mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5
1254e27c2d
ca_injected asked three questions, the first being whether the application has a domain. That decides whether it is SERVED over the self-signed CA. An application that only CALLS one has no domain of its own, so the predicate answered false, sys-svc-compose-ca skipped its stack, and the container ran with an empty trust store. svc-ai-agent-broker is such a caller: it authorizes every request against Keycloak group paths over the public HTTPS base. Without the CA every outbound call died in the TLS handshake, the broker answered 503 "access check unavailable", Open WebUI turned that into HTTP 400, and the spec failed on a model it had just listed. Its container was the only one in the rescue artifact without SSL_CERT_FILE, while litellm and open-webui carried it. A service may now declare ca_client: true, and the predicate then answers on the deployment's TLS mode alone, because the domain question is meaningless for a client. The three served-side conditions are untouched, so no application that already received the CA stops receiving it. The alternative of pointing the broker at an internal Keycloak URL was rejected: the role declares no keycloak service, so the URL would render without a route. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>