Root mTLS trust in signed registry

Bind authorization to the presented client certificate key in Postgres so client CA bundles are no longer a trust root.

Author: sl5-guy

Cargo.lock

@@ -31,7 +31,6 @@ opentelemetry-otlp = { version = "0.31", features = ["grpc-tonic"] }
 anyhow = "1"
 sqlx = { version = "0.8.6", default-features = false, features = ["runtime-tokio-rustls", "postgres", "chrono", "migrate", "macros", "derive"] }
 chrono = { version = "0.4.44", features = ["serde"] }
-sha2 = "0.11.0"
 p256 = { version = "0.13.2", features = ["ecdsa", "pkcs8"] }
 
 [dev-dependencies]

Cargo.toml

@@ -2,14 +2,10 @@
 listen_addr = "0.0.0.0:8443"
 tls_cert_path = "certs/server.pem"
 tls_key_path = "certs/server-key.pem"
-# Concatenated PEM of per-machine client CAs (from connect.sh: machine-client-ca.pem).
-# Append one -----BEGIN CERTIFICATE----- block per enrolled machine; restart the gateway to load.
-client_ca_path = "certs/client-ca-bundle.pem"
 
 [observability]
 log_level = "info"
 otlp_endpoint = "http://localhost:4317"
-
 [policy]
 # Custom extension OID to extract from client certs.
 client_ext_oid = "1.3.6.1.4.1.57264.1.1"