mTLS & Network
mTLS implementedNegative matrix 18/18Ports 6543 / 5432 / 3000
Client-to-AXIS and AXIS-to-backend TLS/mTLS are implemented on the shared write-path transport (native pgwire forwarder, CancelRequest path, and API DbPool). The negative mTLS matrix passes 18/18 — plaintext and certificate-verification-bypass mutations fail closed. Cleartext traffic is a lab-only configuration, not a supported production mode.
Topology
Transport posture: TLS/mTLS on client-to-AXIS and AXIS-to-backend paths; direct :5432 access is the documented bypass to close.
Ports and listeners
| Port | Owner | Purpose |
|---|---|---|
6543 | AXIS | HTTP API (LISTEN_ADDR, default 0.0.0.0:6543) |
6544 | AXIS pgwire lab | Native wire listener, disabled by default (AXIS_PGWIRE_ENABLED=false) |
5432 | PostgreSQL | Protected database (DB_HOST/DB_PORT) |
3000 | Control Plane | Operator UI; proxies /api/axis/* |
6545 | AXIS (prod-like) | Production-like instance in the extended demo stack |
65430 / 54320 | Reviewer stack | AXIS + PostgreSQL for the reviewer/demo environment |
TLS / mTLS variables (hardened core)
| Variable | Notes |
|---|---|
AXIS_TLS_REQUIRE_CLIENT_CERT | Require and validate a client certificate (mTLS); production profile rejects false |
AXIS_TLS_CLIENT_CA_BUNDLE_PATH / AXIS_TLS_SERVER_CERT_PATH / AXIS_TLS_SERVER_KEY_PATH | Client-to-AXIS TLS termination material |
AXIS_TLS_UPSTREAM_CLIENT_CERT_PATH / AXIS_TLS_UPSTREAM_CLIENT_KEY_PATH / AXIS_TLS_UPSTREAM_CA_BUNDLE_PATH | AXIS-to-PostgreSQL mTLS material (upstream) |
AXIS_PG_HBA_PROXY_CIDR / AXIS_ENFORCE_PG_HBA_BASELINE / AXIS_PG_HBA_CHECK_INTERVAL_MINUTES | pg_hba proxy-only hostssl/cert baseline enforcement; drift → signed AXIS_PG_HBA_DRIFT_DETECTED audit event |
AXIS_TLS_MIN_VERSION | Minimum TLS version (e.g. 1.2) |
mTLS status (2026-08)
| Item | Status | Detail |
|---|---|---|
| Client-to-AXIS TLS/mTLS | Implemented | Shared write-path transport; AXIS_TLS_REQUIRE_CLIENT_CERT enforced |
| AXIS-to-backend mTLS | Implemented | Upstream client cert + CA bundle on the native pgwire forwarder and API DbPool |
| CancelRequest path | Implemented | Runs over the same mTLS transport (RFC-032 status update 2026-08) |
| Negative mTLS matrix | 18/18 passed | Plaintext and certificate-verification-bypass mutations (invalid CA, hostname-only bypass, disabled verification) all fail closed |
| Cleartext traffic | Lab-only | Not a supported production mode; pg_hba baseline blocks proxy-only hostssl/cert elsewhere |
| Control Plane HTTPS | Implemented | Production mode uses HTTPS; pilot runs HTTP on localhost |
| Production posture | Required | Certificate rotation, expiry monitoring and key management (KMS/OIDC) remain enterprise requirements |
Control Plane proxy details
- Browser →
/api/axis/*→ server-side fetch toAXIS_BACKEND_URL; backend URL and token never reach the browser. - Real mode reads live endpoints (
health,logs,runtime/stats, approvals, policies); mock mode is explicit demo-only. - Production mode requires
NEXTAUTH_URL, admin credentials and HTTPS; secrets are passed via environment in the demo stack.
mTLS is implemented and the negative matrix passes (18/18), but cleartext remains lab-only. Production deployments must enforce AXIS_TLS_REQUIRE_CLIENT_CERT=true, keep PostgreSQL host-only (pg_hba baseline), and complete certificate lifecycle management.
Related: Security Model · Deployment · Security Review