Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)
This commit is contained in:
Executable
+58
@@ -0,0 +1,58 @@
|
||||
#!/bin/sh
|
||||
# The mesh's internal certificate authority, trusted by this machine.
|
||||
#
|
||||
# Written by the mesh from the ca-trust module's manifest (novox/hq ADR 0147).
|
||||
# Editing it here lasts until the next apply.
|
||||
#
|
||||
# There is no prior trust to verify the fetch against — this is the thing that
|
||||
# establishes it — so it is made over the mesh's own private network, which is
|
||||
# what authenticates it (novox/hq ADR 0098, the same reasoning that lets the
|
||||
# route proxy fetch this root for itself). What comes back is checked here: a
|
||||
# body that is not a certificate is refused now, rather than believed and then
|
||||
# failed by whatever reads the trust store next.
|
||||
set -eu
|
||||
|
||||
ROOTS='https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}'
|
||||
ANCHORS=/etc/ca-certificates/trust-source/anchors
|
||||
ANCHOR="$ANCHORS/mesh-internal-ca.crt"
|
||||
|
||||
# Arch's layout, said out loud rather than assumed: a machine that keeps its
|
||||
# anchors elsewhere fails here, visibly, instead of writing a file nothing
|
||||
# reads. That failure is the signal that this belongs in the host, where one
|
||||
# operating system's difference lives (novox/hq ADR 0147, option 2).
|
||||
[ -d "$ANCHORS" ] || {
|
||||
echo "this machine keeps no trust anchors in $ANCHORS; ca-trust is written for that layout" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
case "${1:-}" in
|
||||
install)
|
||||
tmp=$(mktemp)
|
||||
trap 'rm -f "$tmp"' EXIT
|
||||
# The authority may still be starting, or this machine may have come up
|
||||
# before it: two minutes of asking, then an honest failure.
|
||||
n=0
|
||||
while [ "$n" -lt 60 ]; do
|
||||
if curl --fail --silent --show-error --insecure --max-time 10 \
|
||||
--output "$tmp" "$ROOTS" &&
|
||||
grep -q 'BEGIN CERTIFICATE' "$tmp"; then
|
||||
install -m 0644 "$tmp" "$ANCHOR"
|
||||
update-ca-trust
|
||||
exit 0
|
||||
fi
|
||||
n=$((n + 1))
|
||||
sleep 2
|
||||
done
|
||||
echo "the authority at $ROOTS did not serve a certificate within two minutes" >&2
|
||||
exit 1
|
||||
;;
|
||||
remove)
|
||||
# What stopping the unit does, and therefore what being unassigned does.
|
||||
rm -f "$ANCHOR"
|
||||
update-ca-trust
|
||||
;;
|
||||
*)
|
||||
echo "usage: $(basename "$0") install|remove" >&2
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
@@ -0,0 +1,16 @@
|
||||
[Unit]
|
||||
Description=The mesh's internal certificate authority, trusted by this machine
|
||||
# novox/hq ADR 0147. Starting this unit places the mesh's root among this
|
||||
# machine's trust anchors; stopping it takes the root away again, which is what
|
||||
# the host does when the module is no longer assigned here.
|
||||
Wants=network-online.target
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=${dir:state}/anchor install
|
||||
ExecStop=${dir:state}/anchor remove
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -32,14 +32,14 @@
|
||||
"type": "file",
|
||||
"path": "${dir:state}/anchor",
|
||||
"mode": "0755",
|
||||
"content": "#!/bin/sh\n# The mesh's internal certificate authority, trusted by this machine.\n#\n# Written by the mesh from the ca-trust module's manifest (novox/hq ADR 0147).\n# Editing it here lasts until the next apply.\n#\n# There is no prior trust to verify the fetch against \u2014 this is the thing that\n# establishes it \u2014 so it is made over the mesh's own private network, which is\n# what authenticates it (novox/hq ADR 0098, the same reasoning that lets the\n# route proxy fetch this root for itself). What comes back is checked here: a\n# body that is not a certificate is refused now, rather than believed and then\n# failed by whatever reads the trust store next.\nset -eu\n\nROOTS='https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}'\nANCHORS=/etc/ca-certificates/trust-source/anchors\nANCHOR=\"$ANCHORS/mesh-internal-ca.crt\"\n\n# Arch's layout, said out loud rather than assumed: a machine that keeps its\n# anchors elsewhere fails here, visibly, instead of writing a file nothing\n# reads. That failure is the signal that this belongs in the host, where one\n# operating system's difference lives (novox/hq ADR 0147, option 2).\n[ -d \"$ANCHORS\" ] || {\n\techo \"this machine keeps no trust anchors in $ANCHORS; ca-trust is written for that layout\" >&2\n\texit 1\n}\n\ncase \"${1:-}\" in\ninstall)\n\ttmp=$(mktemp)\n\ttrap 'rm -f \"$tmp\"' EXIT\n\t# The authority may still be starting, or this machine may have come up\n\t# before it: two minutes of asking, then an honest failure.\n\tn=0\n\twhile [ \"$n\" -lt 60 ]; do\n\t\tif curl --fail --silent --show-error --insecure --max-time 10 \\\n\t\t\t--output \"$tmp\" \"$ROOTS\" &&\n\t\t\tgrep -q 'BEGIN CERTIFICATE' \"$tmp\"; then\n\t\t\tinstall -m 0644 \"$tmp\" \"$ANCHOR\"\n\t\t\tupdate-ca-trust\n\t\t\texit 0\n\t\tfi\n\t\tn=$((n + 1))\n\t\tsleep 2\n\tdone\n\techo \"the authority at $ROOTS did not serve a certificate within two minutes\" >&2\n\texit 1\n\t;;\nremove)\n\t# What stopping the unit does, and therefore what being unassigned does.\n\trm -f \"$ANCHOR\"\n\tupdate-ca-trust\n\t;;\n*)\n\techo \"usage: $(basename \"$0\") install|remove\" >&2\n\texit 2\n\t;;\nesac\n"
|
||||
"template": "files/anchor"
|
||||
},
|
||||
{
|
||||
"id": "unit",
|
||||
"type": "file",
|
||||
"path": "/etc/systemd/system/mesh-ca-trust.service",
|
||||
"mode": "0644",
|
||||
"content": "[Unit]\nDescription=The mesh's internal certificate authority, trusted by this machine\n# novox/hq ADR 0147. Starting this unit places the mesh's root among this\n# machine's trust anchors; stopping it takes the root away again, which is what\n# the host does when the module is no longer assigned here.\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=${dir:state}/anchor install\nExecStop=${dir:state}/anchor remove\n\n[Install]\nWantedBy=multi-user.target\n"
|
||||
"template": "files/mesh-ca-trust.service"
|
||||
},
|
||||
{
|
||||
"id": "trust",
|
||||
@@ -52,5 +52,14 @@
|
||||
"unit"
|
||||
]
|
||||
}
|
||||
]
|
||||
],
|
||||
"build": {
|
||||
"artifacts": [
|
||||
{
|
||||
"name": "files",
|
||||
"kind": "archive",
|
||||
"from": "files"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user