feat: add trust store management for upstream TLS verification

Trust stores hold CA certificate bundles used to verify backend servers
when the proxy connects to upstreams over HTTPS, completing Phase 8.1
(TLS / Certificate Management).

Includes schema with PEM parsing/validation, Services context CRUD,
API controller, LiveView pages (index/new/show/edit), KDL generation
(trust_stores block + upstream group TLS verify block), upstream group
form integration, and 41 new tests.

Author: raffaelschneider

lib/sentinel_cp/services.ex

@@ -8,7 +8,7 @@ defmodule SentinelCp.Services do
 
   import Ecto.Query, warn: false
   alias SentinelCp.Repo
-  alias SentinelCp.Services.{Service, ServiceTemplate, ProjectConfig, UpstreamGroup, UpstreamTarget, Certificate, AuthPolicy, OpenApiSpec, DiscoverySource, DiscoverySync, Middleware, ServiceMiddleware}
+  alias SentinelCp.Services.{Service, ServiceTemplate, ProjectConfig, UpstreamGroup, UpstreamTarget, Certificate, TrustStore, AuthPolicy, OpenApiSpec, DiscoverySource, DiscoverySync, Middleware, ServiceMiddleware}
   alias SentinelCp.Secrets
 
   ## Services
@@ -357,6 +357,54 @@ defmodule SentinelCp.Services do
     |> Repo.update()
   end
 
+  ## Trust Stores
+
+  @doc """
+  Lists trust stores for a project, ordered by name.
+  """
+  def list_trust_stores(project_id) do
+    from(t in TrustStore,
+      where: t.project_id == ^project_id,
+      order_by: [asc: t.name]
+    )
+    |> Repo.all()
+  end
+
+  @doc """
+  Gets a single trust store by ID.
+  """
+  def get_trust_store(id), do: Repo.get(TrustStore, id)
+
+  @doc """
+  Gets a single trust store by ID, raises if not found.
+  """
+  def get_trust_store!(id), do: Repo.get!(TrustStore, id)
+
+  @doc """
+  Creates a trust store.
+  """
+  def create_trust_store(attrs) do
+    %TrustStore{}
+    |> TrustStore.create_changeset(attrs)
+    |> Repo.insert()
+  end
+
+  @doc """
+  Updates a trust store.
+  """
+  def update_trust_store(%TrustStore{} = trust_store, attrs) do
+    trust_store
+    |> TrustStore.update_changeset(attrs)
+    |> Repo.update()
+  end
+
+  @doc """
+  Deletes a trust store.
+  """
+  def delete_trust_store(%TrustStore{} = trust_store) do
+    Repo.delete(trust_store)
+  end
+
   ## Service Templates
 
   @doc """

lib/sentinel_cp/services/kdl_generator.ex

@@ -6,7 +6,7 @@ defmodule SentinelCp.Services.KdlGenerator do
   """
 
   alias SentinelCp.Services
-  alias SentinelCp.Services.{Service, ProjectConfig, UpstreamGroup, Certificate, AuthPolicy}
+  alias SentinelCp.Services.{Service, ProjectConfig, UpstreamGroup, Certificate, TrustStore, AuthPolicy}
 
   @doc """
   Generates KDL configuration for a project from its services and config.
@@ -29,6 +29,7 @@ defmodule SentinelCp.Services.KdlGenerator do
       upstream_groups = Services.list_upstream_groups(project_id)
       certificates = Services.list_certificates(project_id)
       auth_policies = Services.list_auth_policies(project_id)
+      trust_stores = Services.list_trust_stores(project_id)
 
       # Build middleware chain map: service_id -> [service_middlewares]
       middleware_chains =
@@ -40,7 +41,7 @@ defmodule SentinelCp.Services.KdlGenerator do
       # Resolve secret references if requested
       case maybe_resolve_secrets(services, opts) do
         {:ok, resolved_services} ->
-          kdl = build_kdl(resolved_services, config, upstream_groups, certificates, auth_policies, middleware_chains)
+          kdl = build_kdl(resolved_services, config, upstream_groups, certificates, auth_policies, middleware_chains, trust_stores)
           {:ok, kdl}
 
         {:error, _} = error ->
@@ -92,7 +93,7 @@ defmodule SentinelCp.Services.KdlGenerator do
   Generates KDL from provided services, config, and upstream groups (no DB access).
   Useful for testing.
   """
-  def build_kdl(services, %ProjectConfig{} = config, upstream_groups \\ [], certificates \\ [], auth_policies \\ [], middleware_chains \\ %{}) do
+  def build_kdl(services, %ProjectConfig{} = config, upstream_groups \\ [], certificates \\ [], auth_policies \\ [], middleware_chains \\ %{}, trust_stores \\ []) do
     # Build lookup maps
     group_map =
       upstream_groups
@@ -106,6 +107,10 @@ defmodule SentinelCp.Services.KdlGenerator do
       auth_policies
       |> Enum.into(%{}, fn a -> {a.id, a} end)
 
+    trust_store_map =
+      trust_stores
+      |> Enum.into(%{}, fn t -> {t.id, t} end)
+
     # Determine which certificates are used by services
     used_cert_ids =
       services
@@ -115,14 +120,24 @@ defmodule SentinelCp.Services.KdlGenerator do
 
     used_certs = Enum.filter(certificates, fn c -> MapSet.member?(used_cert_ids, c.id) end)
 
+    # Determine which trust stores are used by upstream groups
+    used_trust_store_ids =
+      upstream_groups
+      |> Enum.map(& &1.trust_store_id)
+      |> Enum.reject(&is_nil/1)
+      |> MapSet.new()
+
+    used_trust_stores = Enum.filter(trust_stores, fn t -> MapSet.member?(used_trust_store_ids, t.id) end)
+
     parts = [
       "// Generated by Sentinel Control Plane",
       "// Do not edit manually — managed via Services UI",
       "",
       build_settings(config),
       "",
       build_tls_certificates(used_certs),
-      build_upstream_groups(upstream_groups),
+      build_trust_stores(used_trust_stores),
+      build_upstream_groups(upstream_groups, trust_store_map),
       build_routes(services, group_map, cert_map, auth_policy_map, middleware_chains),
       build_rate_limits(services)
     ]
@@ -167,18 +182,38 @@ defmodule SentinelCp.Services.KdlGenerator do
     build_nested_map_block(config.default_security, "security", "    ")
   end
 
-  defp build_upstream_groups([]), do: []
+  defp build_trust_stores([]), do: []
 
-  defp build_upstream_groups(groups) do
+  defp build_trust_stores(trust_stores) do
+    blocks =
+      trust_stores
+      |> Enum.map(&build_trust_store_block/1)
+      |> Enum.intersperse([""])
+
+    ["trust_stores {"] ++ List.flatten(blocks) ++ ["}", ""]
+  end
+
+  defp build_trust_store_block(%TrustStore{} = ts) do
+    [
+      "    store #{inspect(ts.slug)} {",
+      "        ca_file \"/etc/sentinel/trust-stores/#{ts.slug}.pem\"",
+      "    }"
+    ]
+  end
+
+  defp build_upstream_groups(groups, trust_store_map)
+  defp build_upstream_groups([], _trust_store_map), do: []
+
+  defp build_upstream_groups(groups, trust_store_map) do
     blocks =
       groups
-      |> Enum.map(&build_upstream_group_block/1)
+      |> Enum.map(&build_upstream_group_block(&1, trust_store_map))
       |> Enum.intersperse([""])
 
     ["upstream_groups {"] ++ List.flatten(blocks) ++ ["}", ""]
   end
 
-  defp build_upstream_group_block(%UpstreamGroup{} = group) do
+  defp build_upstream_group_block(%UpstreamGroup{} = group, trust_store_map) do
     lines = ["    group #{inspect(group.slug)} {"]
     lines = lines ++ ["        algorithm #{inspect(group.algorithm)}"]
 
@@ -203,9 +238,29 @@ defmodule SentinelCp.Services.KdlGenerator do
     # Add sticky sessions
     lines = lines ++ build_nested_map_block(group.sticky_sessions, "sticky_sessions", "        ")
 
+    # Add TLS verify block if trust store is linked
+    lines = lines ++ build_upstream_tls_block(group.trust_store_id, trust_store_map)
+
     lines ++ ["    }"]
   end
 
+  defp build_upstream_tls_block(nil, _trust_store_map), do: []
+
+  defp build_upstream_tls_block(trust_store_id, trust_store_map) do
+    case Map.get(trust_store_map, trust_store_id) do
+      nil ->
+        []
+
+      ts ->
+        [
+          "        tls {",
+          "            verify true",
+          "            ca_file \"/etc/sentinel/trust-stores/#{ts.slug}.pem\"",
+          "        }"
+        ]
+    end
+  end
+
   defp build_routes(services, group_map, cert_map, auth_policy_map, middleware_chains) do
     route_blocks =
       services