crates/gunnar-pairing-door/src/lib.rs
//! **gunnar's part of an installation on the front** (edda nordisk-pairing
//! 0.3): the relay (the binary), and the one move only the front can make —
//! certifying the elected twin for mutual-TLS replication with the console
//! key it holds. The installer's door is gone from the front: the installer
//! runs on the operator's machine and connects OUT to every VM.
//!
//! * [`certify`] — what the twin's follower needs, in order, retried in the
//! background once the installer's ledger carries the verdict; the outcome
//! kept beside the ledger.
//! * [`front`] — the same, run by vm1 itself when the installer feeds it role
//! `front` (0.4: one medium) — the relay on its own tunnel key, and the
//! certification with a key it minted and offered.
//! * [`grpc`] — the same calls against the boxes' real control planes.
#![doc(
html_logo_url = "https://gunnar.rs/download/gunnar.webp",
html_favicon_url = "https://gunnar.rs/download/favicon.svg"
)]
pub mod certify;
pub mod front;
pub mod grpc;
/// **The offer key of the build a VM runs** (lane B, private-gunnar-ops
/// d49cfdd): EVERY VM offers it on every visit — main and twin on the gunnar
/// medium, vm1 on the front medium — and the installer feeds it onward as
/// `offer.<vm>.version`. The value is the build reference the binary was
/// stamped with (`gunnar_common::BUILD_REF`: `git describe --tags --always
/// --dirty=-modified --abbrev=7` of the composed checkout), the same string
/// the SSH banner and `AdminService.Health` carry. xtask compares it with the
/// checkout the medium was composed from; nothing reads the banner for it.
pub const OFFER_VERSION: &str = "version";
/// **The offer key of the forge's SSH host key** (the public half, never the
/// private one): the elected primary's gunnar serves the forge on `:2222`, and
/// the front forwards that port byte for byte (`gunnar-front` `forward.rs`),
/// so the key a git client sees IS the primary's. Every gunnar box offers the
/// key it serves on every visit, as one OpenSSH line
/// (`ssh-ed25519 AAAA…`, no comment); the installer takes the PRIMARY's into
/// the run's receipt (`host_key {fingerprint, public_key, read_from}`) and
/// pins it for the estate's declared forge `host:port` — so no later run has
/// to learn the key from the port (private-gunnar-ops `forge_pin.rs`). It
/// travels the installer's authenticated link (mutual TLS inside WireGuard),
/// never the public port.
pub const OFFER_SSH_HOST_KEY: &str = "ssh_host_key";