foxhunt/services/trading_agent_service/README_TLS.md

Trading Agent Service TLS Implementation

Quick Start

Enable TLS

# Set environment variables
export TLS_ENABLED=true
export MTLS_ENABLED=true  # Optional: enable mutual TLS

# Start service
cargo run --bin trading_agent_service

Generate Test Certificates

# Run the automated setup script
./scripts/verify_tls.sh

# Or manually:
cd /tmp/foxhunt/certs

# 1. Generate CA
openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 365 -key ca.key \
    -out ca.crt \
    -subj "/CN=Foxhunt Trading Agent CA"

# 2. Generate server certificate
openssl genrsa -out server.key 4096
openssl req -new -key server.key \
    -out server.csr \
    -subj "/CN=trading-agent-service"

# 3. Sign server certificate
openssl x509 -req -days 365 \
    -in server.csr \
    -CA ca.crt \
    -CAkey ca.key \
    -CAcreateserial \
    -out server.crt

Configuration

Environment Variables

Variable	Default	Description
TLS_ENABLED	false	Enable/disable TLS
MTLS_ENABLED	false	Enable mutual TLS (client cert validation)
TLS_CERT_PATH	/tmp/foxhunt/certs/server.crt	Server certificate path
TLS_KEY_PATH	/tmp/foxhunt/certs/server.key	Server private key path
TLS_CA_PATH	/tmp/foxhunt/certs/ca.crt	CA certificate path (for mTLS)

Testing

# Run TLS tests (non-ignored)
cargo test --test tls_test

# Run all tests including integration tests
cargo test --test tls_test -- --ignored

# Verify TLS configuration
./scripts/verify_tls.sh

Client Connection Example

use tonic::transport::{Certificate, Channel, ClientTlsConfig, Identity};

async fn connect() -> Result<Channel> {
    let cert_pem = tokio::fs::read_to_string("/tmp/foxhunt/certs/client.crt").await?;
    let key_pem = tokio::fs::read_to_string("/tmp/foxhunt/certs/client.key").await?;
    let ca_pem = tokio::fs::read_to_string("/tmp/foxhunt/certs/ca.crt").await?;

    let tls = ClientTlsConfig::new()
        .identity(Identity::from_pem(cert_pem, key_pem))
        .ca_certificate(Certificate::from_pem(ca_pem))
        .domain_name("trading-agent-service");

    Channel::from_shared("https://localhost:50055")?
        .tls_config(tls)?
        .connect()
        .await
}

Documentation

For complete documentation, see:

• AGENT_S6_TLS_TRADING_AGENT_SERVICE_COMPLETE.md - Full implementation guide
• tests/tls_test.rs - Test suite examples
• scripts/verify_tls.sh - Verification script

Support

For issues or questions:

1. Check the verification script output: ./scripts/verify_tls.sh
2. Verify certificates are valid: openssl x509 -in /tmp/foxhunt/certs/server.crt -text -noout
3. Check service logs for TLS-related errors

Security Notes

• Production: Use proper certificate management (Vault, cert-manager, etc.)
• Development: Test certificates are fine for local testing
• mTLS: Enable for maximum security in production environments
• TLS 1.3: Modern protocol with improved security and performance