Improve sidecar gateway error diagnostics

Author: sl5-guy

Cargo.lock

@@ -1,40 +1,3 @@
 [workspace]
-members = [".", "sidecar"]
-
-[package]
-name = "agent_gateway"
-version = "0.1.0"
-edition = "2024"
-
-[dependencies]
-tokio = { version = "1", features = ["io-util", "macros", "net", "rt-multi-thread", "signal", "time"] }
-rustls = { version = "0.23", default-features = false, features = ["aws-lc-rs", "std", "tls12"] }
-tokio-rustls = { version = "0.26", default-features = false, features = ["aws-lc-rs", "tls12"] }
-rustls-pemfile = "2"
-rustls-pki-types = "1"
-x509-parser = { version = "0.18", default-features = false }
-hyper = { version = "1", features = ["server", "http2"] }
-hyper-util = { version = "0.1", features = ["tokio", "server-auto"] }
-http = "1"
-http-body-util = "0.1"
-bytes = "1"
-serde = { version = "1", features = ["derive"] }
-toml = "1"
-async-trait = "0.1"
-clap = { version = "4", features = ["derive"] }
-tracing = "0.1"
-tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
-tracing-opentelemetry = "0.32"
-opentelemetry = "0.31"
-opentelemetry_sdk = { version = "0.31", default-features = false, features = ["rt-tokio", "trace"] }
-opentelemetry-otlp = { version = "0.31", default-features = false, features = ["grpc-tonic", "trace"] }
-anyhow = "1"
-sqlx = { version = "0.8.6", default-features = false, features = ["runtime-tokio-rustls", "postgres", "chrono", "derive"] }
-chrono = "0.4.44"
-p256 = { version = "0.13.2", features = ["ecdsa", "pkcs8"] }
-
-[dev-dependencies]
-rcgen = { version = "0.14", features = ["x509-parser"] }
-tokio-test = "0.4"
-hyper = { version = "1", features = ["client"] }
-sqlx = { version = "0.8.6", default-features = false, features = ["migrate", "macros"] }
+members = ["sidecar"]
+resolver = "3"

Cargo.toml

@@ -1,13 +1,13 @@
-# agent_gateway
+# agent_gateway demo
 
-An mTLS HTTP/2 CONNECT proxy that authorizes connections based on custom X.509 certificate extensions.
+Demo and support tooling for an mTLS HTTP/2 CONNECT proxy that authorizes connections based on custom X.509 certificate extensions.
 
 The proxy accepts incoming mTLS connections, extracts a custom extension value from the client certificate, and checks a PostgreSQL-backed signed permission registry to decide whether the client may connect to the requested destination. If allowed, it opens a raw TCP connection to the destination and tunnels data bidirectionally. The client is responsible for establishing its own TLS session to the destination through the tunnel.
 
 ## Building
 
 ```
-cargo build --release
+cargo build -p agent_gateway_sidecar
 ```
 
 The sidecar uses a simulated TPM identity. Install the native TPM stack before
@@ -20,12 +20,13 @@ sudo apt-get install libtss2-dev swtpm tpm2-tools pkg-config
 ## Quick start
 
 ```bash
+export AGENT_GATEWAY_DEMO_GATEWAY_IMAGE=ghcr.io/sl5taskforce/agent-gateway:main
 ./demo/setup.sh
 ```
 
 The setup script generates demo TLS material, creates `config.toml` when needed,
 starts Postgres and static HTTPS mock services with Podman Compose or Docker Compose, applies the
-database migration, builds and starts the gateway, enrolls a demo principal,
+database migration, starts the configured gateway image, enrolls a demo principal,
 grants access to `docstore` and `messaging`, creates a demo agent handle, and
 verifies that Claude Code can fetch `https://docstore/health` through the
 gateway.

README.md

@@ -20,9 +20,11 @@ GATEWAY="${AGENT_GATEWAY_DEMO_GATEWAY:-127.0.0.1:8443}"
 GATEWAY_CA="${AGENT_GATEWAY_DEMO_GATEWAY_CA:-$REPO_ROOT/certs/server-ca.pem}"
 MOCK_CA="${AGENT_GATEWAY_DEMO_MOCK_CA:-$REPO_ROOT/certs/mock-ca.pem}"
 SIDECAR_BIN="$REPO_ROOT/target/debug/agent_gateway_sidecar"
+GATEWAY_IMAGE="${AGENT_GATEWAY_DEMO_GATEWAY_IMAGE:-ghcr.io/sl5taskforce/agent-gateway:main}"
 VERIFY_TIMEOUT_SECONDS="${AGENT_GATEWAY_DEMO_VERIFY_TIMEOUT_SECONDS:-120}"
 
 export COMPOSE_PROJECT_NAME
+export AGENT_GATEWAY_DEMO_GATEWAY_IMAGE="$GATEWAY_IMAGE"
 
 require_cmd() {
   command -v "$1" >/dev/null 2>&1 || {
@@ -144,8 +146,7 @@ fi
 echo "==> Building local sidecar"
 cargo build -p agent_gateway_sidecar
 
-echo "==> Building gateway image"
-compose build gateway
+echo "==> Using gateway image $GATEWAY_IMAGE"
 
 echo "==> Starting Postgres and mock HTTPS services"
 compose up -d --force-recreate postgres mock-services

demo/gateway.Dockerfile

@@ -28,18 +28,17 @@ services:
           - messaging
 
   gateway:
-    build:
-      context: .
-      dockerfile: demo/gateway.Dockerfile
-    image: agent-gateway-demo-gateway
+    image: ${AGENT_GATEWAY_DEMO_GATEWAY_IMAGE:-ghcr.io/sl5taskforce/agent-gateway:main}
     working_dir: /workspaces/agent_gateway
     command: --config config.toml
     environment:
       AGENT_GATEWAY_DATABASE_URL: postgres://agent_gateway_admin:agent_gateway_dev@postgres:5432/agent_gateway
     ports:
       - "8443:8443"
     volumes:
-      - .:/workspaces/agent_gateway
+      - ./config.toml:/workspaces/agent_gateway/config.toml:ro
+      - ./certs/server.pem:/workspaces/agent_gateway/certs/server.pem:ro
+      - ./certs/server-key.pem:/workspaces/agent_gateway/certs/server-key.pem:ro
     depends_on:
       - postgres
       - mock-services

demo/setup.sh

@@ -288,6 +288,7 @@ async fn handle(
                     dest_authority = %authority,
                     gateway_endpoint = %connector.gateway_endpoint(),
                     error = %e,
+                    error_chain = %format_args!("{e:#}"),
                     "gateway connect failed"
                 );
                 return response(StatusCode::BAD_GATEWAY, "gateway unreachable");