Add complimentary OOBE polish and configurable admin mTLS

Allow one server-audited onboarding polish request without credits and make the certificate gate temporarily reversible while preserving application authentication.
2026-08-20 17:05:35 +08:00
parent 0b4acb5978
commit 034a3e8745
25 changed files with 698 additions and 64 deletions
@@ -161,6 +161,7 @@ data class AppConfig(
            }
            val admin = AdminConfig(
                enabled = adminEnabled,
+                mtlsRequired = config.booleanOrDefault("app.admin.mtlsRequired", true),
                bootstrapEnabled = adminBootstrapEnabled,
                bootstrapOperatorId = config.optionalValue("app.admin.bootstrapOperatorId")
                    ?.let {
@@ -434,6 +435,7 @@ data class IntegrityConfig(

 data class AdminConfig(
    val enabled: Boolean = false,
+    val mtlsRequired: Boolean = true,
    val bootstrapEnabled: Boolean = false,
    val bootstrapOperatorId: UUID? = null,
    val bootstrapUsername: String? = null,