feat: add TLS for node bridge

2026-01-16 05:28:33 +00:00
parent 1656f491fd
commit 1ab1e312b2
36 changed files with 1161 additions and 180 deletions
--- a/src/infra/widearea-dns.ts
+++ b/src/infra/widearea-dns.ts
@@ -71,6 +71,8 @@ export type WideAreaBridgeZoneOpts = {
  displayName: string;
  tailnetIPv4: string;
  tailnetIPv6?: string;
+  bridgeTlsEnabled?: boolean;
+  bridgeTlsFingerprintSha256?: string;
  instanceLabel?: string;
  hostLabel?: string;
  tailnetDns?: string;
@@ -91,6 +93,12 @@ function renderZone(opts: WideAreaBridgeZoneOpts & { serial: number }): string {
  if (typeof opts.gatewayPort === "number" && opts.gatewayPort > 0) {
    txt.push(`gatewayPort=${opts.gatewayPort}`);
  }
+  if (opts.bridgeTlsEnabled) {
+    txt.push(`bridgeTls=1`);
+    if (opts.bridgeTlsFingerprintSha256) {
+      txt.push(`bridgeTlsSha256=${opts.bridgeTlsFingerprintSha256}`);
+    }
+  }
  if (opts.tailnetDns?.trim()) {
    txt.push(`tailnetDns=${opts.tailnetDns.trim()}`);
  }