mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
fc0881ff33
The package-cache frontend terminates TLS for package traffic and signs with its own CA: probed from inside the test container, pypi.org arrives as subject CN=pypi.org issued by CN=Infinito Package-Cache Frontend CA. package-frontend-ca.sh installs that CA into the OS store, which is why apt, pip, curl and urllib work — but requests reads certifi, which has never heard of it, so test-external failed its reachability precondition with CERTIFICATE_VERIFY_FAILED. Upgrading certifi does not help; the issuer is not a public root. load.sh is where the runner puts the venv on PATH, so it is also where the interpreter carrying the pip certifi is chosen; pointing REQUESTS_CA_BUNDLE and SSL_CERT_FILE at the store the stack deliberately fills keeps one trust decision instead of two. A caller-set value still wins. The bundle location was about to become a fourth copy: dev-nix and the network diagnose CLI each carried their own candidate list, and the two had already drifted apart in their fourth entry. All of them now read group_vars CA_BUNDLE_CANDIDATES — Ansible directly, the shell through a generated env key, python through read_group_paths. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
42 lines
1.3 KiB
YAML
42 lines
1.3 KiB
YAML
---
|
|
# Nix version to install via official installer
|
|
dev_nix_installer_version: "2.32.4"
|
|
|
|
# Base URL for Nix releases
|
|
dev_nix_installer_base_url: "https://releases.nixos.org/nix" # nocheck: url
|
|
|
|
# Full URL to the installer script (can be overridden if needed)
|
|
dev_nix_installer_url: >-
|
|
{{ dev_nix_installer_base_url }}/nix-{{ dev_nix_installer_version }}/install
|
|
|
|
# Full URL to the SHA256 checksum file
|
|
dev_nix_installer_sha256_url: "{{ dev_nix_installer_url }}.sha256"
|
|
|
|
# Path where the installer will be downloaded on the target host
|
|
dev_nix_installer_dest: "/usr/local/share/nix-install.sh"
|
|
|
|
dev_nix_binary_candidates:
|
|
- /nix/var/nix/profiles/default/bin/nix
|
|
- /nix/var/nix/profiles/per-user/root/profile/bin/nix
|
|
- /root/.nix-profile/bin/nix
|
|
- /usr/local/bin/nix
|
|
- /usr/bin/nix
|
|
|
|
# Will be filled at runtime from dev_nix_installer_sha256_url
|
|
dev_nix_installer_sha256: ""
|
|
|
|
dev_nix_enable_shell_snippet: true
|
|
|
|
# Path of the profile.d snippet
|
|
dev_nix_shell_snippet_path: "/etc/profile.d/nix.sh"
|
|
|
|
# Enable experimental features such as nix-command and flakes
|
|
dev_nix_enable_experimental_features: true
|
|
|
|
# List of experimental features to enable when dev_nix_enable_experimental_features is true
|
|
dev_nix_experimental_features:
|
|
- nix-command
|
|
- flakes
|
|
|
|
DEV_NIX_SSL_CERT_FILE_CANDIDATES: "{{ CA_BUNDLE_CANDIDATES }}"
|