mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
266a37d965
- svc-net-tor: expose SSH (22) + Mailu SMTP/submission/IMAP (25/465/587/143/993) as HiddenServicePorts on the node onion (TOR_ONION_SSH_ENABLED, 19_tor.yml). - email lookup: relay plaintext (tls off, port 25) for .onion mail domains — no public TLS cert for a .onion; onion transport is already authenticated. - CA root CN: drop the " Root CA" suffix when a 62-char v3 onion + suffix would overflow the X.509 commonName 64-char cap (02_tls.yml). - Playwright onion compat: HSTS is HTTPS-only (RFC 6797), absent on the http onion vhost. New shared helper expectHstsWhenTls() gates the assertion on the reached scheme; wired into web-svc-cdn spec. - rerun-spec.sh: route the inner-loop browser through the Tor SOCKS proxy when the staged env targets a .onion, mirroring the deploy-time runner. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
34 lines
1.1 KiB
JavaScript
34 lines
1.1 KiB
JavaScript
/**
|
|
* TLS-dependent header assertions shared by role specs.
|
|
*
|
|
* HSTS (Strict-Transport-Security) is an HTTPS-only header: per RFC 6797 a
|
|
* user agent MUST ignore it when received over plain HTTP, and OpenResty only
|
|
* emits it on the TLS vhost. On an onion node every domain is served over
|
|
* http:// (onion v3 is the transport auth; there is no public TLS cert for a
|
|
* .onion), so the header is legitimately absent. Gate the assertion on the
|
|
* scheme the app is actually reached over so the same spec passes on both
|
|
* clearnet (TLS) and onion (plaintext) nodes.
|
|
*/
|
|
|
|
const { expect } = require("@playwright/test");
|
|
|
|
function isTlsBaseUrl(baseUrl) {
|
|
return /^https:/i.test(String(baseUrl || ""));
|
|
}
|
|
|
|
function expectHstsWhenTls(headers, baseUrl, label) {
|
|
if (isTlsBaseUrl(baseUrl)) {
|
|
expect(
|
|
headers["strict-transport-security"],
|
|
`${label} must emit HSTS`,
|
|
).toBeTruthy();
|
|
} else {
|
|
expect(
|
|
headers["strict-transport-security"],
|
|
`${label} must not emit HSTS over plaintext onion transport`,
|
|
).toBeFalsy();
|
|
}
|
|
}
|
|
|
|
module.exports = { isTlsBaseUrl, expectHstsWhenTls };
|