mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5.5
66c8df6729
A node runs in NETWORK_MODE clearnet, tor or multi; empty derives multi when svc-net-tor is deployed. meta/networks.yml reachability narrows a role (modes, single_mode, each justified by a network-reachability nocheck), and utils/networks/reachability.py is the one registry every network decision goes through. services.tor keeps only the dependency bond; exclusive and primary are gone and Matrix is single_mode. Every canonical domain gains one sibling per effective network, clearnet first. sys-stk-front-proxy renders one vhost per sibling, and TLS, CSP, injected snippets, redirects, the web health probe and the CSP crawler are decided per vhost. Cross-app URLs follow the network of the vhost being rendered, the SSO issuer stays single, clearnet vhosts of multi roles send Onion-Location, and the shared location forwards X-Forwarded-Host, which lets Wazuh derive its OIDC redirect per request again. The to_onion_url filter is removed; its two consumers render per vhost instead. Measured before commit: on a clearnet node the domain map of all 108 apps and every CSP header are identical to HEAD; on a multi node every role keeps its clearnet domains first and only gains onion siblings, and no CSP source crosses networks except the SSO issuer. Refs: docs/requirements/037-multi-network-serving.md Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Certificate & TLS Unit Tests 🔐
Unit tests for the top-level certificate and TLS helper modules in utils/: cert_utils.py (wildcard/exact match logic, newest-certificate selection) and tls_common.py (flavor handling, SAN overrides, domain normalisation).
Tests in this directory MUST only cover the pure-function behaviour of utils.cert_utils and utils.tls_common. Lookup-plugin integration that depends on these modules MUST live under tests/unit/python/plugins/lookup/.
For framework and make test-unit usage see unit.md.