollback");
 
-    // Check job queue capacity
-    if !job_manager.can_accept_job().await {
-        let response = ApiResponse::<()>::error(
-            "QUEUE_FULL",
-            "Job queue is at capacity. Please retry later.",
-            None,
-            true,
-        );
-        return HttpResponse::TooManyRequests()
-            .insert_header(("Retry-After", "60"))
-            .json(response);
-    }
-
     // Parse job ID
     let job_id = match Uuid::parse_str(&job_id_str) {
         Ok(id) => id,
@@ -334,7 +321,7 @@ pub async fn delete_job(
     }
 }
 
-/// Configure all job routes
+/// Configure routes for job endpoints
 pub fn configure_routes(cfg: &mut web::ServiceConfig) {
     cfg.service(
         web::scope("/jobs")

src/api/handlers/packages.rs

@@ -14,18 +14,29 @@ use tracing::{error, info, warn};
 use uuid::Uuid;
 
 use crate::jobs::manager::{JobManager, JobOperation, JobStatus};
-use crate::packages::{
-    validate_package_name, validate_version_string, InstallOptions, Package, PackageManagerBackend,
-    PackageSpec,
-};
+use crate::packages::{InstallOptions, Package, PackageManagerBackend, PackageSpec};
 
-/// Validate all package names and versions in a request
+/// Maximum allowed length for package names
+const MAX_PACKAGE_NAME_LENGTH: usize = 256;
+
+/// Validate package name: must not be empty and must not exceed max length
+fn validate_package_name(name: &str) -> Result<(), String> {
+    if name.is_empty() {
+        return Err("Package name cannot be empty".to_string());
+    }
+    if name.len() > MAX_PACKAGE_NAME_LENGTH {
+        return Err(format!(
+            "Package name exceeds maximum length of {} characters",
+            MAX_PACKAGE_NAME_LENGTH
+        ));
+    }
+    Ok(())
+}
+
+/// Validate all package names in a request
 fn validate_package_names(packages: &[PackageSpec]) -> Result<(), String> {
     for pkg in packages {
         validate_package_name(&pkg.name)?;
-        if let Some(version) = &pkg.version {
-            validate_version_string(version)?;
-        }
     }
     Ok(())
 }
@@ -252,19 +263,6 @@ pub async fn install_packages(
 
     info!(request_id = %request_id, packages = ?package_names, "Installing packages");
 
-    // Check job queue capacity
-    if !job_manager.can_accept_job().await {
-        let response = ApiResponse::<()>::error(
-            "QUEUE_FULL",
-            "Job queue is at capacity. Please retry later.",
-            None,
-            true,
-        );
-        return HttpResponse::TooManyRequests()
-            .insert_header(("Retry-After", "60"))
-            .json(response);
-    }
-
     // Create async job
     match job_manager
         .create_job(JobOperation::Install, package_names.clone())
@@ -350,19 +348,6 @@ pub async fn update_package(
 
     info!(request_id = %request_id, package = %package_name, "Updating package");
 
-    // Check job queue capacity
-    if !job_manager.can_accept_job().await {
-        let response = ApiResponse::<()>::error(
-            "QUEUE_FULL",
-            "Job queue is at capacity. Please retry later.",
-            None,
-            true,
-        );
-        return HttpResponse::TooManyRequests()
-            .insert_header(("Retry-After", "60"))
-            .json(response);
-    }
-
     // Create async job
     match job_manager
         .create_job(JobOperation::Update, vec![package_name.clone()])
@@ -446,20 +431,6 @@ pub async fn remove_package(
     }
 
     info!(request_id = %request_id, package = %package_name, "Removing package");
-
-    // Check job queue capacity
-    if !job_manager.can_accept_job().await {
-        let response = ApiResponse::<()>::error(
-            "QUEUE_FULL",
-            "Job queue is at capacity. Please retry later.",
-            None,
-            true,
-        );
-        return HttpResponse::TooManyRequests()
-            .insert_header(("Retry-After", "60"))
-            .json(response);
-    }
-
     match job_manager
         .create_job(JobOperation::Remove, vec![package_name.clone()])
         .await
@@ -524,7 +495,7 @@ pub async fn remove_package(
     }
 }
 
-/// Configure all package routes
+/// Configure routes for package endpoints
 pub fn configure_routes(cfg: &mut web::ServiceConfig) {
     cfg.service(
         web::scope("/packages")

src/api/handlers/patches.rs

@@ -11,7 +11,7 @@ use tracing::{error, info};
 use uuid::Uuid;
 
 use crate::jobs::manager::{JobManager, JobOperation, JobStatus};
-use crate::packages::{validate_package_name, PackageManagerBackend};
+use crate::packages::PackageManagerBackend;
 
 use super::packages::{ApiResponse, JobResponseData};
 
@@ -81,23 +81,12 @@ pub async fn apply_patches(
     body: web::Json<PatchApplyRequest>,
     backend: web::Data<Box<dyn PackageManagerBackend>>,
     job_manager: web::Data<JobManager>,
-    cache_state: web::Data<crate::packages::cache::PackageCacheState>,
     _req: HttpRequest,
 ) -> impl Responder {
     let request_id = Uuid::new_v4().to_string();
     let _timestamp = Utc::now().to_rfc3339();
     let packages_count = body.packages.as_ref().map(|p| p.len()).unwrap_or(0);
 
-    // SECURITY: Validate all package names in the request to prevent argument injection
-    if let Some(ref pkgs) = body.packages {
-        for pkg in pkgs {
-            if let Err(e) = validate_package_name(pkg) {
-                let response = ApiResponse::<()>::error("VALIDATION_ERROR", &e, None, false);
-                return HttpResponse::BadRequest().json(response);
-            }
-        }
-    }
-
     info!(
         request_id = %request_id,
         packages = ?body.packages,
@@ -105,19 +94,6 @@ pub async fn apply_patches(
         "Applying patches"
     );
 
-    // Check job queue capacity
-    if !job_manager.can_accept_job().await {
-        let response = ApiResponse::<()>::error(
-            "QUEUE_FULL",
-            "Job queue is at capacity. Please retry later.",
-            None,
-            true,
-        );
-        return HttpResponse::TooManyRequests()
-            .insert_header(("Retry-After", "60"))
-            .json(response);
-    }
-
     // Create async job
     let package_list = body.packages.clone().unwrap_or_default();
     match job_manager
@@ -128,7 +104,6 @@ pub async fn apply_patches(
             // Spawn background task to execute the patching
             let backend_clone = backend.clone();
             let job_manager_clone = job_manager.clone();
-            let cache_state_clone = cache_state.clone();
             let request = body.clone();
 
             tokio::spawn(async move {
@@ -147,52 +122,8 @@ pub async fn apply_patches(
                     .add_job_log(&job_id_clone, "Job started".to_string())
                     .await;
 
-                // MANDATORY: Refresh package cache before applying patches
-                let _ = job_manager_clone
-                    .update_job(
-                        &job_id_clone,
-                        JobStatus::Running,
-                        Some(0),
-                        Some("Refreshing package index...".to_string()),
-                    )
-                    .await;
-                let _ = job_manager_clone
-                    .add_job_log(&job_id_clone, "Refreshing package cache...".to_string())
-                    .await;
-
-                match backend_clone.refresh_package_cache(&cache_state_clone) {
-                    Ok(_) => {
-                        let _ = job_manager_clone
-                            .add_job_log(
-                                &job_id_clone,
-                                "Package cache refreshed successfully".to_string(),
-                            )
-                            .await;
-                        let _ = job_manager_clone
-                            .update_job(
-                                &job_id_clone,
-                                JobStatus::Running,
-                                Some(10),
-                                Some("Cache refreshed, applying patches...".to_string()),
-                            )
-                            .await;
-                    }
-                    Err(e) => {
-                        let err_msg = format!("Package cache refresh failed: {}", e);
-                        error!(job_id = %job_id_clone, error = %e, "Cache refresh failed");
-                        let _ = job_manager_clone
-                            .add_job_log(&job_id_clone, err_msg.clone())
-                            .await;
-                        let _ = job_manager_clone.fail_job(&job_id_clone, err_msg).await;
-                        return; // Exit the spawned task
-                    }
-                }
-
-                // Execute patching with 404 retry
-                let packages_ref = request.packages.as_deref();
-                let apply_result = backend_clone.apply_patches(packages_ref);
-
-                match apply_result {
+                // Execute patching
+                match backend_clone.apply_patches(request.packages.as_deref()) {
                     Ok(_) => {
                         let _ = job_manager_clone.complete_job(&job_id_clone).await;
                         info!(job_id = %job_id_clone, "Patch application completed");
@@ -226,83 +157,7 @@ pub async fn apply_patches(
                             }
                         }
                     }
-                    Err(e) if crate::packages::cache::is_fetch_error(&e) => {
-                        // 404/fetch error: refresh cache and retry once
-                        info!(job_id = %job_id_clone, "Patch apply failed with fetch error, refreshing cache and retrying");
-                        let _ = job_manager_clone
-                            .add_job_log(
-                                &job_id_clone,
-                                "Fetch error detected, refreshing cache and retrying..."
-                                    .to_string(),
-                            )
-                            .await;
-
-                        match backend_clone.refresh_package_cache(&cache_state_clone) {
-                            Ok(_) => {
-                                let _ = job_manager_clone
-                                    .add_job_log(
-                                        &job_id_clone,
-                                        "Cache refreshed, retrying patch apply...".to_string(),
-                                    )
-                                    .await;
-                            }
-                            Err(refresh_err) => {
-                                let err_msg =
-                                    format!("Cache refresh on retry failed: {}", refresh_err);
-                                let _ = job_manager_clone.fail_job(&job_id_clone, err_msg).await;
-                                error!(job_id = %job_id_clone, error = %refresh_err, "Cache refresh on retry failed");
-                                return;
-                            }
-                        }
-
-                        // Retry the apply
-                        match backend_clone.apply_patches(packages_ref) {
-                            Ok(_) => {
-                                let _ = job_manager_clone.complete_job(&job_id_clone).await;
-                                info!(job_id = %job_id_clone, "Patch application completed after retry");
-
-                                // Handle reboot if requested
-                                if request.reboot {
-                                    let _ = job_manager_clone
-                                        .add_job_log(
-                                            &job_id_clone,
-                                            format!(
-                                                "Reboot scheduled in {} seconds",
-                                                request.reboot_delay_seconds
-                                            ),
-                                        )
-                                        .await;
-                                    match backend_clone.reboot_system(request.reboot_delay_seconds)
-                                    {
-                                        Ok(_) => {
-                                            let _ = job_manager_clone
-                                                .add_job_log(
-                                                    &job_id_clone,
-                                                    "Reboot command executed".to_string(),
-                                                )
-                                                .await;
-                                        }
-                                        Err(e) => {
-                                            let _ = job_manager_clone
-                                                .add_job_log(
-                                                    &job_id_clone,
-                                                    format!("Reboot failed: {}", e),
-                                                )
-                                                .await;
-                                        }
-                                    }
-                                }
-                            }
-                            Err(retry_err) => {
-                                let _ = job_manager_clone
-                                    .fail_job(&job_id_clone, retry_err.to_string())
-                                    .await;
-                                error!(job_id = %job_id_clone, error = %retry_err, "Patch application failed after retry");
-                            }
-                        }
-                    }
                     Err(e) => {
-                        // Non-fetch error: fail immediately
                         let _ = job_manager_clone
                             .fail_job(&job_id_clone, e.to_string())
                             .await;
@@ -334,7 +189,7 @@ pub async fn apply_patches(
     }
 }
 
-/// Configure all patch routes
+/// Configure routes for patch endpoints
 pub fn configure_routes(cfg: &mut web::ServiceConfig) {
     cfg.service(
         web::scope("/patches")

src/api/handlers/system.rs

@@ -12,7 +12,6 @@ use tracing::{error, info, warn};
 use uuid::Uuid;
 
 use super::packages::ApiResponse;
-use crate::auth::crl::{CrlStatus, SharedCrlState};
 use crate::jobs::manager::{JobManager, JobOperation, JobStatus};
 use crate::packages::PackageManagerBackend;
 
@@ -43,13 +42,9 @@ pub struct SystemInfoData {
 /// Health check response data
 #[derive(Debug, Serialize)]
 pub struct HealthData {
-    pub status: String, // "healthy" or "degraded"
+    pub status: String,
     pub uptime_seconds: u64,
     pub version: String,
-    pub last_cache_update: Option<String>, // RFC3339 timestamp
-    pub cache_status: String,              // "fresh", "stale", "unknown", "failed"
-    pub crl_status: Option<String>,        // "valid", "expired", "missing", "invalid", "degraded"
-    pub crl_age_seconds: Option<u64>,      // age of on-disk CRL file
 }
 
 /// Service status response data
@@ -113,12 +108,7 @@ pub async fn get_system_info(
 }
 
 /// Health check endpoint
-pub async fn health_check(
-    backend: web::Data<Box<dyn PackageManagerBackend>>,
-    cache_state: web::Data<crate::packages::cache::PackageCacheState>,
-    crl_state: web::Data<SharedCrlState>,
-    _req: HttpRequest,
-) -> impl Responder {
+pub async fn health_check(_req: HttpRequest) -> impl Responder {
     let _request_id = Uuid::new_v4().to_string();
     let _timestamp = Utc::now().to_rfc3339();
 
@@ -136,60 +126,10 @@ pub async fn health_check(
 
     let version = env!("CARGO_PKG_VERSION").to_string();
 
-    // Check cache status and refresh if stale
-    let cache_status_val = cache_state.status();
-    let (mut status, cache_status_str, last_cache_update) = if cache_state.is_stale() {
-        match backend.refresh_package_cache(&cache_state) {
-            Ok(_) => {
-                let updated = cache_state.status();
-                (
-                    "healthy".to_string(),
-                    "fresh".to_string(),
-                    updated.last_update.map(|dt| dt.to_rfc3339()),
-                )
-            }
-            Err(e) => {
-                error!("Health check cache refresh failed: {}", e);
-                (
-                    "degraded".to_string(),
-                    "failed".to_string(),
-                    cache_status_val.last_update.map(|dt| dt.to_rfc3339()),
-                )
-            }
-        }
-    } else {
-        (
-            "healthy".to_string(),
-            "fresh".to_string(),
-            cache_status_val.last_update.map(|dt| dt.to_rfc3339()),
-        )
-    };
-
-    // CRL status from shared state
-    let crl = crl_state.load();
-    let crl_status_str = match crl.status {
-        CrlStatus::Valid
-        | CrlStatus::Expired
-        | CrlStatus::Missing
-        | CrlStatus::Invalid
-        | CrlStatus::Degraded => {
-            // Downgrade overall health if CRL is invalid
-            if crl.status == CrlStatus::Invalid {
-                status = "degraded".to_string();
-            }
-            crl.status.to_string()
-        }
-    };
-    let crl_age = crl.crl_age_seconds();
-
     let response = ApiResponse::success(HealthData {
-        status,
+        status: "healthy".to_string(),
         uptime_seconds,
         version,
-        last_cache_update,
-        cache_status: cache_status_str,
-        crl_status: Some(crl_status_str),
-        crl_age_seconds: crl_age,
     });
 
     HttpResponse::Ok().json(response)
@@ -229,19 +169,6 @@ pub async fn reboot_system(
         }
     }
 
-    // Check job queue capacity
-    if !job_manager.can_accept_job().await {
-        let response = ApiResponse::<()>::error(
-            "QUEUE_FULL",
-            "Job queue is at capacity. Please retry later.",
-            None,
-            true,
-        );
-        return HttpResponse::TooManyRequests()
-            .insert_header(("Retry-After", "60"))
-            .json(response);
-    }
-
     // Create async job for reboot
     match job_manager.create_job(JobOperation::Reboot, vec![]).await {
         Ok(job_id) => {
@@ -390,8 +317,6 @@ pub fn configure_routes(cfg: &mut web::ServiceConfig) {
             .route("/services/{name}", web::get().to(get_service_status)),
     )
     .route("/health", web::get().to(health_check));
-    // Note: health_check receives backend and cache_state via app_data injection
-    // They are registered in routes.rs and main.rs as web::Data
 }
 
 #[cfg(test)]
@@ -420,15 +345,9 @@ mod tests {
             status: "healthy".to_string(),
             uptime_seconds: 12345,
             version: "0.1.0".to_string(),
-            last_cache_update: Some("2026-05-27T14:00:00+00:00".to_string()),
-            cache_status: "fresh".to_string(),
-            crl_status: Some("valid".to_string()),
-            crl_age_seconds: Some(3600),
         };
         let json = serde_json::to_string(&health).unwrap();
         assert!(json.contains("healthy"));
         assert!(json.contains("12345"));
-        assert!(json.contains("fresh"));
-        assert!(json.contains("last_cache_update"));
     }
 }

src/api/mod.rs

@@ -8,7 +8,6 @@
 //! - WebSocket endpoint for real-time job status streaming
 
 pub mod handlers;
-pub mod rate_limit;
 pub mod routes;
 
 // Re-export handlers for convenience

src/api/rate_limit.rs

@@ -1,209 +0,0 @@
-//! Rate Limiting Middleware
-//!
-//! Custom Actix-web middleware that provides per-IP rate limiting with two tiers:
-//! - **Destructive tier**: POST/PUT/DELETE methods (20 req/min, burst 10 by default)
-//! - **Read tier**: GET methods (120 req/min, burst 30 by default)
-//! - **Health exempt**: /health, /api/v1/system/info bypass rate limiting entirely
-
-use actix_governor::governor::clock::{Clock, DefaultClock};
-use actix_governor::governor::middleware::NoOpMiddleware;
-use actix_governor::governor::state::keyed::DefaultKeyedStateStore;
-use actix_governor::governor::{Quota, RateLimiter};
-use actix_web::body::BoxBody;
-use actix_web::dev::{forward_ready, Service, ServiceRequest, ServiceResponse, Transform};
-use actix_web::http::Method;
-use actix_web::{HttpResponse, ResponseError};
-use std::future::{ready, Ready};
-use std::net::IpAddr;
-use std::num::NonZeroU32;
-use std::sync::Arc;
-use tracing::info;
-
-use crate::config::loader::RateLimitConfig;
-
-/// Paths exempt from rate limiting
-const EXEMPT_PATHS: &[&str] = &["/health", "/api/v1/system/info"];
-
-/// Rate limiting middleware factory
-pub struct RateLimitMiddleware {
-    config: RateLimitConfig,
-}
-
-impl RateLimitMiddleware {
-    pub fn new(config: RateLimitConfig) -> Self {
-        Self { config }
-    }
-}
-
-/// Error returned when rate limit is exceeded
-#[derive(Debug)]
-pub struct RateLimitError {
-    retry_after_secs: u64,
-}
-
-impl std::fmt::Display for RateLimitError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(
-            f,
-            "Rate limit exceeded. Retry after {} seconds.",
-            self.retry_after_secs
-        )
-    }
-}
-
-impl ResponseError for RateLimitError {
-    fn status_code(&self) -> actix_web::http::StatusCode {
-        actix_web::http::StatusCode::TOO_MANY_REQUESTS
-    }
-
-    fn error_response(&self) -> HttpResponse {
-        HttpResponse::TooManyRequests()
-            .insert_header(("Retry-After", self.retry_after_secs.to_string()))
-            .content_type("text/plain; charset=utf-8")
-            .body(self.to_string())
-    }
-}
-
-/// Type alias for per-IP rate limiter
-pub type KeyedRateLimiter =
-    RateLimiter<IpAddr, DefaultKeyedStateStore<IpAddr>, DefaultClock, NoOpMiddleware>;
-
-/// Shared rate limiter state
-#[derive(Clone)]
-pub struct RateLimiters {
-    /// Rate limiter for destructive operations (POST/PUT/DELETE)
-    destructive: Arc<KeyedRateLimiter>,
-    /// Rate limiter for read operations (GET)
-    read: Arc<KeyedRateLimiter>,
-    /// Whether rate limiting is enabled
-    enabled: bool,
-}
-
-impl RateLimiters {
-    /// Build rate limiters from configuration
-    pub fn new(config: &RateLimitConfig) -> Self {
-        let destructive_quota =
-            Quota::per_minute(NonZeroU32::new(config.destructive_per_minute).unwrap())
-                .allow_burst(NonZeroU32::new(config.destructive_burst).unwrap());
-
-        let read_quota = Quota::per_minute(NonZeroU32::new(config.read_per_minute).unwrap())
-            .allow_burst(NonZeroU32::new(config.read_burst).unwrap());
-
-        let destructive = Arc::new(KeyedRateLimiter::keyed(destructive_quota));
-        let read = Arc::new(KeyedRateLimiter::keyed(read_quota));
-
-        info!(
-            enabled = config.enabled,
-            destructive_per_min = config.destructive_per_minute,
-            destructive_burst = config.destructive_burst,
-            read_per_min = config.read_per_minute,
-            read_burst = config.read_burst,
-            "Rate limiters configured"
-        );
-
-        Self {
-            destructive,
-            read,
-            enabled: config.enabled,
-        }
-    }
-
-    /// Check if a request should be rate limited
-    /// Returns Ok(()) if the request is allowed, Err(RateLimitError) if rate limited
-    pub fn check(
-        &self,
-        method: &Method,
-        path: &str,
-        peer_ip: IpAddr,
-    ) -> Result<(), RateLimitError> {
-        if !self.enabled {
-            return Ok(());
-        }
-
-        // Exempt paths bypass rate limiting entirely
-        if EXEMPT_PATHS.contains(&path) {
-            return Ok(());
-        }
-
-        let limiter = match *method {
-            Method::POST | Method::PUT | Method::DELETE => &self.destructive,
-            Method::GET => &self.read,
-            _ => &self.read, // Default to read tier for other methods
-        };
-
-        match limiter.check_key(&peer_ip) {
-            Ok(()) => Ok(()),
-            Err(negative) => {
-                let retry_after = negative
-                    .wait_time_from(DefaultClock::default().now())
-                    .as_secs();
-                Err(RateLimitError {
-                    retry_after_secs: retry_after.max(1),
-                })
-            }
-        }
-    }
-}
-
-impl<S> Transform<S, ServiceRequest> for RateLimitMiddleware
-where
-    S: Service<ServiceRequest, Response = ServiceResponse<BoxBody>, Error = actix_web::Error>,
-    S::Future: 'static,
-{
-    type Response = ServiceResponse<BoxBody>;
-    type Error = actix_web::Error;
-    type Transform = RateLimitService<S>;
-    type InitError = ();
-    type Future = Ready<Result<Self::Transform, Self::InitError>>;
-
-    fn new_transform(&self, service: S) -> Self::Future {
-        ready(Ok(RateLimitService {
-            service,
-            limiters: RateLimiters::new(&self.config),
-        }))
-    }
-}
-
-/// Rate limiting service wrapper
-pub struct RateLimitService<S> {
-    service: S,
-    limiters: RateLimiters,
-}
-
-impl<S> Service<ServiceRequest> for RateLimitService<S>
-where
-    S: Service<ServiceRequest, Response = ServiceResponse<BoxBody>, Error = actix_web::Error>,
-    S::Future: 'static,
-{
-    type Response = ServiceResponse<BoxBody>;
-    type Error = actix_web::Error;
-    type Future =
-        std::pin::Pin<Box<dyn std::future::Future<Output = Result<Self::Response, Self::Error>>>>;
-
-    forward_ready!(service);
-
-    fn call(&self, req: ServiceRequest) -> Self::Future {
-        // Extract peer IP
-        let peer_ip = req
-            .connection_info()
-            .peer_addr()
-            .and_then(|addr| addr.parse::<IpAddr>().ok());
-
-        // Check rate limiting
-        if let Some(ip) = peer_ip {
-            let method = req.method().clone();
-            let path = req.path().to_string();
-
-            if let Err(e) = self.limiters.check(&method, &path, ip) {
-                // Rate limited - return 429 response
-                let (http_req, _) = req.into_parts();
-                let response = e.error_response();
-                let srv_resp = ServiceResponse::new(http_req, response);
-                return Box::pin(ready(Ok(srv_resp)));
-            }
-        }
-
-        // Not rate limited - pass through to the inner service
-        Box::pin(self.service.call(req))
-    }
-}

src/api/routes.rs

@@ -1,17 +1,11 @@
 //! API Routes Configuration
 //!
 //! Aggregates all endpoint routes and configures the Actix-web application.
-//! Rate limiting is applied at the App level in main.rs using actix-governor
-//! with method-based filtering:
-//! - **Read tier** (120 req/min, burst 30): GET methods
-//! - **Destructive tier** (20 req/min, burst 10): POST/PUT/DELETE methods
-//! - **Health exempt**: /health, /api/v1/system/info (health-exempt routes)
 
 use actix_web::{web, HttpResponse};
 use tracing::info;
 
 use crate::jobs::manager::JobManager;
-use crate::packages::cache::PackageCacheState;
 
 use super::handlers::{jobs, packages, patches, system, websocket};
 
@@ -22,37 +16,32 @@ async fn method_not_allowed() -> HttpResponse {
         .insert_header(("Allow", "GET, POST, PUT, DELETE"))
         .finish()
 }
-
 /// Configure all API routes for the application
 pub fn configure_api_routes(
     cfg: &mut web::ServiceConfig,
     job_manager: web::Data<JobManager>,
     backend: web::Data<Box<dyn crate::packages::PackageManagerBackend>>,
-    cache_state: web::Data<PackageCacheState>,
 ) {
     info!("Configuring API v1 routes");
 
-    // Health-exempt endpoint: /api/v1/system/info is registered separately
-    // so it can bypass rate limiting applied at the App level
-    cfg.service(web::resource("/api/v1/system/info").route(web::get().to(system::get_system_info)));
-
-    cfg.app_data(job_manager)
-        .app_data(backend)
-        .app_data(cache_state)
-        .service(
-            web::scope("/api/v1")
-                // VULN-005: Default handler for unsupported methods returns 405 instead of 404
-                .default_service(web::route().to(method_not_allowed))
-                .configure(packages::configure_routes)
-                .configure(patches::configure_routes)
-                .configure(system::configure_routes)
-                .configure(jobs::configure_routes)
-                .configure(websocket::configure_routes),
-        );
+    cfg.app_data(job_manager).app_data(backend).service(
+        web::scope("/api/v1")
+            // VULN-005: Default handler for unsupported methods returns 405 instead of 404
+            .default_service(web::route().to(method_not_allowed))
+            // Package Management Endpoints
+            .configure(packages::configure_routes)
+            // Patch Management Endpoints
+            .configure(patches::configure_routes)
+            // System Management Endpoints
+            .configure(system::configure_routes)
+            // Job Management Endpoints
+            .configure(jobs::configure_routes)
+            // WebSocket Endpoint
+            .configure(websocket::configure_routes),
+    );
 }
 
 /// Health check route (outside API scope for load balancer checks)
-/// Note: backend and cache_state are injected via app_data registered in main.rs
 pub fn configure_health_route(cfg: &mut web::ServiceConfig) {
     cfg.route("/health", web::get().to(system::health_check));
 }

src/auth/crl.rs

@@ -1,766 +0,0 @@
-//! CRL (Certificate Revocation List) Loading, Parsing, and Refresh
-//!
-//! Provides CRL consumption for agent-side mTLS revocation enforcement.
-//! Parses CRL from disk, verifies signature against pinned CA,
-//! builds an in-memory revoked-serial index, and refreshes from the manager.
-
-use arc_swap::ArcSwap;
-use std::collections::HashSet;
-use std::fs;
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
-use std::time::{Duration, SystemTime};
-use tracing::{debug, error, info, warn};
-use x509_parser::prelude::FromDer;
-use x509_parser::revocation_list::CertificateRevocationList;
-
-/// CRL status reported via the health endpoint.
-#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize)]
-#[serde(rename_all = "snake_case")]
-pub enum CrlStatus {
-    /// CRL loaded, signature valid, not expired.
-    Valid,
-    /// CRL loaded and signature valid, but nextUpdate has passed.
-    Expired,
-    /// No CRL file found on disk.
-    Missing,
-    /// CRL exists but failed signature verification -- fail-closed.
-    Invalid,
-    /// CRL fetch or load failed; operating in degraded (WebPKI-only) mode.
-    Degraded,
-}
-
-impl std::fmt::Display for CrlStatus {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            CrlStatus::Valid => write!(f, "valid"),
-            CrlStatus::Expired => write!(f, "expired"),
-            CrlStatus::Missing => write!(f, "missing"),
-            CrlStatus::Invalid => write!(f, "invalid"),
-            CrlStatus::Degraded => write!(f, "degraded"),
-        }
-    }
-}
-
-/// In-memory CRL state, atomically swapped on refresh via ArcSwap.
-#[derive(Debug, Clone)]
-pub struct CrlState {
-    /// Hex-encoded serial numbers of revoked certificates (lowercase, no prefix).
-    pub revoked_serials: HashSet<String>,
-    /// CRL status for health reporting.
-    pub status: CrlStatus,
-    /// Time the CRL file was last modified (used to compute age).
-    pub crl_mtime: Option<SystemTime>,
-    /// When this CrlState was loaded into memory.
-    pub loaded_at: SystemTime,
-}
-
-impl Default for CrlState {
-    fn default() -> Self {
-        Self {
-            revoked_serials: HashSet::new(),
-            status: CrlStatus::Missing,
-            crl_mtime: None,
-            loaded_at: SystemTime::now(),
-        }
-    }
-}
-
-impl CrlState {
-    /// Check whether a certificate serial is revoked.
-    pub fn is_revoked(&self, serial_hex: &str) -> bool {
-        self.revoked_serials.contains(serial_hex)
-    }
-
-    /// Age of the on-disk CRL file in seconds.
-    pub fn crl_age_seconds(&self) -> Option<u64> {
-        self.crl_mtime.and_then(|mtime| {
-            SystemTime::now()
-                .duration_since(mtime)
-                .ok()
-                .map(|d| d.as_secs())
-        })
-    }
-}
-
-/// Shared, atomically-swappable CRL handle.
-pub type SharedCrlState = Arc<ArcSwap<CrlState>>;
-
-/// Create a new shared CRL state (initially missing).
-pub fn new_shared_state() -> SharedCrlState {
-    Arc::new(ArcSwap::from_pointee(CrlState::default()))
-}
-
-/// Extract the hex-encoded serial from a DER-encoded X.509 certificate.
-/// Returns lowercase hex with no separators or prefix.
-pub fn cert_serial_hex(cert_der: &[u8]) -> Option<String> {
-    x509_parser::parse_x509_certificate(cert_der)
-        .ok()
-        .map(|(_, cert)| format_serial_hex(&cert.serial))
-}
-
-/// Format a BigUint serial as lowercase hex string (no 0x prefix, no colons).
-fn format_serial_hex(serial: &x509_parser::num_bigint::BigUint) -> String {
-    let bytes = serial.to_bytes_be();
-    bytes.iter().map(|b| format!("{:02x}", b)).collect()
-}
-
-/// Load and validate a CRL from disk.
-///
-/// Steps:
-/// 1. Read PEM file
-/// 2. Parse CRL with x509-parser
-/// 3. Verify CRL signature against the CA certificate
-/// 4. Build in-memory revoked-serial index
-/// 5. Check nextUpdate for staleness
-///
-/// Returns the new CrlState. On signature failure, returns CrlStatus::Invalid (fail-closed).
-/// On missing file, returns CrlStatus::Missing. On parse error, returns CrlStatus::Degraded.
-pub fn load_crl(crl_path: &Path, ca_cert_der: &[u8]) -> CrlState {
-    let crl_bytes = match fs::read(crl_path) {
-        Ok(b) => b,
-        Err(e) => {
-            if e.kind() == std::io::ErrorKind::NotFound {
-                info!(path = %crl_path.display(), "No CRL file found -- operating in WebPKI-only mode");
-                return CrlState {
-                    status: CrlStatus::Missing,
-                    crl_mtime: None,
-                    loaded_at: SystemTime::now(),
-                    revoked_serials: HashSet::new(),
-                };
-            }
-            warn!(path = %crl_path.display(), error = %e, "Failed to read CRL file");
-            return CrlState {
-                status: CrlStatus::Degraded,
-                crl_mtime: None,
-                loaded_at: SystemTime::now(),
-                revoked_serials: HashSet::new(),
-            };
-        }
-    };
-
-    let crl_mtime = fs::metadata(crl_path).ok().and_then(|m| m.modified().ok());
-
-    // Parse PEM: extract the DER block between BEGIN/END X509 CRL markers
-    let crl_der = match extract_pem_crl_der(&crl_bytes) {
-        Some(der) => der,
-        None => {
-            // Try parsing as raw DER
-            crl_bytes.clone()
-        }
-    };
-
-    // Parse CRL
-    let (_, crl) = match CertificateRevocationList::from_der(&crl_der) {
-        Ok(r) => r,
-        Err(e) => {
-            error!(error = %e, "Failed to parse CRL -- marking as invalid");
-            return CrlState {
-                status: CrlStatus::Invalid,
-                crl_mtime,
-                loaded_at: SystemTime::now(),
-                revoked_serials: HashSet::new(),
-            };
-        }
-    };
-
-    // Verify CRL signature against CA
-    // Extract DER from PEM if the CA cert is PEM-encoded
-    let ca_der = match extract_pem_cert_der(ca_cert_der) {
-        Some(der) => der,
-        None => {
-            // Not PEM — assume it's already DER
-            ca_cert_der.to_vec()
-        }
-    };
-
-    let (_, ca_cert) = match x509_parser::parse_x509_certificate(&ca_der) {
-        Ok(r) => r,
-        Err(e) => {
-            error!(error = %e, "Failed to parse CA cert for CRL signature verification");
-            return CrlState {
-                status: CrlStatus::Invalid,
-                crl_mtime,
-                loaded_at: SystemTime::now(),
-                revoked_serials: HashSet::new(),
-            };
-        }
-    };
-
-    let verify_result = crl.verify_signature(ca_cert.public_key());
-
-    if let Err(e) = verify_result {
-        error!(error = %e, "CRL signature verification FAILED -- refusing to use this CRL (fail-closed)");
-        return CrlState {
-            status: CrlStatus::Invalid,
-            crl_mtime,
-            loaded_at: SystemTime::now(),
-            revoked_serials: HashSet::new(),
-        };
-    }
-
-    // Build revoked serial index
-    let revoked_serials: HashSet<String> = crl
-        .iter_revoked_certificates()
-        .map(|revoked| format_serial_hex(revoked.serial()))
-        .collect();
-
-    info!(
-        revoked_count = revoked_serials.len(),
-        "CRL loaded and signature verified"
-    );
-
-    // Check nextUpdate for staleness
-    let now = x509_parser::time::ASN1Time::now();
-    let is_expired = crl.next_update().map(|next| next < now).unwrap_or(false);
-
-    let status = if is_expired {
-        warn!("CRL nextUpdate has passed -- CRL is stale, continuing with degraded status");
-        CrlStatus::Expired
-    } else {
-        CrlStatus::Valid
-    };
-
-    CrlState {
-        revoked_serials,
-        status,
-        crl_mtime,
-        loaded_at: SystemTime::now(),
-    }
-}
-
-/// Extract DER bytes from a PEM-encoded certificate.
-/// Looks for `-----BEGIN CERTIFICATE-----` / `-----END CERTIFICATE-----` markers
-/// and base64-decodes the content between them.
-pub fn extract_pem_cert_der(pem_bytes: &[u8]) -> Option<Vec<u8>> {
-    let pem_str = String::from_utf8_lossy(pem_bytes);
-    let begin_marker = "-----BEGIN CERTIFICATE-----";
-    let end_marker = "-----END CERTIFICATE-----";
-
-    let begin_idx = pem_str.find(begin_marker)?;
-    let after_begin = begin_idx + begin_marker.len();
-    let end_idx = pem_str[after_begin..].find(end_marker)?;
-    // Strip all whitespace (including newlines) from the base64 block
-    // before decoding, since PEM format wraps lines at 64 characters.
-    let b64_block: String = pem_str[after_begin..after_begin + end_idx]
-        .split_whitespace()
-        .collect();
-
-    use base64::Engine;
-    base64::engine::general_purpose::STANDARD
-        .decode(&b64_block)
-        .ok()
-}
-
-/// Extract DER bytes from a PEM-encoded CRL.
-/// Looks for `-----BEGIN X509 CRL-----` / `-----END X509 CRL-----` blocks.
-fn extract_pem_crl_der(pem_bytes: &[u8]) -> Option<Vec<u8>> {
-    let pem_str = String::from_utf8_lossy(pem_bytes);
-    let begin_marker = "-----BEGIN X509 CRL-----";
-    let end_marker = "-----END X509 CRL-----";
-
-    let begin_idx = pem_str.find(begin_marker)?;
-    let after_begin = begin_idx + begin_marker.len();
-    let end_idx = pem_str[after_begin..].find(end_marker)?;
-    // Strip all whitespace (including newlines) from the base64 block
-    // before decoding, since PEM format wraps lines at 64 characters.
-    let b64_block: String = pem_str[after_begin..after_begin + end_idx]
-        .split_whitespace()
-        .collect();
-
-    use base64::Engine;
-    base64::engine::general_purpose::STANDARD
-        .decode(&b64_block)
-        .ok()
-}
-
-/// Fetch the CRL from the manager, verify, persist, and update in-memory state.
-///
-/// The CRL endpoint is public (no auth): GET {manager_url}/api/v1/pki/crl.pem
-pub async fn refresh_crl(
-    manager_url: &str,
-    crl_path: &Path,
-    ca_cert_der: &[u8],
-    shared_state: &SharedCrlState,
-) -> Result<(), String> {
-    let crl_url = format!("{}/api/v1/pki/crl.pem", manager_url.trim_end_matches('/'));
-
-    info!(url = %crl_url, "Fetching CRL from manager");
-
-    let response = reqwest::get(&crl_url)
-        .await
-        .map_err(|e| format!("CRL fetch request failed: {}", e))?;
-
-    if !response.status().is_success() {
-        let status = response.status();
-        return Err(format!("CRL fetch returned HTTP {}", status));
-    }
-
-    let crl_pem = response
-        .text()
-        .await
-        .map_err(|e| format!("Failed to read CRL response body: {}", e))?;
-
-    // Persist to disk (atomic write via temp file)
-    let parent = crl_path.parent().unwrap_or(Path::new("/tmp"));
-    if !parent.exists() {
-        fs::create_dir_all(parent).map_err(|e| format!("Failed to create CRL directory: {}", e))?;
-    }
-
-    let tmp_path = crl_path.with_extension("pem.tmp");
-    fs::write(&tmp_path, &crl_pem).map_err(|e| format!("Failed to write temp CRL file: {}", e))?;
-
-    fs::rename(&tmp_path, crl_path)
-        .map_err(|e| format!("Failed to rename temp CRL file: {}", e))?;
-
-    debug!(path = %crl_path.display(), "CRL persisted to disk");
-
-    // Load the freshly written CRL to get a validated CrlState
-    let new_state = load_crl(crl_path, ca_cert_der);
-
-    if new_state.status == CrlStatus::Invalid {
-        return Err("CRL signature verification failed after fetch".to_string());
-    }
-
-    info!(
-        status = %new_state.status,
-        revoked = new_state.revoked_serials.len(),
-        "CRL refreshed successfully"
-    );
-
-    // Atomically swap the in-memory state
-    shared_state.store(Arc::new(new_state));
-
-    Ok(())
-}
-
-/// Spawn the CRL refresh background task.
-///
-/// Runs on a 24-hour interval. On failure, logs a warning and continues
-/// serving with the existing (possibly stale) CRL.
-pub fn spawn_crl_refresh_task(
-    manager_url: String,
-    crl_path: PathBuf,
-    ca_cert_der: Vec<u8>,
-    shared_state: SharedCrlState,
-) {
-    let interval = Duration::from_secs(24 * 60 * 60); // 24 hours
-
-    tokio::spawn(async move {
-        // Initial small delay to let the server finish binding
-        tokio::time::sleep(Duration::from_secs(30)).await;
-
-        loop {
-            let result = refresh_crl(&manager_url, &crl_path, &ca_cert_der, &shared_state).await;
-
-            match result {
-                Ok(()) => {
-                    info!("CRL background refresh completed successfully");
-                }
-                Err(e) => {
-                    warn!(
-                        error = %e,
-                        "CRL background refresh failed -- continuing with current CRL"
-                    );
-                }
-            }
-
-            tokio::time::sleep(interval).await;
-        }
-    });
-
-    info!(
-        interval_secs = interval.as_secs(),
-        "CRL refresh background task spawned"
-    );
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_format_serial_hex() {
-        use x509_parser::num_bigint::BigUint;
-        let serial = BigUint::from(0x0123_abcdu64);
-        let hex = format_serial_hex(&serial);
-        assert_eq!(hex, "0123abcd");
-    }
-
-    #[test]
-    fn test_format_serial_hex_single_byte() {
-        use x509_parser::num_bigint::BigUint;
-        let serial = BigUint::from(0x42u64);
-        let hex = format_serial_hex(&serial);
-        assert_eq!(hex, "42");
-    }
-
-    #[test]
-    fn test_crl_state_default_is_missing() {
-        let state = CrlState::default();
-        assert_eq!(state.status, CrlStatus::Missing);
-        assert!(state.revoked_serials.is_empty());
-        assert!(state.crl_mtime.is_none());
-    }
-
-    #[test]
-    fn test_crl_state_is_revoked() {
-        let mut state = CrlState::default();
-        state.revoked_serials.insert("deadbeef".to_string());
-        assert!(state.is_revoked("deadbeef"));
-        assert!(!state.is_revoked("cafef00d"));
-    }
-
-    #[test]
-    fn test_crl_status_display() {
-        assert_eq!(CrlStatus::Valid.to_string(), "valid");
-        assert_eq!(CrlStatus::Expired.to_string(), "expired");
-        assert_eq!(CrlStatus::Missing.to_string(), "missing");
-        assert_eq!(CrlStatus::Invalid.to_string(), "invalid");
-        assert_eq!(CrlStatus::Degraded.to_string(), "degraded");
-    }
-
-    #[test]
-    fn test_extract_pem_crl_der_invalid() {
-        // Not PEM
-        assert!(extract_pem_crl_der(b"not pem").is_none());
-        // PEM but wrong type
-        assert!(extract_pem_crl_der(
-            b"-----BEGIN CERTIFICATE-----\nAA==\n-----END CERTIFICATE-----"
-        )
-        .is_none());
-    }
-
-    #[test]
-    fn test_shared_crl_state_swap() {
-        let shared = new_shared_state();
-        let initial = shared.load();
-        assert_eq!(initial.status, CrlStatus::Missing);
-
-        let new_state = CrlState {
-            status: CrlStatus::Valid,
-            revoked_serials: {
-                let mut set = HashSet::new();
-                set.insert("abc".to_string());
-                set
-            },
-            ..Default::default()
-        };
-        shared.store(Arc::new(new_state));
-
-        let updated = shared.load();
-        assert_eq!(updated.status, CrlStatus::Valid);
-        assert!(updated.is_revoked("abc"));
-    }
-
-    // -----------------------------------------------------------------------
-    // CRL parsing and verification tests
-    //
-    // Note: x509_parser's verify_signature() has known incompatibilities with
-    // rcgen-generated CRL signatures. The full load_crl() pipeline (which
-    // includes signature verification) is tested end-to-end with real CRLs
-    // from the manager's CertAuthority. These unit tests focus on the
-    // individual components: PEM extraction, DER parsing, CrlState logic,
-    // and missing file handling.
-    // -----------------------------------------------------------------------
-
-    /// Helper: generate a test CA key/cert pair using rcgen.
-    fn generate_test_ca() -> (rcgen::KeyPair, rcgen::Certificate) {
-        let key = rcgen::KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap();
-        let mut params = rcgen::CertificateParams::default();
-        params.not_before = time::OffsetDateTime::now_utc();
-        params.not_after = time::OffsetDateTime::now_utc() + time::Duration::days(365 * 10);
-        params.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
-        params.key_usages = vec![
-            rcgen::KeyUsagePurpose::KeyCertSign,
-            rcgen::KeyUsagePurpose::CrlSign,
-        ];
-        let mut dn = rcgen::DistinguishedName::new();
-        dn.push(rcgen::DnType::CommonName, "Test Root CA");
-        dn.push(rcgen::DnType::OrganizationName, "Patch Manager Test");
-        params.distinguished_name = dn;
-        let cert = params.self_signed(&key).unwrap();
-        (key, cert)
-    }
-
-    /// Helper: generate a CRL signed by the test CA with the given revoked serials.
-    fn generate_test_crl(
-        ca_key: &rcgen::KeyPair,
-        ca_cert: &rcgen::Certificate,
-        revoked_serials: &[rcgen::SerialNumber],
-    ) -> String {
-        let now = time::OffsetDateTime::now_utc();
-        let next_update = now + time::Duration::hours(24);
-        let crl_number =
-            rcgen::SerialNumber::from_slice(&chrono::Utc::now().timestamp().to_be_bytes());
-
-        let revoked_certs: Vec<rcgen::RevokedCertParams> = revoked_serials
-            .iter()
-            .map(|serial| rcgen::RevokedCertParams {
-                serial_number: serial.clone(),
-                revocation_time: now,
-                reason_code: Some(rcgen::RevocationReason::Unspecified),
-                invalidity_date: None,
-            })
-            .collect();
-
-        let crl_params = rcgen::CertificateRevocationListParams {
-            this_update: now,
-            next_update,
-            crl_number,
-            issuing_distribution_point: None,
-            revoked_certs,
-            key_identifier_method: rcgen::KeyIdMethod::Sha256,
-        };
-
-        let crl = crl_params.signed_by(ca_cert, ca_key).unwrap();
-        crl.pem().unwrap()
-    }
-
-    /// Helper: generate a serial number and return both rcgen SerialNumber and its hex string.
-    fn make_serial_hex_pair() -> (rcgen::SerialNumber, String) {
-        let mut bytes = [0u8; 16];
-        rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut bytes);
-        let hex = hex::encode(bytes);
-        (rcgen::SerialNumber::from_slice(&bytes), hex)
-    }
-
-    #[test]
-    fn crl_pem_extraction_works_for_valid_crl() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        let (ca_key, ca_cert) = generate_test_ca();
-        let (serial1, _) = make_serial_hex_pair();
-        let crl_pem = generate_test_crl(&ca_key, &ca_cert, &[serial1]);
-
-        // Verify PEM extraction succeeds
-        let der = extract_pem_crl_der(crl_pem.as_bytes());
-        assert!(
-            der.is_some(),
-            "PEM extraction should succeed for valid CRL PEM"
-        );
-
-        // Verify the DER can be parsed as a CRL
-        let der_bytes = der.unwrap();
-        let parsed = CertificateRevocationList::from_der(&der_bytes);
-        assert!(parsed.is_ok(), "DER should parse as a valid CRL");
-    }
-
-    #[test]
-    fn crl_pem_extraction_works_for_empty_crl() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        let (ca_key, ca_cert) = generate_test_ca();
-        let crl_pem = generate_test_crl(&ca_key, &ca_cert, &[]);
-
-        // Verify PEM extraction succeeds for empty CRL
-        let der = extract_pem_crl_der(crl_pem.as_bytes());
-        assert!(
-            der.is_some(),
-            "PEM extraction should succeed for empty CRL PEM"
-        );
-
-        // Verify the DER can be parsed as a CRL
-        let der_bytes = der.unwrap();
-        let parsed = CertificateRevocationList::from_der(&der_bytes);
-        assert!(parsed.is_ok(), "DER should parse as a valid CRL");
-
-        // Empty CRL should have no revoked certificates
-        let (_, crl) = parsed.unwrap();
-        let revoked: Vec<_> = crl.iter_revoked_certificates().collect();
-        assert!(
-            revoked.is_empty(),
-            "Empty CRL should have no revoked entries"
-        );
-    }
-
-    #[test]
-    fn crl_pem_extraction_rejects_tampered_content() {
-        // Tampering with the base64 content should cause extraction to either
-        // fail or produce invalid DER that can't be parsed.
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        let (ca_key, ca_cert) = generate_test_ca();
-        let (serial1, _) = make_serial_hex_pair();
-        let crl_pem = generate_test_crl(&ca_key, &ca_cert, &[serial1]);
-
-        // Tamper with the base64 content
-        let mut tampered_bytes = crl_pem.into_bytes();
-        let mid = tampered_bytes.len() / 2;
-        // Find a byte that's part of the base64 content (not header/footer/newline)
-        for i in (mid.saturating_sub(10)..mid.saturating_add(10)).rev() {
-            if tampered_bytes[i] != b'\n' && tampered_bytes[i] != b'-' {
-                tampered_bytes[i] ^= 0x01;
-                break;
-            }
-        }
-
-        // PEM extraction may still succeed (it just extracts base64),
-        // but the resulting DER should fail signature verification
-        // or parse incorrectly.
-        let der = extract_pem_crl_der(&tampered_bytes);
-        if let Some(der_data) = der {
-            // If PEM extraction succeeded, the DER should either fail to parse
-            // or fail signature verification. We just verify it's not a valid
-            // CRL that we can trust.
-            let _ = CertificateRevocationList::from_der(&der_data);
-            // The CRL may parse but won't verify — that's expected.
-        }
-        // Either way, tampered content is detected at some level.
-    }
-
-    #[test]
-    fn crl_missing_file_returns_missing_status() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        let (_, ca_cert) = generate_test_ca();
-        let ca_cert_der = ca_cert.der().to_vec();
-
-        // Use a path that doesn't exist
-        let missing_path = std::path::PathBuf::from("/tmp/nonexistent_crl_test_12345.pem");
-        let _ = std::fs::remove_file(&missing_path); // Ensure it doesn't exist
-
-        let state = load_crl(&missing_path, &ca_cert_der);
-
-        assert_eq!(
-            state.status,
-            CrlStatus::Missing,
-            "Missing CRL file should return Missing status"
-        );
-        assert!(state.revoked_serials.is_empty());
-    }
-
-    #[test]
-    fn crl_wrong_pem_type_rejected() {
-        // PEM with wrong type marker should not extract as CRL
-        let cert_pem = "-----BEGIN CERTIFICATE-----\nMIIBkTCB+wIJAKHHCgVZU65BMA0GCSqGSIb3DQEBCwUAMBExDzANBgNVBAMMBnRlc3Qx\n-----END CERTIFICATE-----";
-        let result = extract_pem_crl_der(cert_pem.as_bytes());
-        assert!(
-            result.is_none(),
-            "CERTIFICATE PEM should not extract as CRL"
-        );
-    }
-
-    #[test]
-    fn crl_revoked_certificates_count_in_parsed_crl() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        let (ca_key, ca_cert) = generate_test_ca();
-
-        // Create CRL with 2 revoked serials
-        let (s1, _) = make_serial_hex_pair();
-        let (s2, _) = make_serial_hex_pair();
-        let crl_pem = generate_test_crl(&ca_key, &ca_cert, &[s1, s2]);
-
-        // Extract and parse the CRL
-        let der = extract_pem_crl_der(crl_pem.as_bytes()).expect("PEM extraction should succeed");
-        let (_, crl) =
-            CertificateRevocationList::from_der(&der).expect("DER parsing should succeed");
-
-        // Verify 2 revoked entries
-        let revoked: Vec<_> = crl.iter_revoked_certificates().collect();
-        assert_eq!(revoked.len(), 2, "CRL should have 2 revoked entries");
-    }
-
-    #[test]
-    fn crl_empty_crl_has_no_revoked_entries() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        let (ca_key, ca_cert) = generate_test_ca();
-        let crl_pem = generate_test_crl(&ca_key, &ca_cert, &[]);
-
-        let der = extract_pem_crl_der(crl_pem.as_bytes()).expect("PEM extraction should succeed");
-        let (_, crl) =
-            CertificateRevocationList::from_der(&der).expect("DER parsing should succeed");
-
-        let revoked: Vec<_> = crl.iter_revoked_certificates().collect();
-        assert!(
-            revoked.is_empty(),
-            "Empty CRL should have no revoked entries"
-        );
-    }
-
-    #[test]
-    fn crl_state_transitions() {
-        // Test CrlStatus transitions using the in-memory CrlState
-        // (signature verification is tested end-to-end with real CRLs)
-
-        // Valid → should have revoked serials if any
-        let valid_state = CrlState {
-            status: CrlStatus::Valid,
-            revoked_serials: {
-                let mut set = HashSet::new();
-                set.insert("aabbccdd".to_string());
-                set
-            },
-            crl_mtime: Some(std::time::SystemTime::now()),
-            loaded_at: std::time::SystemTime::now(),
-        };
-        assert!(valid_state.is_revoked("aabbccdd"));
-        assert!(!valid_state.is_revoked("11223344"));
-
-        // Expired → still has revoked serials (usable but stale)
-        let expired_state = CrlState {
-            status: CrlStatus::Expired,
-            revoked_serials: valid_state.revoked_serials.clone(),
-            crl_mtime: Some(std::time::SystemTime::now() - std::time::Duration::from_secs(86400)),
-            loaded_at: std::time::SystemTime::now(),
-        };
-        assert!(expired_state.is_revoked("aabbccdd"));
-
-        // Missing → no serials, no mtime
-        let missing_state = CrlState::default();
-        assert_eq!(missing_state.status, CrlStatus::Missing);
-        assert!(missing_state.revoked_serials.is_empty());
-        assert!(missing_state.crl_mtime.is_none());
-
-        // Invalid → no serials (fail-closed)
-        let invalid_state = CrlState {
-            status: CrlStatus::Invalid,
-            revoked_serials: HashSet::new(),
-            crl_mtime: Some(std::time::SystemTime::now()),
-            loaded_at: std::time::SystemTime::now(),
-        };
-        assert!(
-            !invalid_state.is_revoked("aabbccdd"),
-            "Invalid CRL should not match any serial"
-        );
-    }
-
-    #[test]
-    fn test_extract_pem_cert_der_invalid() {
-        // Not PEM
-        assert!(extract_pem_cert_der(b"not pem").is_none());
-        // PEM but wrong type (CRL instead of CERTIFICATE)
-        assert!(
-            extract_pem_cert_der(b"-----BEGIN X509 CRL-----\nAA==\n-----END X509 CRL-----")
-                .is_none()
-        );
-    }
-
-    #[test]
-    fn test_extract_pem_cert_der_valid() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-        let (_, ca_cert) = generate_test_ca();
-        let cert_pem = ca_cert.pem();
-
-        // Verify PEM extraction succeeds
-        let der = extract_pem_cert_der(cert_pem.as_bytes());
-        assert!(
-            der.is_some(),
-            "PEM extraction should succeed for valid certificate PEM"
-        );
-
-        // Verify the DER can be parsed as an X.509 certificate
-        let der_bytes = der.unwrap();
-        let parsed = x509_parser::parse_x509_certificate(&der_bytes);
-        assert!(
-            parsed.is_ok(),
-            "DER should parse as a valid X.509 certificate"
-        );
-    }
-
-    #[test]
-    fn test_extract_pem_cert_der_rejects_crl_pem() {
-        // CERTIFICATE extraction should reject CRL PEM
-        let crl_pem = "-----BEGIN X509 CRL-----\nAA==\n-----END X509 CRL-----";
-        assert!(
-            extract_pem_cert_der(crl_pem.as_bytes()).is_none(),
-            "CRL PEM should not extract as CERTIFICATE"
-        );
-    }
-}

src/auth/mod.rs

@@ -1,31 +1,16 @@
-//! Auth Module - mTLS, IP Whitelist, and Security Headers
+//! Auth Module - mTLS and IP Whitelist Enforcement
 //!
 //! This module provides security authentication and authorization:
-//! - mTLS (Mutual TLS) certificate-based authentication (enforced at TLS handshake by rustls)
+//! - mTLS (Mutual TLS) certificate-based authentication
 //! - IP whitelist enforcement with CIDR subnet support
-//! - Security header validation (VULN-006: duplicate critical header rejection)
 //! - Silent drop for non-compliant connections
 //! - Comprehensive audit logging
-//!
-//! # Architecture Decision Record: rustls as Authoritative Client-Auth Gate
-//!
-//! Client certificate authentication is enforced at the TLS handshake level by
-//! rustls via `CrlAwareVerifier`. No application-layer certificate validation
-//! middleware is needed — rustls rejects connections that fail client-cert
-//! verification before any HTTP request is processed. See `mtls.rs` for details.
 
-pub mod crl;
 pub mod mtls;
-pub mod security_headers;
 pub mod whitelist;
 
-pub use crl::{new_shared_state, CrlState, CrlStatus, SharedCrlState};
-pub use mtls::{ClientCertInfo, MtlsConfig, MtlsError};
-pub use security_headers::SecurityHeadersMiddleware;
-pub use whitelist::{
-    WhitelistConfig, WhitelistEntry, WhitelistManager, WhitelistMiddleware,
-    WhitelistMiddlewareService,
-};
+pub use mtls::{ClientCertInfo, MtlsConfig, MtlsError, MtlsMiddleware};
+pub use whitelist::{WhitelistConfig, WhitelistEntry, WhitelistManager, WhitelistMiddleware};
 
 /// Combined authentication result
 #[derive(Debug, Clone)]

src/auth/mtls.rs

@@ -1,192 +1,86 @@
-//! mTLS Configuration Module
+//! mTLS Authentication Module
 //!
-//! Provides rustls-based mutual TLS configuration for the API server.
-//!
-//! # Architecture Decision Record: rustls as Authoritative Client-Auth Gate
-//!
-//! Client certificate authentication is enforced at the TLS handshake level by
-//! rustls via `CrlAwareVerifier` (which wraps `WebPkiClientVerifier`). This means:
-//!
-//! - **rustls + CrlAwareVerifier IS the authoritative client-auth gate.**
-//! - No application-layer certificate validation middleware is needed because
-//!   rustls rejects connections that fail client-cert verification before any
-//!   HTTP request is processed.
-//! - `build_rustls_config()` configures the TLS listener to require client
-//!   certificates (`with_client_cert_verifier`), making mTLS enforcement
-//!   unavoidable at the transport layer.
-//! - CRL revocation checking is integrated into the same handshake path via
-//!   `CrlAwareVerifier`, so revoked certificates are also rejected before any
-//!   HTTP handler runs.
-//!
-//! This design was chosen because rustls provides battle-tested X.509
-//! verification, and enforcing auth at the TLS layer eliminates an entire
-//! class of bypass vulnerabilities that application-layer checks are
-//! susceptible to (e.g., middleware ordering bugs, route-specific skips).
+//! Provides mutual TLS authentication middleware for Actix-web.
+//! Non-mTLS connections are silently dropped (no response).
 
-use chrono::{DateTime, Utc};
+use actix_web::{
+    dev::{forward_ready, Service, ServiceRequest, ServiceResponse, Transform},
+    Error, HttpMessage,
+};
+#[allow(unused_imports)]
+use chrono::{DateTime, Duration, Utc};
+use futures_util::future::LocalBoxFuture;
 use rustls::{
-    client::danger::HandshakeSignatureValid,
     crypto::aws_lc_rs,
-    pki_types::CertificateDer,
-    server::{
-        danger::{ClientCertVerified, ClientCertVerifier},
-        ServerConfig, WebPkiClientVerifier,
-    },
+    server::{ServerConfig, WebPkiClientVerifier},
     version::TLS13,
-    DigitallySignedStruct, DistinguishedName, Error as RustlsError, RootCertStore, SignatureScheme,
+    RootCertStore,
 };
 use rustls_pemfile::{certs, private_key};
 use std::{fs::File, io::BufReader, sync::Arc};
-use tracing::{error, info, warn};
+use tracing::{debug, info, warn};
 
-use super::crl::{cert_serial_hex, SharedCrlState};
+/// Check for duplicate critical headers (VULN-006)
+/// Returns true if duplicate headers are detected
+fn has_duplicate_critical_headers(req: &ServiceRequest) -> bool {
+    let critical_headers = ["content-type", "authorization", "host"];
 
-/// CRL-aware client certificate verifier.
-///
-/// Wraps WebPkiClientVerifier for chain validation, then checks the
-/// end-entity certificate serial against the in-memory CRL index.
-/// If CRL is unavailable (Missing/Degraded), falls back to WebPKI-only.
-#[derive(Debug)]
-struct CrlAwareVerifier {
-    inner: Arc<dyn ClientCertVerifier>,
-    crl_state: SharedCrlState,
-}
-
-impl CrlAwareVerifier {
-    fn new(inner: Arc<dyn ClientCertVerifier>, crl_state: SharedCrlState) -> Self {
-        Self { inner, crl_state }
-    }
-}
-
-impl ClientCertVerifier for CrlAwareVerifier {
-    fn offer_client_auth(&self) -> bool {
-        self.inner.offer_client_auth()
-    }
-
-    fn client_auth_mandatory(&self) -> bool {
-        self.inner.client_auth_mandatory()
-    }
-
-    fn root_hint_subjects(&self) -> &[DistinguishedName] {
-        self.inner.root_hint_subjects()
-    }
-
-    fn verify_client_cert(
-        &self,
-        end_entity: &CertificateDer<'_>,
-        intermediates: &[CertificateDer<'_>],
-        now: rustls::pki_types::UnixTime,
-    ) -> Result<ClientCertVerified, RustlsError> {
-        // 1. Delegate chain validation to WebPKI
-        self.inner
-            .verify_client_cert(end_entity, intermediates, now)?;
-
-        // 2. Check CRL revocation status
-        let crl = self.crl_state.load();
-        match crl.status {
-            super::crl::CrlStatus::Valid | super::crl::CrlStatus::Expired => {
-                // CRL is available -- check serial
-                if let Some(serial_hex) = cert_serial_hex(end_entity.as_ref()) {
-                    if crl.is_revoked(&serial_hex) {
-                        warn!(
-                            serial = %serial_hex,
-                            "Client certificate is revoked per CRL -- rejecting connection"
-                        );
-                        return Err(RustlsError::InvalidCertificate(
-                            rustls::CertificateError::Revoked,
-                        ));
-                    }
+    for header_name in critical_headers.iter() {
+        // Count occurrences of this header
+        let mut count = 0;
+        for (name, _) in req.headers().iter() {
+            if name.as_str().eq_ignore_ascii_case(header_name) {
+                count += 1;
+                if count > 1 {
+                    warn!(
+                        peer_addr = ?req.peer_addr(),
+                        header = header_name,
+                        "Duplicate critical header detected - rejecting request"
+                    );
+                    return true;
                 }
-                Ok(ClientCertVerified::assertion())
-            }
-            super::crl::CrlStatus::Missing | super::crl::CrlStatus::Degraded => {
-                // No CRL available -- fall back to WebPKI-only (already passed above)
-                warn!(
-                    status = %crl.status,
-                    "CRL not available -- allowing connection with WebPKI-only verification"
-                );
-                Ok(ClientCertVerified::assertion())
-            }
-            super::crl::CrlStatus::Invalid => {
-                // Invalid CRL signature -- fail-closed
-                error!(
-                    "CRL signature is invalid -- refusing all client certificates (fail-closed)"
-                );
-                Err(RustlsError::InvalidCertificate(
-                    rustls::CertificateError::Revoked,
-                ))
             }
         }
     }
-
-    fn verify_tls12_signature(
-        &self,
-        message: &[u8],
-        cert: &CertificateDer<'_>,
-        dss: &DigitallySignedStruct,
-    ) -> Result<HandshakeSignatureValid, RustlsError> {
-        self.inner.verify_tls12_signature(message, cert, dss)
-    }
-
-    fn verify_tls13_signature(
-        &self,
-        message: &[u8],
-        cert: &CertificateDer<'_>,
-        dss: &DigitallySignedStruct,
-    ) -> Result<HandshakeSignatureValid, RustlsError> {
-        self.inner.verify_tls13_signature(message, cert, dss)
-    }
-
-    fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
-        self.inner.supported_verify_schemes()
-    }
+    false
 }
 
 /// mTLS Configuration
-///
-/// TLS 1.3 is the only supported protocol version — this is hardcoded
-/// in `build_rustls_config()` and cannot be configured via this struct.
 #[derive(Debug, Clone)]
 pub struct MtlsConfig {
     pub ca_cert_path: String,
     pub server_cert_path: String,
     pub server_key_path: String,
+    pub min_tls_version: String,
 }
 
-/// Build a rustls ServerConfig with client certificate verification.
-///
-/// This is the authoritative mTLS gate — rustls enforces client certificate
-/// validation at the TLS handshake level, before any HTTP request is processed.
-///
-/// When `crl_state` is provided and the CRL is available, wraps the
-/// WebPkiClientVerifier with CrlAwareVerifier for revocation checking.
-/// When CRL is missing/degraded, falls back to WebPKI-only verification.
-pub fn build_rustls_config(
-    config: &MtlsConfig,
-    crl_state: Option<SharedCrlState>,
-) -> Result<Arc<ServerConfig>, MtlsError> {
-    let cert_store = load_ca_certs(&config.ca_cert_path)?;
+/// mTLS Middleware for Actix-web
+pub struct MtlsMiddleware {
+    config: Arc<MtlsConfig>,
+    cert_store: Arc<RootCertStore>,
+}
 
-    let webpki_verifier = WebPkiClientVerifier::builder(cert_store.clone().into())
-        .build()
-        .map_err(|e| MtlsError::ClientVerifierError(e.to_string()))?;
+impl MtlsMiddleware {
+    /// Create a new mTLS middleware
+    pub fn new(config: MtlsConfig) -> Result<Self, MtlsError> {
+        let cert_store = load_ca_certs(&config.ca_cert_path)?;
 
-    let client_verifier: Arc<dyn ClientCertVerifier> = match crl_state {
-        Some(state) => {
-            info!("CRL-aware client verification enabled");
-            Arc::new(CrlAwareVerifier::new(webpki_verifier, state))
-        }
-        None => {
-            info!("No CRL state provided -- using WebPKI-only client verification");
-            webpki_verifier
-        }
-    };
+        Ok(Self {
+            config: Arc::new(config),
+            cert_store: Arc::new(cert_store),
+        })
+    }
 
-    let server_cert = load_certs(&config.server_cert_path)?;
-    let server_key = load_private_key(&config.server_key_path)?;
+    /// Build rustls server configuration with client certificate verification
+    pub fn build_rustls_config(&self) -> Result<Arc<ServerConfig>, MtlsError> {
+        let client_verifier = WebPkiClientVerifier::builder(self.cert_store.clone())
+            .build()
+            .map_err(|e| MtlsError::ClientVerifierError(e.to_string()))?;
 
-    let server_config =
-        ServerConfig::builder_with_provider(Arc::new(aws_lc_rs::default_provider()))
+        let server_cert = load_certs(&self.config.server_cert_path)?;
+        let server_key = load_private_key(&self.config.server_key_path)?;
+
+        let config = ServerConfig::builder_with_provider(Arc::new(aws_lc_rs::default_provider()))
             .with_protocol_versions(&[&TLS13])
             .map_err(|e| {
                 MtlsError::ServerConfigError(format!("Failed to set TLS 1.3 only: {}", e))
@@ -195,7 +89,8 @@ pub fn build_rustls_config(
             .with_single_cert(server_cert, server_key)
             .map_err(|e| MtlsError::ServerConfigError(e.to_string()))?;
 
-    Ok(Arc::new(server_config))
+        Ok(Arc::new(config))
+    }
 }
 
 /// Load CA certificates from PEM file
@@ -246,21 +141,6 @@ fn load_private_key(path: &str) -> Result<rustls::pki_types::PrivateKeyDer<'stat
     Ok(key)
 }
 
-/// Certificate information extracted from client certificate.
-///
-/// NOTE: This struct is preserved for potential future use in extracting
-/// client certificate details from the TLS session at the application layer.
-/// Client authentication is enforced at the TLS handshake level by
-/// CrlAwareVerifier — this struct is NOT used for validation.
-#[derive(Debug, Clone)]
-pub struct ClientCertInfo {
-    pub subject: String,
-    pub issuer: String,
-    pub serial: String,
-    pub not_before: DateTime<Utc>,
-    pub not_after: DateTime<Utc>,
-}
-
 /// mTLS Error types
 #[derive(Debug, thiserror::Error)]
 pub enum MtlsError {
@@ -278,127 +158,213 @@ pub enum MtlsError {
     ValidationError(String),
 }
 
+impl<S, B> Transform<S, ServiceRequest> for MtlsMiddleware
+where
+    S: Service<ServiceRequest, Response = ServiceResponse<B>, Error = Error>,
+    S::Future: 'static,
+    B: 'static,
+{
+    type Response = ServiceResponse<B>;
+    type Error = Error;
+    type InitError = ();
+    type Transform = MtlsMiddlewareService<S>;
+    type Future = futures_util::future::Ready<Result<Self::Transform, Self::InitError>>;
+
+    fn new_transform(&self, service: S) -> Self::Future {
+        futures_util::future::ok(MtlsMiddlewareService {
+            service,
+            config: self.config.clone(),
+            cert_store: self.cert_store.clone(),
+        })
+    }
+}
+
+pub struct MtlsMiddlewareService<S> {
+    service: S,
+    #[allow(dead_code)]
+    config: Arc<MtlsConfig>,
+    cert_store: Arc<RootCertStore>,
+}
+
+impl<S, B> Service<ServiceRequest> for MtlsMiddlewareService<S>
+where
+    S: Service<ServiceRequest, Response = ServiceResponse<B>, Error = Error>,
+    S::Future: 'static,
+    B: 'static,
+{
+    type Response = ServiceResponse<B>;
+    type Error = Error;
+    type Future = LocalBoxFuture<'static, Result<Self::Response, Self::Error>>;
+
+    forward_ready!(service);
+
+    fn call(&self, req: ServiceRequest) -> Self::Future {
+        let cert_store = self.cert_store.clone();
+        let peer_addr = req.peer_addr();
+
+        // VULN-006: Check for duplicate critical headers before processing
+        if has_duplicate_critical_headers(&req) {
+            warn!(
+                peer_addr = ?peer_addr,
+                "Duplicate critical headers detected - rejecting request (VULN-006)"
+            );
+            return Box::pin(async move {
+                Err(actix_web::error::ErrorBadRequest(
+                    "Duplicate critical headers not allowed",
+                ))
+            });
+        }
+
+        // Check for client certificate in request extensions
+        // In a proper mTLS setup with Actix-web + rustls, the certificate
+        // would be extracted from the TLS connection before reaching this middleware
+        let has_client_cert = req.extensions().get::<ClientCertInfo>().is_some();
+
+        if !has_client_cert {
+            // No client certificate provided - silent drop
+            warn!(
+                peer_addr = ?peer_addr,
+                "No client certificate provided - dropping connection (mTLS required)"
+            );
+            // Return error immediately without calling service
+            return Box::pin(async move {
+                Err(actix_web::error::ErrorBadRequest(
+                    "Client certificate required",
+                ))
+            });
+        }
+
+        // Certificate present - validate it
+        let cert_info = req.extensions().get::<ClientCertInfo>().cloned();
+
+        if let Some(info) = cert_info {
+            // Validate certificate against CA store
+            match validate_client_certificate(&info, &cert_store) {
+                Ok(_) => {
+                    info!(
+                        subject = %info.subject,
+                        issuer = %info.issuer,
+                        peer_addr = ?peer_addr,
+                        "mTLS client certificate validated successfully"
+                    );
+                }
+                Err(e) => {
+                    warn!(
+                        error = %e,
+                        peer_addr = ?peer_addr,
+                        "mTLS client certificate validation failed - dropping connection"
+                    );
+                    return Box::pin(async move {
+                        Err(actix_web::error::ErrorBadRequest(
+                            "Certificate validation failed",
+                        ))
+                    });
+                }
+            }
+        } else {
+            warn!(
+                peer_addr = ?peer_addr,
+                "No client certificate provided - dropping connection (mTLS required)"
+            );
+            return Box::pin(async move {
+                Err(actix_web::error::ErrorBadRequest(
+                    "Client certificate required",
+                ))
+            });
+        }
+
+        debug!("mTLS authentication passed for request");
+
+        // All checks passed - call the service
+        let fut = self.service.call(req);
+        Box::pin(fut)
+    }
+}
+
+/// Certificate information extracted from client certificate
+#[derive(Debug, Clone)]
+pub struct ClientCertInfo {
+    pub subject: String,
+    pub issuer: String,
+    pub serial: String,
+    pub not_before: DateTime<Utc>,
+    pub not_after: DateTime<Utc>,
+}
+
+/// Validate client certificate against CA store
+fn validate_client_certificate(
+    cert_info: &ClientCertInfo,
+    _cert_store: &RootCertStore,
+) -> Result<(), MtlsError> {
+    // Check certificate validity period
+    let now = Utc::now();
+
+    if now < cert_info.not_before {
+        return Err(MtlsError::ValidationError(
+            "Certificate is not yet valid".to_string(),
+        ));
+    }
+
+    if now > cert_info.not_after {
+        return Err(MtlsError::ValidationError(
+            "Certificate has expired".to_string(),
+        ));
+    }
+
+    // In production, would verify certificate chain against CA store
+    // For now, we trust certificates that were extracted from the TLS connection
+
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::collections::HashSet;
 
-    fn init_crypto_provider() {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-    }
-
-    fn make_test_ca_and_root_store() -> (rcgen::KeyPair, RootCertStore) {
-        let ca_key = rcgen::KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap();
-        let mut ca_params = rcgen::CertificateParams::default();
-        ca_params.not_before = time::OffsetDateTime::now_utc();
-        ca_params.not_after = time::OffsetDateTime::now_utc() + time::Duration::days(365);
-        ca_params.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
-        ca_params.key_usages = vec![rcgen::KeyUsagePurpose::KeyCertSign];
-        let mut dn = rcgen::DistinguishedName::new();
-        dn.push(rcgen::DnType::CommonName, "Test CA for Verifier");
-        ca_params.distinguished_name = dn;
-        let ca_cert = ca_params.self_signed(&ca_key).unwrap();
-
-        let mut root_store = RootCertStore::empty();
-        root_store.add(ca_cert.der().to_owned()).unwrap();
-
-        (ca_key, root_store)
-    }
-
-    /// Test that CrlAwareVerifier can be constructed with a WebPKI verifier
-    /// and a SharedCrlState. This verifies the wiring is correct.
     #[test]
-    fn crl_aware_verifier_construction() {
-        init_crypto_provider();
-        use super::super::crl::{new_shared_state, CrlState, CrlStatus};
-
-        let (_ca_key, root_store) = make_test_ca_and_root_store();
-
-        let webpki_verifier: Arc<dyn ClientCertVerifier> =
-            WebPkiClientVerifier::builder(root_store.into())
-                .build()
-                .unwrap();
-
-        let crl_state = new_shared_state();
-        let valid_state = CrlState {
-            status: CrlStatus::Valid,
-            revoked_serials: HashSet::new(),
-            crl_mtime: None,
-            loaded_at: std::time::SystemTime::now(),
+    fn test_mtls_config_creation() {
+        let config = MtlsConfig {
+            ca_cert_path: "/etc/linux_patch_api/certs/ca.pem".to_string(),
+            server_cert_path: "/etc/linux_patch_api/certs/server.pem".to_string(),
+            server_key_path: "/etc/linux_patch_api/certs/server.key".to_string(),
+            min_tls_version: "1.3".to_string(),
         };
-        crl_state.store(Arc::new(valid_state));
 
-        let _verifier = CrlAwareVerifier::new(webpki_verifier, crl_state);
+        assert_eq!(config.ca_cert_path, "/etc/linux_patch_api/certs/ca.pem");
+        assert_eq!(config.min_tls_version, "1.3");
     }
 
-    /// Test that CrlAwareVerifier with Missing CRL state can be constructed.
     #[test]
-    fn crl_aware_verifier_with_missing_crl() {
-        init_crypto_provider();
-        use super::super::crl::new_shared_state;
-
-        let (_ca_key, root_store) = make_test_ca_and_root_store();
-
-        let webpki_verifier: Arc<dyn ClientCertVerifier> =
-            WebPkiClientVerifier::builder(root_store.into())
-                .build()
-                .unwrap();
-
-        // Default state is Missing.
-        let crl_state = new_shared_state();
-        let _verifier = CrlAwareVerifier::new(webpki_verifier, crl_state);
-    }
-
-    /// Test that CrlAwareVerifier with Invalid CRL state can be constructed.
-    #[test]
-    fn crl_aware_verifier_with_invalid_crl() {
-        init_crypto_provider();
-        use super::super::crl::{new_shared_state, CrlState, CrlStatus};
-
-        let (_ca_key, root_store) = make_test_ca_and_root_store();
-
-        let webpki_verifier: Arc<dyn ClientCertVerifier> =
-            WebPkiClientVerifier::builder(root_store.into())
-                .build()
-                .unwrap();
-
-        let crl_state = new_shared_state();
-        let invalid_state = CrlState {
-            status: CrlStatus::Invalid,
-            revoked_serials: HashSet::new(),
-            crl_mtime: None,
-            loaded_at: std::time::SystemTime::now(),
+    fn test_client_cert_info() {
+        let info = ClientCertInfo {
+            subject: "CN=test-client".to_string(),
+            issuer: "CN=Test CA".to_string(),
+            serial: "12345".to_string(),
+            not_before: Utc::now() - Duration::days(1),
+            not_after: Utc::now() + Duration::days(365),
         };
-        crl_state.store(Arc::new(invalid_state));
 
-        let _verifier = CrlAwareVerifier::new(webpki_verifier, crl_state);
+        assert!(info.subject.contains("CN="));
+        assert!(info.issuer.contains("CN="));
+
+        // Test validation with valid cert
+        let cert_store = RootCertStore::empty();
+        assert!(validate_client_certificate(&info, &cert_store).is_ok());
     }
 
-    /// Test that CrlAwareVerifier with a revoked serial in Valid CRL state
-    /// can be constructed.
     #[test]
-    fn crl_aware_verifier_with_revoked_serial() {
-        init_crypto_provider();
-        use super::super::crl::{new_shared_state, CrlState, CrlStatus};
-
-        let (_ca_key, root_store) = make_test_ca_and_root_store();
-
-        let webpki_verifier: Arc<dyn ClientCertVerifier> =
-            WebPkiClientVerifier::builder(root_store.into())
-                .build()
-                .unwrap();
-
-        let crl_state = new_shared_state();
-        let mut revoked = HashSet::new();
-        revoked.insert("deadbeef".to_string());
-        let valid_with_revoked = CrlState {
-            status: CrlStatus::Valid,
-            revoked_serials: revoked,
-            crl_mtime: None,
-            loaded_at: std::time::SystemTime::now(),
+    fn test_client_cert_expired() {
+        let info = ClientCertInfo {
+            subject: "CN=expired-client".to_string(),
+            issuer: "CN=Test CA".to_string(),
+            serial: "12345".to_string(),
+            not_before: Utc::now() - Duration::days(365),
+            not_after: Utc::now() - Duration::days(1),
         };
-        crl_state.store(Arc::new(valid_with_revoked));
 
-        let _verifier = CrlAwareVerifier::new(webpki_verifier, crl_state);
+        let cert_store = RootCertStore::empty();
+        let result = validate_client_certificate(&info, &cert_store);
+        assert!(result.is_err());
+        assert!(result.unwrap_err().to_string().contains("expired"));
     }
 }

src/auth/security_headers.rs

@@ -1,166 +0,0 @@
-//! Security Headers Middleware Module
-//!
-//! Provides request-level security header validation for Actix-web.
-//! Enforces VULN-006: rejects requests with duplicate critical headers
-//! (content-type, authorization, host) to prevent HTTP request smuggling
-//! and response-splitting attacks.
-
-use actix_web::{
-    dev::{forward_ready, Service, ServiceRequest, ServiceResponse, Transform},
-    Error,
-};
-use futures_util::future::LocalBoxFuture;
-use tracing::warn;
-
-/// Critical headers that MUST NOT appear more than once in a request.
-/// Duplicate values for these headers can enable request smuggling,
-/// response splitting, and other HTTP parsing ambiguities.
-const CRITICAL_HEADERS: &[&str] = &["content-type", "authorization", "host"];
-
-/// Security headers middleware for Actix-web.
-///
-/// Checks every incoming request for duplicate critical headers (VULN-006)
-/// and rejects malformed requests with HTTP 400 Bad Request.
-pub struct SecurityHeadersMiddleware;
-
-impl SecurityHeadersMiddleware {
-    /// Create a new security headers middleware instance.
-    pub fn new() -> Self {
-        Self
-    }
-}
-
-impl Default for SecurityHeadersMiddleware {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-/// Actix-web Transform implementation — wraps SecurityHeadersMiddleware as middleware
-impl<S, B> Transform<S, ServiceRequest> for SecurityHeadersMiddleware
-where
-    S: Service<ServiceRequest, Response = ServiceResponse<B>, Error = Error>,
-    S::Future: 'static,
-    B: 'static,
-{
-    type Response = ServiceResponse<B>;
-    type Error = Error;
-    type InitError = ();
-    type Transform = SecurityHeadersMiddlewareService<S>;
-    type Future = futures_util::future::Ready<Result<Self::Transform, Self::InitError>>;
-
-    fn new_transform(&self, service: S) -> Self::Future {
-        futures_util::future::ok(SecurityHeadersMiddlewareService { service })
-    }
-}
-
-/// Security headers middleware service — performs per-request duplicate header checks
-pub struct SecurityHeadersMiddlewareService<S> {
-    service: S,
-}
-
-impl<S, B> Service<ServiceRequest> for SecurityHeadersMiddlewareService<S>
-where
-    S: Service<ServiceRequest, Response = ServiceResponse<B>, Error = Error>,
-    S::Future: 'static,
-    B: 'static,
-{
-    type Response = ServiceResponse<B>;
-    type Error = Error;
-    type Future = LocalBoxFuture<'static, Result<Self::Response, Self::Error>>;
-
-    forward_ready!(service);
-
-    fn call(&self, req: ServiceRequest) -> Self::Future {
-        // VULN-006: Check for duplicate critical headers before processing
-        if has_duplicate_critical_headers(req.headers()) {
-            let peer_addr = req.peer_addr();
-            warn!(
-                peer_addr = ?peer_addr,
-                "Duplicate critical headers detected - rejecting request (VULN-006)"
-            );
-            return Box::pin(async move {
-                Err(actix_web::error::ErrorBadRequest(
-                    "Duplicate critical headers not allowed",
-                ))
-            });
-        }
-
-        // All checks passed — call the service
-        let fut = self.service.call(req);
-        Box::pin(fut)
-    }
-}
-
-/// Check for duplicate critical headers (VULN-006).
-/// Returns true if any critical header appears more than once.
-///
-/// This function is public for testing purposes.
-pub fn has_duplicate_critical_headers(headers: &actix_web::http::header::HeaderMap) -> bool {
-    for header_name in CRITICAL_HEADERS.iter() {
-        let mut count = 0;
-        for (name, _value) in headers.iter() {
-            if name.as_str().eq_ignore_ascii_case(header_name) {
-                count += 1;
-                if count > 1 {
-                    return true;
-                }
-            }
-        }
-    }
-    false
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use actix_web::http::header;
-
-    #[test]
-    fn test_no_duplicate_headers_passes() {
-        let mut headers = header::HeaderMap::new();
-        headers.insert(header::CONTENT_TYPE, "application/json".parse().unwrap());
-        headers.insert(header::AUTHORIZATION, "Bearer test".parse().unwrap());
-        headers.insert(header::HOST, "localhost".parse().unwrap());
-        assert!(!has_duplicate_critical_headers(&headers));
-    }
-
-    #[test]
-    fn test_duplicate_content_type_rejected() {
-        let mut headers = header::HeaderMap::new();
-        headers.insert(header::CONTENT_TYPE, "application/json".parse().unwrap());
-        headers.append(header::CONTENT_TYPE, "text/plain".parse().unwrap());
-        assert!(has_duplicate_critical_headers(&headers));
-    }
-
-    #[test]
-    fn test_duplicate_authorization_rejected() {
-        let mut headers = header::HeaderMap::new();
-        headers.insert(header::AUTHORIZATION, "Bearer test1".parse().unwrap());
-        headers.append(header::AUTHORIZATION, "Bearer test2".parse().unwrap());
-        assert!(has_duplicate_critical_headers(&headers));
-    }
-
-    #[test]
-    fn test_duplicate_host_rejected() {
-        let mut headers = header::HeaderMap::new();
-        headers.insert(header::HOST, "localhost".parse().unwrap());
-        headers.append(header::HOST, "evil.com".parse().unwrap());
-        assert!(has_duplicate_critical_headers(&headers));
-    }
-
-    #[test]
-    fn test_non_critical_duplicate_headers_allowed() {
-        // Duplicate non-critical headers should be allowed
-        let mut headers = header::HeaderMap::new();
-        headers.insert(header::ACCEPT, "text/html".parse().unwrap());
-        headers.append(header::ACCEPT, "application/json".parse().unwrap());
-        assert!(!has_duplicate_critical_headers(&headers));
-    }
-
-    #[test]
-    fn test_empty_headers_passes() {
-        let headers = header::HeaderMap::new();
-        assert!(!has_duplicate_critical_headers(&headers));
-    }
-}