mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 5.5
69aee158f6
Matrix is the only single_mode role: on a multi node it is served on onion only, so it has no TLS of its own, yet Synapse calls the clearnet Keycloak issuer over self-signed TLS. ca_injected returned false, Synapse got no CA, and OIDC discovery failed with CERTIFICATE_VERIFY_FAILED, which Synapse reports as "504 Timeout waiting for response" and Element as "This login provider is unavailable right now". An application with a domain and self-signed TLS of its own still gets the CA. Otherwise a ca_client service now gets it when the SSO issuer application resolves TLS enabled and self-signed. The cherry-picked store-i18n rule answered a domain-less client on the global TLS_MODE; the issuer's own resolved mode honours per-app overrides on both sides, answers false on a tor-only node, and true when TLS_ENABLED is off but the issuer keeps an override, or when the client serves letsencrypt itself. Matrix declares ca_client on its matrix service. A later merge of feature/store-i18n conflicts in ca_injected.py and its test; keep this side. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>