Transport security

A Consumer connection requires an explicit use_tls choice. Omitting it does not select a secure default or a plaintext fallback; validation fails. false must match AMQP and true must match AMQPS.

Use one connection definition#

Choose either connection_string or individual username, password, hostname, port and vhost fields. Do not mix both forms. This fragment replaces the first application’s [rabbitmq.consumer] profile; do not leave the previous individual fields alongside it. Keep the topology definitions.

[rabbitmq.consumer]
connection_string = "${secret:broker.consumer_url}"
use_tls = true
pool_size = 2
connection_timeout_secs = 10
confirm_timeout_secs = 10
heartbeat_secs = 30

[rabbitmq.consumer.tls]
additional_ca_bundle = "/etc/lily/tls/ca.pem"
client_certificate_chain = "/etc/lily/tls/client.pem"
client_private_key = "/etc/lily/tls/client-key.pem"

Adapt these values to your environment. ${secret:broker.consumer_url} requires a working SecretResolver and must resolve to an AMQPS URL containing host, username and password. A secret reference does not automatically look up an environment variable. URI queries/fragments are unsupported; use typed heartbeat and timeout fields.

CA trust and mutual TLS#

An additional CA bundle is optional. Supply the client certificate chain and private key together for mTLS; supplying only one fails validation. TLS material is rejected when use_tls=false. Paths must be absolute and material must be valid PEM; private keys follow the unencrypted PEM contract.

Place the files in a controlled deployment location readable by the application. The example paths do not mean the framework creates those files. Do not assume changing a file or secret after startup triggers hot reload; configuration explains the immutable startup contract.

Connection budgets#

These values belong to the Consumer connection profile; they are not delivery or process shutdown timeouts. A longer reconnect allowance does not mean the application is ready throughout broker recovery. Use the operational snapshot for current readiness.

Separate transport and message authorization#

mTLS or broker login does not replace vhost/destination permissions or message-level application policy. A message’s tenant/user field does not automatically become a verified principal. Apply required signatures, credentials and domain permissions through guards and middleware.

Use a redacted snapshot for configuration diagnostics; do not log resolved URLs, passwords or private keys. Observing a stable connection error code is different from printing a source error containing credentials.