fleet aggregate: serve /frames with TLS on public listeners by ejc3 · Pull Request #1266 · ejc3/fcvm

ejc3 · 2026-10-25T12:38:19Z

First of three stacked PRs for #1232 (aggregated streams reachable from the https page). This one serves an aggregator's region stream with TLS; the next two name it in DNS.

Stack: this PR (base main) → #1267 (host aggregator names) → #1268 (EC2 aggregator names).

What changed

fcvm fleet aggregate --tls-listen <addr:port> (repeatable, with --tls-file <path>) also serves GET /frames and GET /healthz with TLS on that address. POST/GET /layout and /stats stay on --listen only, so a public address never accepts a layout.

src/fleet/aggregate/tls.rs: the certificate is the agent's renderer file (tls.json, {"cert", "key"} PEM). It is read again every 2 s and a new version is used for the connections that follow; a version that does not load is logged and the previous one kept. Each handshake runs on its own task with a 10 s deadline (at most 256 at once), so a stalled client delays no other.
public_router: /frames and /healthz only.
Cargo.toml: rustls and tokio-rustls as direct dependencies (ring, no aws-lc-rs). Both were already in the lock through reqwest and tokio-tungstenite.
fleet/PROTOCOL.md: the two flags.

Nothing runs it yet: no agent or coordinator passes --tls-listen in this PR.

Contract and evidence

Downstream impact: none until a caller passes --tls-listen. Minimum evidence: the test below, the aggregator suite, lint.

the_public_listener_serves_frames_with_tls_and_no_control_routes (tests/test_fleet_aggregate.rs) reads the region header and a frame over wss, gets 404 for /layout (GET and POST) and /stats over TLS, and after a renewal sees the new certificate on the next connection while a client trusting only the old one is refused; a file that does not load keeps the version in use, and a stream opened before the renewal keeps going. With public_router returning the full router it fails at the 404 assertion.
a_file_without_a_usable_identity_is_refused: missing key, empty cert, bad key, mismatched key.
By hand with the built binary and an openssl P-256 certificate: curl https://<name>:<tls port>/healthz → ok, /layout over TLS → 404, /layout on --listen → 200.

make test-unit FILTER="-E 'binary(test_fleet_aggregate) or test(a_file_without_a_usable_identity)'"
     Summary [   2.517s] 6 tests run: 6 passed
make lint  # fmt, clippy -D warnings, cargo audit, cargo deny: ok

Part of #1232.

An https page cannot open ws://, so a region stream a browser reads must be served with TLS. `fcvm fleet aggregate --tls-listen <addr:port>` (repeatable, with `--tls-file`) serves GET /frames and GET /healthz with TLS on that address. POST/GET /layout and /stats stay on --listen only, so a public address never accepts a layout. - src/fleet/aggregate/tls.rs: the certificate is the agent's renderer file (tls.json, {"cert", "key"} PEM). It is read again every 2 s and a new version is used for the connections that follow; a version that does not load is logged and the previous one kept. The listener accepts and runs each handshake on its own task with a 10 s deadline (at most 256 at once), so a stalled client delays no other. - public_router: /frames and /healthz only. - Cargo.toml: rustls and tokio-rustls as direct dependencies (ring, no aws-lc-rs; both were already in the lock through reqwest and tokio-tungstenite). - fleet/PROTOCOL.md: the two flags. Tests: the_public_listener_serves_frames_with_tls_and_no_control_routes (tests/test_fleet_aggregate.rs) reads the region header and a frame over wss, gets 404 for /layout and /stats over TLS, and after a renewal sees the new certificate on the next connection while a client trusting only the old one is refused. With public_router returning the full router it fails at the 404 assertion. a_file_without_a_usable_identity_is_refused covers missing key, empty cert, bad key and a mismatched key.

coderabbitai · 2026-10-25T12:38:30Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 24 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 179475eb-2b6c-495b-be01-74ab8d13dd0c

Commits

Reviewing files that changed from the base of the PR and between 2840547 and 422bd22.

Files ignored due to path filters: 1

Cargo.lock is excluded by !**/*.lock

Files selected for processing: 6

Cargo.toml
fleet/PROTOCOL.md
src/cli/args.rs
src/fleet/aggregate/mod.rs
src/fleet/aggregate/tls.rs
tests/test_fleet_aggregate.rs

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector · 2026-10-25T12:38:30Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T19:01:03.610368Z	`422bd22`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

ejc3 · 2026-10-25T12:39:02Z

@codex review

chatgpt-codex-connector · 2026-10-25T12:40:31Z

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: cdaee30c14

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ejc3 · 2026-10-25T15:51:51Z

NOT-A-DEFECT: the CodeRabbit comment is a review-limit notice, not a finding.

# Conflicts: # src/fleet/aggregate/mod.rs

ejc3 · 2026-10-25T18:59:39Z

@codex review

ejc3 · 2026-10-25T18:59:44Z

NOT-A-DEFECT: the CodeRabbit comment is a review-limit notice, not a finding.

chatgpt-codex-connector · 2026-10-25T19:01:01Z

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 422bd22a4d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

This was referenced Oct 25, 2026

fleet: publish the host aggregator under agg-<host>-<token> names #1267

Merged

fleet: serve the EC2 half's aggregator to browsers under agg-ec2 names #1268

Merged

fcvm fleet: an aggregated-streaming switch, off (ejc3/fcvm#1232) ejc3/aws#671

Merged

Merge remote-tracking branch 'origin/main' into fix/issue-1232

422bd22

# Conflicts: # src/fleet/aggregate/mod.rs

ejc3 merged commit b608199 into main Oct 25, 2026
10 of 17 checks passed

ejc3 deleted the fix/issue-1232 branch October 25, 2026 21:39

Navigation Menu

Repository navigation

fleet aggregate: serve /frames with TLS on public listeners - #1266

fleet aggregate: serve /frames with TLS on public listeners#1266
ejc3 merged 2 commits into
mainfrom
fix/issue-1232

ejc3 commented Oct 25, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 25, 2026 •

edited

Loading

Review limit reached

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

ejc3 commented Oct 25, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026

Uh oh!

ejc3 commented Oct 25, 2026

Uh oh!

ejc3 commented Oct 25, 2026

Uh oh!

ejc3 commented Oct 25, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

ejc3 commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Contract and evidence

Uh oh!

coderabbitai Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

ejc3 commented Oct 25, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026

Uh oh!

ejc3 commented Oct 25, 2026

Uh oh!

ejc3 commented Oct 25, 2026

Uh oh!

ejc3 commented Oct 25, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ejc3 commented Oct 25, 2026 •

edited

Loading

coderabbitai Bot commented Oct 25, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 25, 2026 •

edited

Loading