merge: gRPC server + hub + 跨实例 pub/sub [tsk__58l3wTLvaSn]

server/internal/config/config.go

@@ -48,6 +48,24 @@ type Config struct {
 	// active key's kid and may carry previous keys still accepted during
 	// rotation. Parsed from JWT_PUBLIC_KEYS="kid1:/path1,kid2:/path2".
 	JWTPublicKeys map[string]string
+
+	// ─── gRPC / agent server ──────────────────────────────────────────────
+
+	// GRPCAddr is the listen address for the mTLS gRPC agent server (host:port).
+	// Optional: if empty, the gRPC server is not started.
+	// Example: ":9443"
+	GRPCAddr string
+
+	// CAKeyPath and CACertPath are file paths for the Pangolin Node CA.
+	// Required when GRPCAddr is set.
+	CAKeyPath  string
+	CACertPath string
+
+	// GRPCCertPath and GRPCKeyPath are the TLS certificate/key used by the gRPC
+	// listener for its own transport credential (distinct from the node CA).
+	// Required when GRPCAddr is set.
+	GRPCCertPath string
+	GRPCKeyPath  string
 }
 
 // FromEnv reads configuration from environment variables.
@@ -66,6 +84,12 @@ func FromEnv() (*Config, error) {
 		JWTPrivateKeyPath:         os.Getenv("JWT_PRIVATE_KEY_PATH"),
 		JWTKeyID:                  os.Getenv("JWT_KEY_ID"),
 		JWTPublicKeys:             parseKeyMap(os.Getenv("JWT_PUBLIC_KEYS")),
+		// gRPC server (optional)
+		GRPCAddr:     os.Getenv("GRPC_ADDR"),
+		CAKeyPath:    os.Getenv("CA_KEY_PATH"),
+		CACertPath:   os.Getenv("CA_CERT_PATH"),
+		GRPCCertPath: os.Getenv("GRPC_CERT_PATH"),
+		GRPCKeyPath:  os.Getenv("GRPC_KEY_PATH"),
 	}
 
 	if c.DSN == "" {