kevinveenbirkenbach/computer-playbook
1
0 Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-12 13:47:01 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
05f2d9d6cc8e4d87db43d3141506fdebf58b1663
computer-playbook/scripts/system/tls/trust
T
History
kevinveenbirkenbachandClaude Opus 4.7 3f2021b07d refactor: collapse INFINITO_DISTRO/INFINITO_CONTAINER to a single SPOT and align all consumers 
Follow-up to d002796a5. The formula `infinito_nexus_${INFINITO_DISTRO}` is
now defined in exactly one place — `scripts/meta/env/defaults.sh:18`,
exported outside the load-once guard so it tracks INFINITO_DISTRO across
matrix iterations (caller re-sources defaults.sh after distro changes).
Every other site reads INFINITO_CONTAINER strictly from env; nothing
re-derives the formula, no lazy/colon-dash fallbacks, no per-call defaults.

Production code aligned:

- cli/deploy/development/common.py: add resolve_container() (strict env
  reader, raises SystemExit on unset). make_compose() calls it as an
  early-fail guard so a missing defaults.sh source surfaces here instead
  of as a confusing compose.yml interpolation error later.
- cli/deploy/development/deploy.py: stop re-deriving from compose.distro;
  use resolve_container().
- compose.yml: container_name reads ${INFINITO_CONTAINER:?...} strictly,
  so callers that bypass defaults.sh fail fast with a clear hint.
- scripts/meta/resolve/image/local.sh: drop ${INFINITO_DISTRO:-debian}
  fallback; require INFINITO_DISTRO via :? error.
- scripts/tests/deploy/ci/dedicated.sh: drop local _container fallback.
- scripts/tests/deploy/local/deploy/fresh-kept-app.sh: drop redundant
  ${INFINITO_DISTRO:-debian} reassignment after sourcing env/all.sh
  (defaults.sh already defaults the value).
- scripts/tests/deploy/local/deploy/fresh-purged-app.sh: drop
  target_container fallback; INFINITO_CONTAINER is already in env.
- scripts/tests/deploy/local/exec/container.sh: drop the lazy
  ${INFINITO_CONTAINER:=infinito_nexus_...} default; defaults.sh source
  in env/all.sh already guarantees the value.
- scripts/tests/dns.sh: source defaults.sh so callers only need to set
  INFINITO_DISTRO (the implicit dependency was previously a footgun).
- scripts/system/tls/trust/{wsl2,linux}.sh: same — source defaults.sh,
  drop the ${INFINITO_CONTAINER:-infinito_nexus_debian} fallback in
  linux.sh.
- .github/workflows/test-dns.yml: drop redundant
  INFINITO_CONTAINER: infinito_nexus_${{ matrix.distro }} from per-step
  env blocks (3 sites). The env now flows from INFINITO_DISTRO via the
  defaults.sh sourced inside the scripts.
- tests/unit/cli/deploy/development/test_matrix_deploy.py: replace the
  module-level os.environ.setdefault('INFINITO_CONTAINER', 'infinito_nexus_arch')
  shim — which itself encoded the formula — with a module-level patch of
  resolve_container that returns an opaque test-fixture string. Drop the
  now-unused distro="arch" field from the _args() Namespace fixture
  (deploy.handler stopped consuming it after the --distro arg removal).

Documentation aligned:

- docs/contributing/environment/variables.md: rewrite the INFINITO_CONTAINER
  row to spell out the SPOT contract — set automatically by defaults.sh,
  never re-derived elsewhere, callers re-source defaults.sh after
  changing INFINITO_DISTRO mid-process.
- docs/contributing/artefact/files/compose.yml.md: replace the
  INFINITO_DISTRO row (which described the now-removed
  `infinito_nexus_${INFINITO_DISTRO:-debian}` interpolation) with an
  INFINITO_CONTAINER row noting the strict ${INFINITO_CONTAINER:?...} read.

Verified:
  - Formula derivation: 1 production hit (the SPOT in defaults.sh:18).
  - INFINITO_CONTAINER fallback patterns (:-/:=): 0.
  - --distro CLI arg refs: 0 (one comment explaining the removal).
  - make test green: 1553 unit + 168 integration tests, no skipped suites.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-26 12:21:35 +02:00
..
linux.sh
refactor: collapse INFINITO_DISTRO/INFINITO_CONTAINER to a single SPOT and align all consumers
2026-04-26 12:21:35 +02:00
README.md
docs(tools): restructure security and framework docs, add cleanup workflow
2026-04-10 16:31:22 +02:00
wsl2.sh
refactor: collapse INFINITO_DISTRO/INFINITO_CONTAINER to a single SPOT and align all consumers
2026-04-26 12:21:35 +02:00

README.md

🔐 CA Trust Scripts

This directory contains platform-specific scripts for trusting the Infinito Root CA certificate on the developer's machine. For the canonical Make target index that invokes these helpers, see make.md.

All scripts extract the Root CA from a running Infinito container and install it into the appropriate system trust store, so that browsers and tools accept *.infinito.example TLS certificates without warnings.

📄 Scripts

🐧 linux.sh

Trusts the Infinito Root CA on the Linux host system.

  1. Extracts root-ca.crt from the running Infinito container via docker cp
  2. Places it under /etc/infinito.nexus/ca/root-ca.crt
  3. Installs it into the system trust store via roles/sys-ca-selfsigned/files/with-ca-trust.sh

Requires INFINITO_CONTAINER to be set to the name of the running container.

🪟 wsl2.sh

Trusts the Infinito Root CA on Windows from inside a WSL2 environment. Only executes when running on WSL2 (detected via /proc/version).

  1. Extracts root-ca.crt from the running container and copies it to the Windows Downloads folder
  2. Imports the certificate into the Windows CurrentUser Root trust store via PowerShell (no admin required)
  3. Discovers all configured domains from the nginx config inside the container
  4. Updates the Windows hosts file (C:\Windows\System32\drivers\etc\hosts) with 127.0.0.1 entries for all discovered domains (requires one UAC confirmation)

🔗 Related

  • ../. TLS administration scripts
  • roles/sys-ca-selfsigned/. generates the self-signed Root CA inside the container
Reference in new issue View Git Blame Copy Permalink