jschoubben
6c14d313b8
Issue 129: every internal HTTPS name fails verification on every machine, because nothing has ever written the mesh's root into a trust store. The report proposed the controller inject it the way the private network writes the registry's trust; this record rejects that — reachability and trust are not the same fact, and where anchors live is the host's difference, not the controller's. A module requiring internal-acme-ca does the whole of it, and being unassigned undoes it.
1.8 KiB
Diagnosis
2026-09-29.
What was ruled out
That something already carries the root and it is only misplaced. It does not. The authority serves its root at a path beside its ACME directory, and the one thing that fetches it — the route proxy — puts it in a directory of its own and hands it to one program. Nothing has ever written into a machine's trust store. Measured on three converged machines: the anchors present are the predecessor's authority and a developer tool's local root, and on the machines where the predecessor's was deliberately removed, every internal name fails verification.
That the private network could carry it, the way it carries the registry's trust. That is what the report proposed, and it was rejected on consideration rather than on difficulty (ADR 0147, option 1): being on the network is what makes the registry reachable and is therefore the right trigger there, while trusting an authority is a separate fact from being able to reach it. The anchor's directory and the command that refreshes the extracted bundles are also one operating system's difference, which is the host's half of the mesh and not the controller's.
That it needs a new host resource type. It does not, today. A file and a service say the whole of it, which the packet filter already proves. The primitive becomes the right answer when a second operating system is in play, and not before.
Where it belongs
A module in the catalogue: it requires internal-acme-ca, fetches the root over the mesh's own
network, installs it as a trust anchor, refreshes the machine's bundles, and — because being
unassigned stops its unit, and stopping the unit is what undoes it — takes both away again.
The owner is therefore mesh-catalog, module ca-trust, and nothing in the control plane.