port TLS/SSL handling to the contracts.ssl contract #1041

Merged

kiara merged 18 commits from kiara/fediversity:ssl-contract into main 2026-06-05 16:12:16 +02:00

Conversation 0 Commits 18 Files changed 30 +1013 -160

kiara commented 2026-06-04 23:13:24 +02:00

Owner

Copy link

Part of #314.

Follow-ups:

• cover non-operator groups (#370)
• use openbao's PKI secrets engine

Part of #314. Follow-ups: - cover non-operator groups (#370) - use openbao's [PKI secrets engine](https://openbao.org/docs/secrets/pki/)

kiara force-pushed ssl-contract from 206c0e9d78 to d19a7dbb59 2026-06-05 00:37:47 +02:00 Compare

kiara force-pushed ssl-contract from 8f364d8a34 to 8c329efb37 2026-06-05 14:16:42 +02:00 Compare

kiara added 1 commit 2026-06-05 15:23:57 +02:00

gate garage cross-node trust on a garage node being deployed ... e684cf5c02

The cross-node trust addition forced `garage.sslDomains` for every
non-garage node, and `garage.sslDomains` always references the garage
`domain` (`s3.${domain}`, `web.${domain}`). Groups without a garage
ancilliary (`hosting-provider`, `dev`) do not set `domain` in their
`default-config`, so building their `nixosConfigurations.*` toplevels
threw `attribute 'domain' missing`.

Gate `garageTrustDomains` on `ancilliaryHosts ? garage`, the same test
the node's `/etc/hosts` garage wiring already uses: a node only needs to
trust the garage certs when there is a garage node to trust. Groups with
a garage ancilliary (`operator`) are unaffected and keep baking the
trust bundle.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Kiara Grouwstra <kiara@procolix.eu>

kiara changed title from WIP: port TLS/SSL handling to the contracts.ssl contract to port TLS/SSL handling to the contracts.ssl contract 2026-06-05 16:12:00 +02:00

kiara requested review from developers 2026-06-05 16:12:00 +02:00

kiara merged commit 827048f5e6 into main 2026-06-05 16:12:16 +02:00

kiara deleted branch ssl-contract 2026-06-05 16:12:16 +02:00

kiara referenced this pull request from a commit 2026-06-05 16:12:17 +02:00

port TLS/SSL handling to the `contracts.ssl` contract (#1041)

kiara referenced this pull request 2026-06-05 16:57:49 +02:00

ephemeral state is automatically provisioned #314

kiara referenced this pull request 2026-06-06 15:53:45 +02:00

contracts coordinated across pods #625

kiara referenced this pull request 2026-06-06 16:29:03 +02:00

explore handling (cross-node) needs without contracts #1047

Sign in to join this conversation.

Reviewers

No reviewers

fediversity/developers

Labels

Clear labels   

0 points

fibonacci complexity: 0 points

  

0.5 points

fibonacci complexity: 0.5 points

  

1 point

fibonacci complexity: 1 point

  

13 points

fibonacci complexity: 13 points

  

2 points

fibonacci complexity: 2 points

  

21 points

fibonacci complexity: 21 points

  

3 points

fibonacci complexity: 3 points

  

34 points

fibonacci complexity: 34 points

  

5 points

fibonacci complexity: 5 points

  

55 points

fibonacci complexity: 55 points

  

8 points

fibonacci complexity: 8 points

  

ambition

application-offering

  

ambition

configure-applications

  

ambition

front-end

  

ambition/install-applications

  

ambition

security

  

ambition

switch-host

  

ambition

update-applications

  

ambition

user-management

  

api service

features that may relate more to a (to be created) API service

  

blocked

  

component: fediversity panel

  

component: nixops4

  

documentation

  

estimation high: >3d

  

estimation low: <2h

  

estimation mid: <8h

  

infinite points

fibonacci complexity: infinite points

  

productisation

features out-scoped with the decoupling of the productisation effort

  

project-management

Project management related tasks

  

question

  

role: application developer

  

role: application operator

  

role: hosting provider

  

role: maintainer

  

security

  

technical debt

  

testing

  

type unclear

  

type: bug

Anything that doesn't work as advertised

  

type: deliverable

  

type: key result

  

type: objective

  

type: task

  

type: user story

  

user experience

No labels

0 points

0.5 points

1 point

13 points

2 points

21 points

3 points

34 points

5 points

55 points

8 points

ambition

application-offering

ambition

configure-applications

ambition

front-end

ambition/install-applications

ambition

security

ambition

switch-host

ambition

update-applications

ambition

user-management

api service

blocked

component: fediversity panel

component: nixops4

documentation

estimation high: >3d

estimation low: <2h

estimation mid: <8h

infinite points

productisation

project-management

question

role: application developer

role: application operator

role: hosting provider

role: maintainer

security

technical debt

testing

type unclear

type: bug

type: deliverable

type: key result

type: objective

type: task

type: user story

user experience

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

fediversity/fediversity!1041

No description provided.