Add complimentary OOBE polish and configurable admin mTLS

Allow one server-audited onboarding polish request without credits and make the certificate gate temporarily reversible while preserving application authentication.
2026-08-20 17:05:35 +08:00
parent 0b4acb5978
commit 034a3e8745
25 changed files with 698 additions and 64 deletions
@@ -31,6 +31,8 @@ IDENTITY_TOMBSTONE_RETENTION_DAYS=365
 # Admin console. Enable bootstrap for the first successful startup only, then
 # set it back to false and remove all four ADMIN_BOOTSTRAP_* credential values.
 ADMIN_ENABLED=false
+# Keep true by default. Set false only for a deliberate temporary mTLS bypass.
+ADMIN_MTLS_REQUIRED=true
 ADMIN_BOOTSTRAP_ENABLED=false
 ADMIN_BOOTSTRAP_OPERATOR_ID=replace-with-random-uuid
 ADMIN_BOOTSTRAP_USERNAME=owner