Revoke a removed node's certificate, and require --api-client with a mirror's mutual TLS

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/control/adminapi/api.go

@@ -47,6 +47,8 @@ type API struct {
 	serve *modelserve.Server
 	// history is the Prometheus the console's charts read from.
 	history History
+	// revoke records a removed node, so its certificate is refused.
+	revoke func(ctx context.Context, nodeID string, at time.Time) error
 
 	models   Models
 	capacity Capacity
@@ -58,6 +60,11 @@ type API struct {
 // New builds the API over a controller.
 func New(ctl *control.Controller) *API { return &API{ctl: ctl} }
 
+// SetRevoker has removing a node revoke its certificate.
+func (a *API) SetRevoker(f func(ctx context.Context, nodeID string, at time.Time) error) {
+	a.revoke = f
+}
+
 // Register mounts the endpoints on a mux under /api/v1.
 func (a *API) Register(mux *http.ServeMux) {
 	mux.HandleFunc("GET /api/v1/summary", a.summary)
@@ -1098,6 +1105,14 @@ func (a *API) removeNode(w http.ResponseWriter, r *http.Request) {
 			"%s is %s: stop its agent (systemctl stop llmgw-agent) and remove it once it is lost, a minute later", id, n.State))
 		return
 	}
+	// Revoked first: a node removed but still holding a certificate the
+	// agent port accepts could connect again and be given work.
+	if a.revoke != nil {
+		if err := a.revoke(r.Context(), id, time.Now()); err != nil {
+			writeError(w, http.StatusInternalServerError, "revoking the node's certificate: "+err.Error())
+			return
+		}
+	}
 	inv.Remove(id)
 	a.ctl.Reconciler().Notify()
 	writeJSON(w, http.StatusOK, map[string]string{"id": id, "removed": "true"})