AegisMesh MVP uses NATS username/password authentication for simplicity in local dev/test environments. TLS is disabled by default.

⚠️ This is NOT production-ready for adversarial networks.

Code locations to update:

• Agent (services/agent/src/main.rs):

  // FUTURE: Add mTLS client cert
  // let tls_opts = nats::TlsOptions::new()
  //     .client_cert("path/to/cert.pem", "path/to/key.pem")
  //     .ca_cert("path/to/ca.pem");
  // let nc = nats::connect_with_options(nats_url, opts.tls_options(tls_opts))?;

• Gateway (services/gateway/src/main.rs): Same pattern

• NATS server (deploy/docker-compose.dev.yml):

  # Mount certs and update nats-server.conf:
  # tls {
  #   cert_file: "/certs/server.pem"
  #   key_file: "/certs/server-key.pem"
  #   ca_file: "/certs/ca.pem"
  #   verify: true
  # }

• Deploy SPIRE server (control plane) and SPIRE agent (per node)
• Each workload (agent, gateway) gets a short-lived X.509 SVID via Unix domain socket
• Replace hardcoded cert paths with SPIRE Workload API calls (e.g., spiffe-helper sidecar or native SDK)

Benefits:

• Automatic cert rotation
• Zero-trust: every workload has cryptographic identity
• Audit trail via SPIRE server logs

Gateway (services/gateway/src/main.rs):

// FUTURE: gRPC server with mTLS
// use tonic::transport::ServerTlsConfig;
// let tls = ServerTlsConfig::new()
//     .identity(Identity::from_pem(cert_pem, key_pem))
//     .client_ca_root(Certificate::from_pem(ca_pem));
// Server::builder().tls_config(tls)?.add_service(svc).serve(addr).await?;

UI (if using gRPC-web): Proxy (e.g., Envoy) handles mTLS termination

• Add TLS termination at Gateway Axum server or reverse proxy (Traefik/Nginx)
• Self-signed certs for dev; LetsEncrypt for staging/prod

• Use Vault, AWS Secrets Manager, or K8s Secrets for NATS credentials
• Never commit secrets to Git (already .gitignore'd)

• Adversary: Nation-state jamming, man-in-the-middle, rogue insider
• Assets: Telemetry data, tasking commands, operator credentials
• Mitigations: mTLS (confidentiality + authenticity), SPIFFE (identity), Vault (secrets), audit logs (detection)

• NIST SP 800-207 (Zero Trust Architecture)
• DoD Zero Trust Reference Architecture
• CNSSI 1253 (for classified environments, add: AES-256, FIPS 140-2 modules)

Email security@example.com (replace with real contact). PGP key available at keybase.io/yourorg.