release(agent): prepare v1.0.7

Author: goktugcy

CHANGELOG.md

@@ -15,6 +15,21 @@ Formatting rules:
 
 ## [Unreleased]
 
+## [1.0.7] - 2026-04-08
+
+### Added
+
+- Added support for custom API TLS trust roots through `api_tls_ca_file` in config files and `NODERAX_API_TLS_CA_FILE` / `API_TLS_CA_FILE` environment overrides.
+
+### Changed
+
+- Changed API client construction to initialize with system CA roots plus optional custom CA bundle loading, and enforced TLS `minVersion` at TLS 1.2 for outbound API requests.
+- Changed enrollment and managed update code paths to use error-returning API client initialization so TLS CA configuration issues are surfaced before network operations start.
+
+### Fixed
+
+- Fixed startup, install, bootstrap, and managed update flows to fail fast with explicit `configure API client` errors when API TLS CA files are unreadable or invalid.
+
 ## [1.0.6] - 2026-04-05
 
 ### Added

cmd/agent/main.go

@@ -53,7 +53,11 @@ func main() {
 	log := logger.New(cfg.LogLevel)
 	log.Info("starting noderax agent", "version", version, "commit", commit, "build_date", buildDate)
 
-	client := api.NewClient(cfg.APIURL, cfg.RequestTimeout)
+	client, err := api.NewClient(cfg.APIURL, cfg.RequestTimeout, cfg.APITLSCAFile)
+	if err != nil {
+		log.Error("configure API client", "error", err)
+		os.Exit(1)
+	}
 	if cfg.AgentToken != "" {
 		client.SetAgentToken(cfg.AgentToken)
 	}

internal/agentctl/commands.go

@@ -281,7 +281,10 @@ func (c CLI) Install(ctx context.Context, args []string) error {
 			return err
 		}
 	} else {
-		client := api.NewClient(cfg.APIURL, cfg.RequestTimeout)
+		client, err := api.NewClient(cfg.APIURL, cfg.RequestTimeout, cfg.APITLSCAFile)
+		if err != nil {
+			return fmt.Errorf("configure API client: %w", err)
+		}
 		if err := agent.RunInteractiveEnrollment(ctx, cfg, client, c.Logger, c.Version, c.stdinOrDefault(), c.stdoutOrDefault()); err != nil {
 			return err
 		}
@@ -334,7 +337,10 @@ func (c CLI) Bootstrap(ctx context.Context, args []string) error {
 		}
 	}
 
-	client := api.NewClient(cfg.APIURL, cfg.RequestTimeout)
+	client, err := api.NewClient(cfg.APIURL, cfg.RequestTimeout, cfg.APITLSCAFile)
+	if err != nil {
+		return fmt.Errorf("configure API client: %w", err)
+	}
 	_, err = agent.RunBootstrapEnrollment(
 		ctx,
 		cfg,
@@ -1796,8 +1802,11 @@ func promptValue(reader *bufio.Reader, writer io.Writer, label, defaultValue str
 
 func (c CLI) bootstrapManagedInstall(ctx context.Context, spec platformSpec, cfg config.Config) error {
 	if strings.TrimSpace(spec.ServiceUser) == "" {
-		client := api.NewClient(cfg.APIURL, cfg.RequestTimeout)
-		_, err := agent.RunBootstrapEnrollment(
+		client, err := api.NewClient(cfg.APIURL, cfg.RequestTimeout, cfg.APITLSCAFile)
+		if err != nil {
+			return fmt.Errorf("configure API client: %w", err)
+		}
+		_, err = agent.RunBootstrapEnrollment(
 			ctx,
 			cfg,
 			client,

internal/agentctl/update.go

@@ -238,7 +238,10 @@ func (c CLI) applyManagedUpdate(
 		return fmt.Errorf("managed agent identity is missing; self-update requires a registered node id and agent token")
 	}
 
-	client := api.NewClient(cfg.APIURL, cfg.RequestTimeout)
+	client, err := api.NewClient(cfg.APIURL, cfg.RequestTimeout, cfg.APITLSCAFile)
+	if err != nil {
+		return fmt.Errorf("configure API client: %w", err)
+	}
 	client.SetAgentNodeID(cfg.NodeID)
 	client.SetAgentToken(cfg.AgentToken)
 
@@ -386,7 +389,10 @@ func (c CLI) reportManagedUpdateProgress(
 		return fmt.Errorf("managed agent identity is missing")
 	}
 
-	client := api.NewClient(cfg.APIURL, cfg.RequestTimeout)
+	client, err := api.NewClient(cfg.APIURL, cfg.RequestTimeout, cfg.APITLSCAFile)
+	if err != nil {
+		return fmt.Errorf("configure API client: %w", err)
+	}
 	client.SetAgentNodeID(cfg.NodeID)
 	client.SetAgentToken(cfg.AgentToken)
 

internal/api/client.go

@@ -2,7 +2,10 @@ package api
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"fmt"
+	"os"
 	"net/url"
 	"strings"
 	"time"
@@ -38,7 +41,7 @@ func (e *RequestError) Error() string {
 	return fmt.Sprintf("%s %s: status=%d message=%s", strings.ToUpper(e.Method), e.Path, e.StatusCode, message)
 }
 
-func NewClient(baseURL string, timeout time.Duration) *Client {
+func NewClient(baseURL string, timeout time.Duration, tlsCAFile string) (*Client, error) {
 	httpClient := resty.New().
 		SetBaseURL(strings.TrimRight(baseURL, "/")).
 		SetTimeout(timeout).
@@ -55,7 +58,27 @@ func NewClient(baseURL string, timeout time.Duration) *Client {
 			return response.StatusCode() == 429 || response.StatusCode() >= 500
 		})
 
-	return &Client{http: httpClient}
+	rootCAs, err := x509.SystemCertPool()
+	if err != nil || rootCAs == nil {
+		rootCAs = x509.NewCertPool()
+	}
+
+	if strings.TrimSpace(tlsCAFile) != "" {
+		pemBytes, readErr := os.ReadFile(strings.TrimSpace(tlsCAFile))
+		if readErr != nil {
+			return nil, fmt.Errorf("read API TLS CA file %s: %w", strings.TrimSpace(tlsCAFile), readErr)
+		}
+		if ok := rootCAs.AppendCertsFromPEM(pemBytes); !ok {
+			return nil, fmt.Errorf("parse API TLS CA file %s: no certificates found", strings.TrimSpace(tlsCAFile))
+		}
+	}
+
+	httpClient.SetTLSClientConfig(&tls.Config{
+		MinVersion: tls.VersionTLS12,
+		RootCAs:    rootCAs,
+	})
+
+	return &Client{http: httpClient}, nil
 }
 
 func (c *Client) SetAgentToken(token string) {

internal/config/config.go

@@ -29,6 +29,7 @@ const (
 
 type Config struct {
 	APIURL                string
+	APITLSCAFile          string
 	EnrollmentToken       string
 	NodeID                string
 	AgentToken            string
@@ -51,6 +52,7 @@ type Config struct {
 
 type fileConfig struct {
 	APIURL                string   `json:"api_url"`
+	APITLSCAFile          string   `json:"api_tls_ca_file,omitempty"`
 	EnrollmentToken       string   `json:"enrollment_token"`
 	NodeID                string   `json:"node_id"`
 	AgentToken            string   `json:"agent_token"`
@@ -138,6 +140,7 @@ func SaveFile(path string, cfg Config) error {
 	realtimeBackoffJitter := cfg.RealtimeBackoffJitter
 	raw := fileConfig{
 		APIURL:                cfg.APIURL,
+		APITLSCAFile:          cfg.APITLSCAFile,
 		EnrollmentToken:       cfg.EnrollmentToken,
 		NodeID:                cfg.NodeID,
 		AgentToken:            cfg.AgentToken,
@@ -196,6 +199,11 @@ func (c Config) Validate() error {
 	if parsedURL.Host == "" {
 		return fmt.Errorf("API_URL must include a host, got %q", c.APIURL)
 	}
+	if strings.TrimSpace(c.APITLSCAFile) != "" {
+		if _, err := os.Stat(c.APITLSCAFile); err != nil {
+			return fmt.Errorf("API_TLS_CA_FILE is invalid: %w", err)
+		}
+	}
 	if c.HeartbeatInterval <= 0 {
 		return fmt.Errorf("HEARTBEAT_INTERVAL must be greater than zero")
 	}
@@ -281,6 +289,9 @@ func mergeConfigFile(cfg *Config, path string) error {
 	if raw.APIURL != "" {
 		cfg.APIURL = strings.TrimSpace(raw.APIURL)
 	}
+	if raw.APITLSCAFile != "" {
+		cfg.APITLSCAFile = filepath.Clean(strings.TrimSpace(raw.APITLSCAFile))
+	}
 	if raw.EnrollmentToken != "" {
 		cfg.EnrollmentToken = raw.EnrollmentToken
 	}
@@ -339,6 +350,7 @@ func mergeConfigFile(cfg *Config, path string) error {
 
 func mergeEnv(cfg *Config) error {
 	overrideStringAny(&cfg.APIURL, "NODERAX_API_URL", "API_URL")
+	overrideStringAny(&cfg.APITLSCAFile, "NODERAX_API_TLS_CA_FILE", "API_TLS_CA_FILE")
 	overrideString(&cfg.EnrollmentToken, "ENROLLMENT_TOKEN")
 	overrideString(&cfg.NodeID, "NODE_ID")
 	overrideString(&cfg.AgentToken, "AGENT_TOKEN")
@@ -381,6 +393,9 @@ func mergeEnv(cfg *Config) error {
 	if cfg.StateFile != "" {
 		cfg.StateFile = filepath.Clean(cfg.StateFile)
 	}
+	if cfg.APITLSCAFile != "" {
+		cfg.APITLSCAFile = filepath.Clean(cfg.APITLSCAFile)
+	}
 	if cfg.RealtimeNamespace != "" && !strings.HasPrefix(cfg.RealtimeNamespace, "/") {
 		cfg.RealtimeNamespace = "/" + cfg.RealtimeNamespace
 	}