mTLS & Network
Partial — mTLS not completedPorts 6543 / 5432 / 3000
The v0.6 pilot runs over HTTP on the trusted lab network. TLS configuration variables exist; a complete, reviewed mTLS story is a documented production requirement, not a shipped feature.
Topology
Pilot networking: HTTP API on :6543, PostgreSQL on :5432, Control Plane on :3000; direct :5432 access is the documented bypass to close.
Ports and listeners
| Port | Owner | Purpose |
|---|---|---|
6543 | AXIS | HTTP API (LISTEN_ADDR, default 0.0.0.0:6543) |
6544 | AXIS pgwire lab | Native wire listener, disabled by default (AXIS_PGWIRE_ENABLED=false) |
5432 | PostgreSQL | Protected database (DB_HOST/DB_PORT) |
3000 | Control Plane | Operator UI; proxies /api/axis/* |
6545 | AXIS (prod-like) | Production-like instance in the extended demo stack |
65430 / 54320 | Reviewer stack | AXIS + PostgreSQL for the reviewer/demo environment |
TLS variables
| Variable | Default | Notes |
|---|---|---|
AXIS_TLS_ENABLED | false | Master TLS switch; false in the v0.6 pilot |
AXIS_TLS_CERT_PATH / AXIS_TLS_KEY_PATH | — | Certificate and key file paths |
AXIS_TLS_CA_PATH | — | Client CA for mutual TLS validation |
AXIS_TLS_REQUIRE_CLIENT_CERT | false | Require and validate a client certificate (mTLS) |
AXIS_TLS_MIN_VERSION | — | Minimum TLS version (e.g. 1.2) |
PGSSLMODE-related / DATABASE_URL options | — | AXIS → PostgreSQL connection security; not part of the complete v0.6 story |
mTLS status
| Item | Status | Detail |
|---|---|---|
| Server TLS on AXIS listener | Partial | Variables exist; not validated in the v0.6 pilot |
| Client certificate (mTLS) enforcement | Partial | AXIS_TLS_REQUIRE_CLIENT_CERT exists; complete mTLS review pending |
| Control Plane HTTPS | Implemented | Production mode uses HTTPS; pilot runs HTTP on localhost |
| AXIS → PostgreSQL TLS | Partial | Variables exist; not part of the complete v0.6 story |
| Production mTLS requirement | Required | Documented review gate: mTLS between AXIS and clients before production |
Control Plane proxy details
- Browser →
/api/axis/*→ server-side fetch toAXIS_BACKEND_URL; backend URL and token never reach the browser. - Real mode reads live endpoints (
health,logs,runtime/stats, approvals, policies); mock mode is explicit demo-only. - Production mode requires
NEXTAUTH_URL, admin credentials and HTTPS; secrets are passed via environment in the demo stack.
The pilot runs on a trusted lab network over HTTP. For any production use, complete the mTLS and TLS-to-PostgreSQL review gates first.
Related: Security Model · Deployment · Security Review