0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 19:01:54 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.7 72e3f97863 fix(compose/package-cache-frontend/cert-gen): add keyUsage + basicConstraints to root CA

`openssl req -x509` without explicit `-addext` produced a CA cert
without an X.509v3 keyUsage extension. Python 3.13's stricter ssl
module refuses to load the system trust bundle if any anchor lacks
keyUsage, so every outbound HTTPS — including hits against the
cache frontend that proxies codeload.github.com — fails with
`CA cert does not include key usage extension`. mediawiki's
OpenIDConnect extension download failed on this in CI.

Add `keyUsage=critical,keyCertSign,cRLSign`,
`basicConstraints=critical,CA:TRUE`, and `subjectKeyIdentifier=hash`
to the CA self-sign so every freshly generated CA is acceptable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-15 14:23:31 +02:00

cert-gen.sh

fix(compose/package-cache-frontend/cert-gen): add keyUsage + basicConstraints to root CA

2026-05-15 14:23:31 +02:00

README.md

feat(cache): inner-build override + TTL env-var + SPOT docs

2026-04-30 01:08:41 +02:00

upstreams.conf

feat(cache): inner-build override + TTL env-var + SPOT docs

2026-04-30 01:08:41 +02:00

README.md

Package-Cache Frontend (TLS-terminating reverse proxy) 🔐

TLS-terminating reverse proxy in front of the Sonatype Nexus 3 OSS package-cache service. Owns the real upstream package-manager hostnames via DNS-hijack so clients reach the cache transparently.

For services, activation, coverage, and operations of the local cache stack, see cache.md.

Files 📄

upstreams.conf: nginx server-blocks. HTTPS (port 443) per hostname for runner-side traffic, HTTP (port 80) for inner-dockerd Dockerfile builds. Bind-mounted at /etc/nginx/conf.d/upstreams.conf.