Sensitive files in the OpenShell config directory (~/.config/openshell/)
were created with default umask permissions, making them world-readable.
This is a security concern for mTLS private keys (tls.key) and auth
tokens.
- Add centralized paths module to openshell-core with permission helpers
(create_dir_restricted 0o700, set_file_owner_only 0o600)
- Set 0o600 on tls.key in mtls.rs (was inheriting umask, typically 0o644)
- Set 0o700 on all config directories (mtls/, gateways/, forwards/, etc.)
- Migrate legacy cf_token files to new edge_token path with proper perms
- Deduplicate xdg_config_dir() from 6 locations into openshell-core
PR #281 removed the shared openshell-cluster Docker network in favor of
the default bridge. This restores custom bridge networking but makes each
gateway use its own isolated network named openshell-cluster-{name},
matching the existing container/volume naming convention.
Changes:
- Add network_name() to constants.rs for per-gateway network naming
- Add ensure_network() with retry/backoff and force_remove_network()
parameterized by network name instead of a global constant
- Attach containers to their per-gateway network via network_mode
- Disconnect and remove the network during gateway destroy
- Wire ensure_network() into the deploy flow before ensure_volume()
- Update architecture docs to reflect per-gateway network isolation
Drew Newberry