Add bridge metrics and broker API key rotation#91
Open
ashioyajotham wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds timing observability to nexus-bridge and hardens nexus-broker API-key handling by supporting file-backed key rotation with periodic reload, plus accompanying tests and documentation updates.
Changes:
nexus-bridge: add Prometheus histograms for connection duration and token refresh latency, and record observations in WebSocket + gRPC lifecycles.nexus-broker: introduce anAPIKeySourceabstraction with a reloadable implementation backed byAPI_KEY_FILE/API_KEYS_FILEandAPI_KEY_RELOAD_INTERVAL.- Add/extend tests and docs to cover AES-GCM vault behavior and API key rotation configuration.
Reviewed changes
Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| nexus-broker/README.md | Documents file-backed API key rotation and reload interval. |
| nexus-broker/pkg/vault/encrypt_test.go | Adds AES-GCM vault tests (round-trip, unique ciphertext, tamper rejection, invalid key length). |
| nexus-broker/pkg/server/apikey.go | Adds APIKeySource + reloadable key source and middleware integration. |
| nexus-broker/pkg/server/apikey_test.go | Adds tests for reload behavior, failure fallback, and missing file startup failure. |
| nexus-broker/pkg/config/broker.go | Adds env parsing for key files + reload interval with defaults and validation. |
| nexus-broker/pkg/config/broker_test.go | Tests API key file parsing and reload interval parsing/validation. |
| nexus-broker/cmd/nexus-broker/main.go | Switches protected routes to use reloadable API key source. |
| nexus-bridge/telemetry/metrics.go | Adds Prometheus histograms + observe methods for timing metrics. |
| nexus-bridge/telemetry/metrics_test.go | Verifies timing histograms are registered and receive samples. |
| nexus-bridge/README.md | Updates Metrics interface docs to include new observe methods. |
| nexus-bridge/options.go | Extends Metrics interface + nop implementation for new methods. |
| nexus-bridge/bridge.go | Observes connection duration (WS + gRPC) and token refresh latency. |
| nexus-bridge/bridge_test.go | Extends mock metrics + assertions for new observations; adjusts cancellation test server. |
| docs/services/broker.md | Documents new broker env vars for API key rotation. |
| docs/reference/security-model.md | Documents runtime API key rotation via secret files. |
| docs/infrastructure/deploying-nexus.md | Adds deployment guidance for API key rotation and reload interval. |
| docs/getting-started/configuration.md | Updates config matrix for API key env options and defaults. |
| docs/concepts/security-model.md | Notes broker API key rotation capability. |
| docs/concepts/broker.md | Updates broker security notes and rotation guidance. |
| .env.example | Adds example env vars for API key rotation via mounted files. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+93
to
+115
| func (s *ReloadingAPIKeySource) reloadIfDue() { | ||
| now := s.now() | ||
|
|
||
| s.mu.RLock() | ||
| reloadDue := now.Sub(s.lastReload) >= s.reloadInterval | ||
| s.mu.RUnlock() | ||
| if !reloadDue { | ||
| return | ||
| } | ||
|
|
||
| s.mu.Lock() | ||
| defer s.mu.Unlock() | ||
| if now.Sub(s.lastReload) < s.reloadInterval { | ||
| return | ||
| } | ||
|
|
||
| next, err := s.load() | ||
| s.lastReload = now | ||
| if err != nil { | ||
| return | ||
| } | ||
| s.keys = next | ||
| } |
Comment on lines
+257
to
+259
| conn, _ := upgrader.Upgrade(w, r, nil) | ||
| defer conn.Close() | ||
| <-r.Context().Done() |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds bridge timing observability and broker API key rotation hardening.
Fixes #44.
Fixes #49.
Type of Change
Changes Made
nexus-bridge: add Prometheus histograms for connection duration and token refresh latency, wire observations into WebSocket and gRPC lifecycles, and update custom metrics docs/tests.nexus-broker: add reloadable API key sources backed byAPI_KEY_FILE/API_KEYS_FILEwithAPI_KEY_RELOAD_INTERVAL, while keeping the existing static middleware API compatible.nexus-broker: verify AES-GCM token vault behavior with tests for round trip, unique ciphertexts/nonces, tamper rejection, and invalid key length.How to Test
cd nexus-bridge && go test ./... -timeout=90scd nexus-broker && go test ./... -timeout=180sMigration / Breaking Changes
No schema changes. Existing
API_KEY/API_KEYSdeployments continue to work; file-backed key loading is additive.Checklist
gofmtapplied)