0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-08 11:46:35 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.8 142a4b4241 fix(cache): self-heal package-cache-frontend CA missing keyUsage

OpenSSL 3.x rejects a trust-anchor CA without keyUsage, but cert-gen.sh only regenerated on missing/expiring certs, so a CA created before the keyUsage addext was added (10y validity) never refreshed and broke all MITM-proxied HTTPS verification in the dev cache. Add a keyUsage guard so a deficient CA is regenerated even while still time-valid.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-17 11:30:47 +02:00

cert-gen.sh

fix(cache): self-heal package-cache-frontend CA missing keyUsage

2026-06-17 11:30:47 +02:00

README.md

feat(cache): inner-build override + TTL env-var + SPOT docs

2026-04-30 01:08:41 +02:00

upstreams.conf

feat(cache): inner-build override + TTL env-var + SPOT docs

2026-04-30 01:08:41 +02:00

README.md

Package-Cache Frontend (TLS-terminating reverse proxy) 🔐

TLS-terminating reverse proxy in front of the Sonatype Nexus 3 OSS package-cache service. Owns the real upstream package-manager hostnames via DNS-hijack so clients reach the cache transparently.

For services, activation, coverage, and operations of the local cache stack, see cache.md.

Files 📄

upstreams.conf: nginx server-blocks. HTTPS (port 443) per hostname for runner-side traffic, HTTP (port 80) for inner-dockerd Dockerfile builds. Bind-mounted at /etc/nginx/conf.d/upstreams.conf.