[PR #408] [MERGED] feat(gateway): support HTTPS with manual and ACME certificates

bsakaguchi commented

2026-10-29 14:23:06 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/kvcache-ai/AgentENV/pull/408
Author: @zlzGithub-0801
Created: 10/21/2026
Status: ✅ Merged
Merged: 10/26/2026
Merged by: @yingdi-shan

Base: main ← Head: feat/https-gateway

📝 Commits (1)

7d9537d feat(gateway): support HTTPS with manual and ACME certificates

📊 Changes

8 files changed (+1164 additions, -24 deletions)

View changed files

📝 deploy/docker-compose.yml (+3 -0)
📝 services/README.md (+130 -0)
📝 services/gateway/cmd/main.go (+185 -5)
📝 services/gateway/cmd/main_test.go (+396 -0)
📝 services/go.mod (+31 -1)
📝 services/go.sum (+64 -2)
📝 services/shared/config/config.go (+177 -16)
📝 services/shared/config/config_test.go (+178 -0)

📄 Description

What

Add gateway HTTPS support with three modes:

off (default): HTTP only.
manual: HTTPS using supplied certificate and private key files.
acme: HTTPS with automatic certificate issuance and renewal through CertMagic.

Why

Allow clients to connect securely to the gateway.

N/A

Scope and non-goals

Gateway TLS termination only. Rust nodes and CLI certificate trust configuration are unchanged.

Design and behavior changes

The gateway runs either HTTP or HTTPS. Manual certificates load at startup; ACME certificates are managed by CertMagic.

Compatibility and operations

Public API or generated protocol: Unchanged.
Configuration or defaults: Adds gateway.tls; defaults to off.
Snapshot manifest, artifact layout, or storage format: Unchanged.
Upgrade and rollback: Existing HTTP deployments remain compatible. Set TLS mode to off to restore HTTP.
Host requirements, permissions, ports, or dependencies: Adds CertMagic. Manual mode requires readable certificate files; ACME requires persistent storage and challenge connectivity.

Validation

make fmt
make clippy
make test-unit
Relevant Rust integration tests
make -C services test (required when services/ changes)
Generated clients/server regenerated with the documented make target
Documentation updated
Benchmarks or performance comparison completed

Risks and reviewer notes

Manual certificates require replacement and gateway restart before expiry. ACME deployments require correct challenge configuration and persistent certificate storage.

Checklist

The PR contains one coherent change and no unrelated formatting or refactoring.
New behavior is covered by tests, or I explained why testing is impractical.
Logs and examples contain no credentials, tokens, or private registry information.
I did not manually edit generated code without updating its source and regenerating it.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/kvcache-ai/AgentENV/pull/408 **Author:** [@zlzGithub-0801](https://github.com/zlzGithub-0801) **Created:** 10/21/2026 **Status:** ✅ Merged **Merged:** 10/26/2026 **Merged by:** [@yingdi-shan](https://github.com/yingdi-shan) **Base:** `main` ← **Head:** `feat/https-gateway` --- ### 📝 Commits (1) - [`7d9537d`](https://github.com/kvcache-ai/AgentENV/commit/7d9537d175f1730554146a2699116a5187c776cd) feat(gateway): support HTTPS with manual and ACME certificates ### 📊 Changes **8 files changed** (+1164 additions, -24 deletions) <details> <summary>View changed files</summary> 📝 `deploy/docker-compose.yml` (+3 -0) 📝 `services/README.md` (+130 -0) 📝 `services/gateway/cmd/main.go` (+185 -5) 📝 `services/gateway/cmd/main_test.go` (+396 -0) 📝 `services/go.mod` (+31 -1) 📝 `services/go.sum` (+64 -2) 📝 `services/shared/config/config.go` (+177 -16) 📝 `services/shared/config/config_test.go` (+178 -0) </details> ### 📄 Description ## What Add gateway HTTPS support with three modes: - `off` (default): HTTP only. - `manual`: HTTPS using supplied certificate and private key files. - `acme`: HTTPS with automatic certificate issuance and renewal through CertMagic. ## Why Allow clients to connect securely to the gateway. ## Related issue N/A ## Scope and non-goals Gateway TLS termination only. Rust nodes and CLI certificate trust configuration are unchanged. ## Design and behavior changes The gateway runs either HTTP or HTTPS. Manual certificates load at startup; ACME certificates are managed by CertMagic. ## Compatibility and operations - Public API or generated protocol: Unchanged. - Configuration or defaults: Adds `gateway.tls`; defaults to `off`. - Snapshot manifest, artifact layout, or storage format: Unchanged. - Upgrade and rollback: Existing HTTP deployments remain compatible. Set TLS mode to `off` to restore HTTP. - Host requirements, permissions, ports, or dependencies: Adds CertMagic. Manual mode requires readable certificate files; ACME requires persistent storage and challenge connectivity. ## Validation - [ ] `make fmt` - [ ] `make clippy` - [ ] `make test-unit` - [ ] Relevant Rust integration tests - [x] `make -C services test` (required when `services/` changes) - [ ] Generated clients/server regenerated with the documented `make` target - [x] Documentation updated - [ ] Benchmarks or performance comparison completed ## Risks and reviewer notes Manual certificates require replacement and gateway restart before expiry. ACME deployments require correct challenge configuration and persistent certificate storage. ## Checklist - [x] The PR contains one coherent change and no unrelated formatting or refactoring. - [x] New behavior is covered by tests, or I explained why testing is impractical. - [x] Logs and examples contain no credentials, tokens, or private registry information. - [x] I did not manually edit generated code without updating its source and regenerating it. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-29 14:23:06 +00:00