The authority makes its own root at first start, and the proxy fetches it through a gate

step-ca's root certificate, its key and that key's password were own secrets — random
bytes the mesh minted, which no certificate is (novox/hq 04-ISSUES/076). The mesh
mints only the CA password now; step-ca makes its root at first start and serves it
at /roots.pem, which the manifest now names beside the ACME directory. The route
proxy fetches that root over the mesh network in a run-once step before it starts,
instead of being handed a served fact that could only be written before anything ran
(ADR 0098).

modules/route-proxy/module.json

@@ -62,19 +62,31 @@
       "path": "/var/lib/route-proxy/ca",
       "mode": "0755"
     },
-    {
-      "id": "ca-bundle",
-      "type": "file",
-      "path": "/var/lib/route-proxy/ca/root.crt",
-      "mode": "0644",
-      "content": "${bound:acme-ca:root}\n"
-    },
     {
       "id": "acme-env",
       "type": "file",
       "path": "/var/lib/route-proxy/acme.env",
       "mode": "0600",
-      "content": "ACME_DIRECTORY=https://${bound:acme-ca:at}:${bound:acme-ca:port}${bound:acme-ca:path}\n"
+      "content": "ACME_DIRECTORY=https://${bound:acme-ca:at}:${bound:acme-ca:port}${bound:acme-ca:path}\nACME_ROOTS=https://${bound:acme-ca:at}:${bound:acme-ca:port}${bound:acme-ca:roots}\n"
+    },
+    {
+      "id": "trust",
+      "type": "container",
+      "name": "route-proxy-trust",
+      "run-once": true,
+      "image": "alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b",
+      "network": "host",
+      "env-file": [
+        "/var/lib/route-proxy/acme.env"
+      ],
+      "volumes": [
+        "/var/lib/route-proxy/ca:/ca"
+      ],
+      "args": [
+        "sh",
+        "-c",
+        "wget -q --no-check-certificate -O /ca/root.crt \"$ACME_ROOTS\" && test -s /ca/root.crt"
+      ]
     },
     {
       "id": "server",

modules/step-ca/module.json

@@ -13,7 +13,7 @@
   "serves": {
     "acme-ca": {
       "path": "/acme/acme/directory",
-      "root": ""
+      "roots": "/roots.pem"
     }
   },
   "listens": [
@@ -25,10 +25,7 @@
     }
   ],
   "own-secrets": {
-    "password": "/var/lib/mesh/step-ca/password",
-    "root-cert": "/var/lib/mesh/step-ca/root-cert",
-    "root-key": "/var/lib/mesh/step-ca/root-key",
-    "root-key-password": "/var/lib/mesh/step-ca/root-key-password"
+    "password": "/var/lib/mesh/step-ca/password"
   },
   "resources": [
     {
@@ -59,30 +56,6 @@
       "mode": "0600",
       "content": "DOCKER_STEPCA_INIT_PASSWORD=${secret:password}\nDOCKER_STEPCA_INIT_DNS_NAMES=${machine:at},${machine:name},localhost,127.0.0.1\n"
     },
-    {
-      "id": "root-cert-file",
-      "type": "file",
-      "path": "/var/lib/mesh/step-ca/root-cert.pem",
-      "mode": "0600",
-      "owner": "1000:1000",
-      "content": "${secret:root-cert}"
-    },
-    {
-      "id": "root-key-file",
-      "type": "file",
-      "path": "/var/lib/mesh/step-ca/root-key.pem",
-      "mode": "0600",
-      "owner": "1000:1000",
-      "content": "${secret:root-key}"
-    },
-    {
-      "id": "root-key-password-file",
-      "type": "file",
-      "path": "/var/lib/mesh/step-ca/root-key-password.txt",
-      "mode": "0600",
-      "owner": "1000:1000",
-      "content": "${secret:root-key-password}"
-    },
     {
       "id": "server",
       "type": "container",
@@ -95,10 +68,7 @@
       "env": {
         "DOCKER_STEPCA_INIT_NAME": "Mesh Internal CA",
         "DOCKER_STEPCA_INIT_ACME": "true",
-        "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT": "false",
-        "DOCKER_STEPCA_INIT_ROOT_FILE": "/run/mesh/root-cert.pem",
-        "DOCKER_STEPCA_INIT_KEY_FILE": "/run/mesh/root-key.pem",
-        "DOCKER_STEPCA_INIT_KEY_PASSWORD_FILE": "/run/mesh/root-key-password.txt"
+        "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT": "false"
       },
       "volumes": [
         "/var/lib/step-ca:/home/step",