Let Periphery send extra websocket headers to Core from a file

[AzScep]

Problem

In outbound mode Periphery opens a websocket to Core, but it has no way to add headers to that request. So it can't get through an authenticating reverse proxy in front of Core. For example, with Cloudflare Access protecting the whole Core hostname, a client has to send CF-Access-Client-Id and CF-Access-Client-Secret service token headers. Today the only option is a bypass rule for /ws/periphery.

Change

• New Periphery setting core_headers_file (PERIPHERY_CORE_HEADERS_FILE). It points to a file with one Name: value header per line, which is added to the websocket upgrade request. Blank lines and # comments are ignored. An empty env value counts as unset.
• The file is read again on every connection attempt, so rotated values take effect on the next reconnect without a restart.
• Periphery refuses to start if the file is missing, has no headers or an invalid line, isn't owned by the user Periphery runs as, or can be accessed by group or others (chmod 600).
• Header values are secrets: they are marked sensitive and never appear in error messages or logs. Headers that the websocket handshake sets itself (Host, Connection, Upgrade, Sec-WebSocket-* and so on) are rejected.
• TungsteniteWebsocket::connect* in lib/transport now takes an extra HeaderMap. Core passes an empty one, so its behaviour doesn't change.
• The setting is documented in config/periphery.config.toml.

This keeps the header values out of the main config and env. Only the file path goes there, and it shows up in the sanitized startup config.

Verification

• 8 unit tests in connection::headers::tests cover parsing, values never showing up in errors or Debug output, and the mode and owner checks.
• cargo fmt --check passes and clippy is clean for komodo_periphery, transport and komodo_core.
• End to end: I ran a 2.3.3 Core (official image, Mongo) behind a Caddy proxy that returns 403 unless both headers match, with Periphery built from this branch:
  • no file: every attempt gets 403 and there is no login
  • file mode 644: Periphery exits at startup with an error telling you to chmod 600
  • file mode 600: Periphery logs in to Core through the proxy
  • file changed to a wrong value and the proxy restarted: reconnects get 403
  • correct value restored: Periphery reconnects without a restart
  • at debug log level, no header value appears in any Periphery log

🤖 Generated with Claude Code