Classify nested managed service reloads

Author: eldryoth

CHANGELOG.md

@@ -32,6 +32,9 @@ behavior when the change improves security or project direction.
 - Make reload safety allowlist-based and require process replacement for
   startup-owned TLS, listener, stream, UDP, ACME, cache-purger, and tracing
   changes.
+- Classify nested managed ACME targets and managed vhost/route PHP-FPM process
+  definitions as startup-owned while retaining snapshot reload for ordinary
+  routing and request-time PHP policy.
 - Enforce trusted ownership and non-writable permissions across complete config
   source and sensitive-path ancestor chains, with descriptor identity and
   mid-read modification checks for TOML sources.

crates/fluxheim-config/src/reload.rs

@@ -4,6 +4,10 @@ use crate::config::{ProxyConfig, VhostConfig};
 #[cfg(feature = "load-balancer")]
 use std::path::PathBuf;
 
+#[path = "reload_service_signatures.rs"]
+mod reload_service_signatures;
+use reload_service_signatures::{managed_acme_services, managed_php_services};
+
 #[derive(Debug, Clone, Eq, PartialEq)]
 pub enum ReloadImpact {
     Noop,
@@ -43,6 +47,7 @@ pub enum ReloadReason {
     TlsClientAuthChanged,
     ComplianceModeChanged,
     AcmeServiceChanged,
+    ManagedPhpServiceChanged,
     AdminServiceChanged,
     MetricsServiceChanged,
     TracingServiceChanged,
@@ -88,6 +93,7 @@ impl std::fmt::Display for ReloadReason {
             Self::TlsClientAuthChanged => "tls-client-auth-changed",
             Self::ComplianceModeChanged => "compliance-mode-changed",
             Self::AcmeServiceChanged => "acme-service-changed",
+            Self::ManagedPhpServiceChanged => "managed-php-service-changed",
             Self::AdminServiceChanged => "admin-service-changed",
             Self::MetricsServiceChanged => "metrics-service-changed",
             Self::TracingServiceChanged => "tracing-service-changed",
@@ -147,10 +153,14 @@ pub fn classify_reload(old: &Config, new: &Config) -> ReloadImpact {
         reasons.push(ReloadReason::ComplianceModeChanged);
     }
 
-    if old.tls.acme != new.tls.acme {
+    if old.tls.acme != new.tls.acme || managed_acme_services(old) != managed_acme_services(new) {
         reasons.push(ReloadReason::AcmeServiceChanged);
     }
 
+    if managed_php_services(old) != managed_php_services(new) {
+        reasons.push(ReloadReason::ManagedPhpServiceChanged);
+    }
+
     if old.tls.profile != new.tls.profile
         || old.tls.min_protocol != new.tls.min_protocol
         || old.tls.alpn != new.tls.alpn
@@ -206,8 +216,9 @@ pub fn classify_reload(old: &Config, new: &Config) -> ReloadImpact {
 }
 
 fn only_snapshot_safe_fields_changed(old: &Config, new: &Config) -> bool {
-    // These exhaustive destructures make future schema fields fail compilation until their
-    // reload ownership is classified explicitly.
+    // This exhaustive top-level destructure makes future Config fields fail compilation until
+    // their reload ownership is classified explicitly. Nested startup-owned fields are audited
+    // by the service-signature module.
     let Config {
         server: _,
         admin: _,

crates/fluxheim-config/src/reload_security_tests.rs

@@ -2,8 +2,12 @@ use crate::config::{Config, DownstreamProxyProtocol, TlsClientAuthConfig, TlsCli
 use crate::reload::{ReloadImpact, ReloadReason, classify_reload};
 
 fn assert_process_upgrade(new: Config, expected: ReloadReason) {
+    assert_transition_requires_process_upgrade(&Config::default(), &new, expected);
+}
+
+fn assert_transition_requires_process_upgrade(old: &Config, new: &Config, expected: ReloadReason) {
     assert_eq!(
-        classify_reload(&Config::default(), &new),
+        classify_reload(old, new),
         ReloadImpact::ProcessUpgrade {
             reasons: vec![expected],
         }
@@ -90,3 +94,160 @@ fn certificate_lookup_change_remains_snapshot_safe() {
         ReloadImpact::Snapshot
     );
 }
+
+fn managed_acme_config() -> Config {
+    toml::from_str(
+        r#"
+            [[vhosts]]
+            name = "site"
+            hosts = ["site.example.test"]
+
+            [vhosts.tls]
+            enabled = true
+
+            [vhosts.tls.acme]
+            enabled = true
+            issuer = "primary"
+        "#,
+    )
+    .unwrap()
+}
+
+#[test]
+fn nested_acme_enablement_requires_process_upgrade() {
+    let new = managed_acme_config();
+    let mut old = new.clone();
+    old.vhosts[0].tls.acme.enabled = false;
+
+    assert_transition_requires_process_upgrade(&old, &new, ReloadReason::AcmeServiceChanged);
+    assert_transition_requires_process_upgrade(&new, &old, ReloadReason::AcmeServiceChanged);
+}
+
+#[test]
+fn nested_acme_identity_and_targets_require_process_upgrade() {
+    let old = managed_acme_config();
+    let mut changes = Vec::new();
+
+    let mut issuer = old.clone();
+    issuer.vhosts[0].tls.acme.issuer = Some("secondary".to_owned());
+    changes.push(issuer);
+
+    let mut domains = old.clone();
+    domains.vhosts[0].tls.acme.domains = vec!["certificate.example.test".to_owned()];
+    changes.push(domains);
+
+    let mut inherited_hosts = old.clone();
+    inherited_hosts.vhosts[0].hosts = vec!["renamed.example.test".to_owned()];
+    changes.push(inherited_hosts);
+
+    let mut vhost_name = old.clone();
+    vhost_name.vhosts[0].name = "renamed".to_owned();
+    changes.push(vhost_name);
+
+    for new in changes {
+        assert_transition_requires_process_upgrade(&old, &new, ReloadReason::AcmeServiceChanged);
+    }
+}
+
+fn managed_php_config() -> Config {
+    toml::from_str(
+        r#"
+            [[vhosts]]
+            name = "php"
+            hosts = ["php.example.test"]
+
+            [vhosts.php]
+            enabled = true
+
+            [vhosts.php.fpm]
+            mode = "managed"
+            php_fpm_binary = "/usr/sbin/php-fpm"
+            socket_dir = "/run/fluxheim/php"
+        "#,
+    )
+    .unwrap()
+}
+
+#[test]
+fn managed_php_add_remove_requires_process_upgrade() {
+    let new = managed_php_config();
+    let old = Config::default();
+
+    assert_transition_requires_process_upgrade(&old, &new, ReloadReason::ManagedPhpServiceChanged);
+    assert_transition_requires_process_upgrade(&new, &old, ReloadReason::ManagedPhpServiceChanged);
+}
+
+#[test]
+fn managed_php_process_policy_changes_require_process_upgrade() {
+    let old = managed_php_config();
+    let mut changes = Vec::new();
+
+    let mut binary = old.clone();
+    binary.vhosts[0].php.fpm.php_fpm_binary = Some("/opt/php/sbin/php-fpm".into());
+    changes.push(binary);
+
+    let mut identity = old.clone();
+    identity.vhosts[0].php.fpm.user = Some("www-data".to_owned());
+    identity.vhosts[0].php.fpm.group = Some("www-data".to_owned());
+    changes.push(identity);
+
+    let mut environment = old.clone();
+    environment.vhosts[0].php.fpm.clear_env = false;
+    changes.push(environment);
+
+    let mut socket_dir = old.clone();
+    socket_dir.vhosts[0].php.fpm.socket_dir = Some("/run/fluxheim/php-next".into());
+    changes.push(socket_dir);
+
+    let mut workers = old.clone();
+    workers.vhosts[0].php.fpm.process_manager = crate::config::PhpFpmProcessManager::Dynamic;
+    workers.vhosts[0].php.fpm.workers = 8;
+    workers.vhosts[0].php.fpm.min_spare_servers = Some(2);
+    workers.vhosts[0].php.fpm.max_spare_servers = Some(4);
+    changes.push(workers);
+
+    for new in changes {
+        assert_transition_requires_process_upgrade(
+            &old,
+            &new,
+            ReloadReason::ManagedPhpServiceChanged,
+        );
+    }
+}
+
+#[test]
+fn route_managed_php_addition_requires_process_upgrade() {
+    let old = Config::default();
+    let new: Config = toml::from_str(
+        r#"
+            [[vhosts]]
+            name = "php"
+            hosts = ["php.example.test"]
+
+            [[vhosts.routes]]
+            name = "application"
+            path_prefix = "/app"
+
+            [vhosts.routes.php]
+            enabled = true
+
+            [vhosts.routes.php.fpm]
+            mode = "managed"
+            php_fpm_binary = "/usr/sbin/php-fpm"
+            socket_dir = "/run/fluxheim/php-route"
+        "#,
+    )
+    .unwrap();
+
+    assert_transition_requires_process_upgrade(&old, &new, ReloadReason::ManagedPhpServiceChanged);
+}
+
+#[test]
+fn managed_php_request_policy_change_remains_snapshot_safe() {
+    let old = managed_php_config();
+    let mut new = old.clone();
+    new.vhosts[0].php.request_timeout_secs += 1;
+    new.vhosts[0].php.fpm.read_timeout_secs = Some(15);
+
+    assert_eq!(classify_reload(&old, &new), ReloadImpact::Snapshot);
+}