Add complimentary OOBE polish and configurable admin mTLS

Allow one server-audited onboarding polish request without credits and make the certificate gate temporarily reversible while preserving application authentication.
2026-08-20 17:05:35 +08:00
parent 0b4acb5978
commit 034a3e8745
25 changed files with 698 additions and 64 deletions
@@ -32,6 +32,7 @@ app:
    tombstoneRetentionDays: "$IDENTITY_TOMBSTONE_RETENTION_DAYS:365"
  admin:
    enabled: "$ADMIN_ENABLED:false"
+    mtlsRequired: "$ADMIN_MTLS_REQUIRED:true"
    bootstrapEnabled: "$ADMIN_BOOTSTRAP_ENABLED:false"
    bootstrapOperatorId: "$ADMIN_BOOTSTRAP_OPERATOR_ID:"
    bootstrapUsername: "$ADMIN_BOOTSTRAP_USERNAME:"