shadowdaoandClaude Sonnet 5.5
962d708fdd
Rename root, api and sdk module paths (imports, go.mod, go_package, ldflags, build scripts, buf configs) and regenerate protobuf/gateway code with the project's pinned toolchain. Wire identifiers unchanged. api gets a local replace for sdk; root/api/sdk require v0.1.0. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
84 lines
4.0 KiB
Markdown
84 lines
4.0 KiB
Markdown
# Threshold
|
|
|
|
Threshold provides simple and secure access to hosts and services. It is a
|
|
community-maintained fork of HashiCorp Boundary Community Edition (CE).
|
|
|
|
## About this fork
|
|
|
|
Threshold is a community fork of [HashiCorp Boundary Community Edition](https://github.com/hashicorp/boundary).
|
|
HashiCorp (an IBM company) archived the upstream Boundary CE repository on
|
|
2026-10-09 and announced that no further CE releases, maintenance updates, bug
|
|
fixes or security patches are planned. Threshold continues maintenance of the
|
|
Community Edition code base so that existing self-managed deployments can keep
|
|
receiving fixes.
|
|
|
|
- Threshold is licensed under the [Business Source License 1.1](LICENSE), the
|
|
same license as the upstream code. The original license text and all
|
|
copyright headers are preserved. See [NOTICE](NOTICE) for attribution.
|
|
- **Threshold is not affiliated with, endorsed by, or sponsored by HashiCorp or
|
|
IBM.** "Boundary", "HashiCorp" and "HCP Boundary" are trademarks of their
|
|
respective owners and are used here only to describe the origin of this
|
|
project.
|
|
- Upstream project: <https://github.com/hashicorp/boundary>
|
|
- This repository: <https://repo.anhonesthost.net/CyberCoveLLC/threshold>
|
|
|
|
### Compatibility with Boundary CE
|
|
|
|
This is the first phase of the rebrand and is designed to keep existing
|
|
Boundary CE deployments working:
|
|
|
|
- The command-line binary is now `threshold` (built from `cmd/threshold`).
|
|
- The wire protocol, HTTP API paths (`/v1`), database schema, plugin protocol
|
|
and configuration file format are unchanged.
|
|
- The Go module path is `repo.anhonesthost.net/CyberCoveLLC/threshold` (with `/api` and `/sdk`
|
|
submodules); protobuf code has been regenerated for it.
|
|
- Release versions are still reported on the wire with the upstream
|
|
`Boundary v` prefix so mixed clusters keep working. `Threshold v` is also
|
|
accepted when parsing.
|
|
|
|
### Environment variable and path fallbacks
|
|
|
|
Threshold prefers `THRESHOLD_*` environment variables, and transparently falls
|
|
back to the legacy `BOUNDARY_*` name when the `THRESHOLD_*` variable is not set.
|
|
For example `THRESHOLD_ADDR`, `THRESHOLD_TOKEN`, `THRESHOLD_SCOPE_ID`,
|
|
`THRESHOLD_KEYRING_TYPE`, `THRESHOLD_TOKEN_NAME`, `THRESHOLD_CONNECT_*`,
|
|
`THRESHOLD_SKIP_CACHE_DAEMON` and the other CLI and server variables are read
|
|
first, then `BOUNDARY_ADDR`, `BOUNDARY_TOKEN`, and so on. A `THRESHOLD_*` variable that is
|
|
set to a non-empty value always wins. Existing scripts and deployments that
|
|
only set `BOUNDARY_*` variables do not need to change.
|
|
|
|
Notes:
|
|
|
|
- `env://VAR` references inside configuration files and flags (for example
|
|
`url = "env://BOUNDARY_POSTGRES_URL"` or `url = "env://THRESHOLD_POSTGRES_URL"`
|
|
as used by the bundled container config) name an environment variable
|
|
literally and are not rewritten; keep using whichever variable name you export.
|
|
- `threshold connect -exec` exports both `THRESHOLD_PROXIED_{PORT,IP,ADDR}` and
|
|
the legacy `BOUNDARY_PROXIED_{PORT,IP,ADDR}` variables to the child process.
|
|
- The container image entrypoint mirrors any `BOUNDARY_*` variables to the
|
|
matching `THRESHOLD_*` variable when it is unset.
|
|
|
|
Other fallbacks:
|
|
|
|
| Item | New | Legacy fallback |
|
|
|------|-----|-----------------|
|
|
| Client cache directory | `~/.threshold` | `~/.boundary` is used if it exists and `~/.threshold` does not |
|
|
| Keyring entry (macOS Keychain / Windows Credential Manager) | `Threshold Auth Token` | `HashiCorp Boundary Auth Token` is read if the new entry is not found, and removed on `threshold logout` |
|
|
| Keyring prefix (`pass`, libsecret) | `Threshold` | `HashiCorp_Boundary` is read if the new entry is not found, and removed on `threshold logout` |
|
|
|
|
Tokens are always written using the new names.
|
|
|
|
## Building
|
|
|
|
```
|
|
make build # builds bin/threshold (requires the embedded UI, see Makefile)
|
|
make build-no-ui # builds bin/threshold without the embedded admin UI
|
|
```
|
|
|
|
The embedded admin UI is built from the upstream `boundary-ui` project and is
|
|
not part of this repository.
|
|
|
|
## Contributing
|
|
|
|
See [CONTRIBUTING.md](CONTRIBUTING.md).
|