ca-trust: a machine trusts the mesh's authority because a module put its root there #142

2026-09-29T13:28:20Z

jschoubben commented

2026-09-29 13:28:20 +00:00

novox/hq ADR 0147, issue 129.

Every internal HTTPS name fails verification on every machine: the certificates are genuine and nothing on a machine has ever been told what issued them. The route proxy's fetch answers for the proxy and for nothing else — a browser, git over HTTPS, a package manager and every module calling another by an internal name read the machine's own trust store.

ca-trust requires internal-acme-ca, fetches the root over the mesh's own network (there is no prior trust to have; this is what establishes it), installs it among the machine's anchors and refreshes the extracted bundles. Being unassigned stops its unit, and stopping the unit takes the anchor away and refreshes them again — the removal issue 129 asked for by name.

A file and a service, the shape the packet filter already proves. Arch's layout is named out loud: a machine that keeps anchors elsewhere fails visibly rather than writing a file nothing reads, and that failure is the signal that this belongs in the host instead.

Checked by mesh-controller feat/ca-trust (the rendering) and mesh-lab feat/ca-trust (the bed, which cannot run yet — novox/hq issue 146).

novox/hq ADR 0147, issue 129. Every internal HTTPS name fails verification on every machine: the certificates are genuine and nothing on a machine has ever been told what issued them. The route proxy's fetch answers for the proxy and for nothing else — a browser, `git` over HTTPS, a package manager and every module calling another by an internal name read the machine's own trust store. `ca-trust` requires `internal-acme-ca`, fetches the root over the mesh's own network (there is no prior trust to have; this is what establishes it), installs it among the machine's anchors and refreshes the extracted bundles. Being unassigned stops its unit, and stopping the unit takes the anchor away and refreshes them again — the removal issue 129 asked for by name. A file and a service, the shape the packet filter already proves. Arch's layout is named out loud: a machine that keeps anchors elsewhere fails visibly rather than writing a file nothing reads, and that failure is the signal that this belongs in the host instead. Checked by `mesh-controller feat/ca-trust` (the rendering) and `mesh-lab feat/ca-trust` (the bed, which cannot run yet — novox/hq issue 146).

jschoubben added 1 commit 2026-09-29 13:28:20 +00:00

ca-trust: a machine trusts the mesh's authority because a module put its root there 8797335fbc

novox/hq ADR 0147, issue 129. Every internal HTTPS name fails verification
on every machine: the certificates are genuine and nothing on a machine has
ever been told what issued them. The proxy's fetch answers for the proxy and
for nothing else — a browser, git over HTTPS and every module calling another
by an internal name read the machine's own trust store.

The module requires internal-acme-ca, fetches the root over the mesh's own
network (no prior trust to have; that is what this establishes), installs it
among the machine's anchors and refreshes the extracted bundles. Being
unassigned stops the unit, and stopping it takes the anchor away and
refreshes them again.

Arch's layout is named out loud: a machine that keeps anchors elsewhere fails
visibly rather than writing a file nothing reads.

jschoubben merged commit 67f5f4cffd into main

2026-09-29 14:06:37 +00:00

jschoubben deleted branch feat/ca-trust

2026-09-29 14:06:37 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#142