route-proxy: the challenge path falls through for real #66

2026-09-26T12:22:17Z

jschoubben commented

2026-09-26 12:22:17 +00:00

autocert.Manager.HTTPHandler answers 404 itself for a token it does not hold and never consults its fallback on the challenge path — the predecessor's exact fault ("the edge owns ACME"), rediscovered live when Mailu's renewal died behind this proxy on cutover day and served its April-expired certbot state to real IMAPS users (mesh-catalog #90/#91 are the flip and the revert).

tokenOrRoute probes each authority against a buffered writer and hands a token none of them holds to plain routing, so a consumer's own ACME client answers its own challenge through an ordinary path-scoped route. Four tests pin it: unknown token routes, held token answers, a second authority is probed past the first, ordinary paths never touch the machinery. The pre-existing foundation-manifest test failures on main are untouched.

`autocert.Manager.HTTPHandler` answers 404 itself for a token it does not hold and never consults its fallback on the challenge path — the predecessor's exact fault ("the edge owns ACME"), rediscovered live when Mailu's renewal died behind this proxy on cutover day and served its April-expired certbot state to real IMAPS users (mesh-catalog #90/#91 are the flip and the revert). `tokenOrRoute` probes each authority against a buffered writer and hands a token none of them holds to plain routing, so a consumer's own ACME client answers its own challenge through an ordinary path-scoped route. Four tests pin it: unknown token routes, held token answers, a second authority is probed past the first, ordinary paths never touch the machinery. The pre-existing foundation-manifest test failures on main are untouched.

jschoubben added 1 commit 2026-09-26 12:22:17 +00:00

route-proxy: the challenge path falls through for real f145d17fc8

autocert's HTTPHandler answers 404 itself for a token it does not hold
and never consults its fallback on the challenge path — the
predecessor's exact fault, rediscovered live when Mailu's renewal died
behind this proxy on cutover day. tokenOrRoute probes each authority
against a buffered writer and hands a token none of them holds to plain
routing, so a consumer's own ACME client answers its own challenge
through an ordinary path-scoped route. Four tests pin it, including the
cache-key shape a restart-surviving token actually has.

jschoubben merged commit 345722a4fd into main

2026-09-26 12:22:21 +00:00

jschoubben deleted branch fix/the-challenge-path-falls-through-for-real

2026-09-26 12:22:21 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#66