Merge remote-tracking branch 'origin/dev/v2.1' into feat/verify-subcommand

[scttbnsn]

sockguard validate is an offline check on a config file, so there's nothing that answers "is this deployment actually working right now." sockguard verify is that: it loads the config the way serve does (flags, SOCKGUARD_* environment, file) and then checks that what the config names is reachable. Five checks, one line each, reporting ok, fail or skip. config loads and validates the effective config structurally. upstream builds the endpoints (loading their TLS material), runs the same reachability probe serve runs at startup, asks the Docker API through the readiness probe internal/health issues, and resolves the engine flavor through the same GET /version probe. listener issues GET <health.path> against each effective listener. tls opens the cert, key and client CA each mutual-TLS listener names, which is the filesystem half of validation the admin API deliberately skips. image-trust reports whether image trust is configured and, when it uses keyless identities, whether the Sigstore trust root loads. A skip is a check that doesn't apply and never changes the exit code, so verify is usable before the proxy starts as well as against a running one; any fail exits non-zero, so it works as a container healthcheck or a deploy gate too. --json emits the same checks in the same order for scripting. No new probe was written for any of it: every check calls code the running proxy already calls, and health.Monitor.Probe is a thin export of the check /health already runs so the two can't drift apart.

TestRunVerifyChecks is the table, running against a fake Docker daemon and a fake sockguard on real unix sockets: both answering, the listener socket absent (skip), the listener answering 503 (fail), the upstream socket missing (fail), missing TLS material (fail), keyed-only image trust that must not touch the network (ok), keyless image trust whose trust root won't load (fail), and a config that doesn't validate, which skips every later check. TestRunVerifyJSONShape pins the --json document: the top-level keys, and five checks in a fixed order each carrying a status from the three-value set. TestRunVerifyTextOutputListsEveryCheck and TestWriteVerifyTextReportsAFailingVerdict cover the default writer's passing and failing arms. TestVerifyTLSTargetsMirrorTheValidatorGating pins which blocks verify opens against the gating config.Validate uses, so the structural config check plus the tls check together cover everything the full validator would have dereferenced. TestVerifyImageTrustTargetsCoverProfiles pins that a client profile's own image_trust block is collected, not just the top-level one. TestRootRegistersVerify pins the subcommand and its flags onto the root command.

CHANGELOG entry is under ### Added.

✨ Added

• Add sockguard verify.
• Reuse serve configuration flags, SOCKGUARD_* environment variables, and file handling.
• Add checks for configuration, upstream Docker readiness, listeners, mutual TLS, and image trust.
• Support ok, fail, and skip statuses.
• Support text and indented JSON output.
• Add Monitor.Probe for one-shot upstream checks.
• Document usage, checks, overrides, and exit behavior.
• Add coverage for check behavior, output formats, TLS targets, image-trust profiles, and command registration.

Concerns

• Confirm that verify cannot widen Docker socket access beyond the configured default-deny proxy rules.
• Confirm that all configuration parsing and validation paths reuse the existing serve utilities.
• Add tests for malformed JSON output inputs and unexpected probe errors.
• Add tests for listener and upstream probe timeouts.
• Confirm that skipped dependent checks are reported consistently in both text and JSON output.

[vercel]

Deployment failed for project sockguard-website with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/codeswhat?upgradeToPro=build-rate-limit

[biggest-littlest]

Reviewed against the CHANGELOG entry and the diff; CI green outside the qlty/Vercel quota noise.

[ALARGECOMPANY]

Reviewed against the CHANGELOG entry and the diff; CI green outside the qlty/Vercel quota noise.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 27ce0652-704d-4f05-a75b-f4cb7e758060

📥 Commits

Reviewing files that changed from the base of the PR and between 9e5bff4 and fab6fc4.

⛔ Files ignored due to path filters (1)

• CHANGELOG.md is excluded by !CHANGELOG.md

📒 Files selected for processing (5)

• README.md
• app/internal/cmd/verify.go
• app/internal/cmd/verify_test.go
• app/internal/health/health.go
• docs/content/docs/getting-started.mdx

---

📝 Walkthrough

Walkthrough

Added the sockguard verify command. It validates effective configuration, checks upstream readiness, listener health, TLS material, and image-trust requirements, then reports ok, fail, or skip results in text or JSON. Added one-shot upstream probing, socket overrides, exit-status handling, comprehensive tests, and usage documentation.

Suggested labels: second-opinion

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/verify-subcommand

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}