mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 03:38:23 +00:00
kevinveenbirkenbachandClaude Opus 4.7
3f2021b07d
Follow-up to d002796a5. The formula `infinito_nexus_${INFINITO_DISTRO}` is
now defined in exactly one place — `scripts/meta/env/defaults.sh:18`,
exported outside the load-once guard so it tracks INFINITO_DISTRO across
matrix iterations (caller re-sources defaults.sh after distro changes).
Every other site reads INFINITO_CONTAINER strictly from env; nothing
re-derives the formula, no lazy/colon-dash fallbacks, no per-call defaults.
Production code aligned:
- cli/deploy/development/common.py: add resolve_container() (strict env
reader, raises SystemExit on unset). make_compose() calls it as an
early-fail guard so a missing defaults.sh source surfaces here instead
of as a confusing compose.yml interpolation error later.
- cli/deploy/development/deploy.py: stop re-deriving from compose.distro;
use resolve_container().
- compose.yml: container_name reads ${INFINITO_CONTAINER:?...} strictly,
so callers that bypass defaults.sh fail fast with a clear hint.
- scripts/meta/resolve/image/local.sh: drop ${INFINITO_DISTRO:-debian}
fallback; require INFINITO_DISTRO via :? error.
- scripts/tests/deploy/ci/dedicated.sh: drop local _container fallback.
- scripts/tests/deploy/local/deploy/fresh-kept-app.sh: drop redundant
${INFINITO_DISTRO:-debian} reassignment after sourcing env/all.sh
(defaults.sh already defaults the value).
- scripts/tests/deploy/local/deploy/fresh-purged-app.sh: drop
target_container fallback; INFINITO_CONTAINER is already in env.
- scripts/tests/deploy/local/exec/container.sh: drop the lazy
${INFINITO_CONTAINER:=infinito_nexus_...} default; defaults.sh source
in env/all.sh already guarantees the value.
- scripts/tests/dns.sh: source defaults.sh so callers only need to set
INFINITO_DISTRO (the implicit dependency was previously a footgun).
- scripts/system/tls/trust/{wsl2,linux}.sh: same — source defaults.sh,
drop the ${INFINITO_CONTAINER:-infinito_nexus_debian} fallback in
linux.sh.
- .github/workflows/test-dns.yml: drop redundant
INFINITO_CONTAINER: infinito_nexus_${{ matrix.distro }} from per-step
env blocks (3 sites). The env now flows from INFINITO_DISTRO via the
defaults.sh sourced inside the scripts.
- tests/unit/cli/deploy/development/test_matrix_deploy.py: replace the
module-level os.environ.setdefault('INFINITO_CONTAINER', 'infinito_nexus_arch')
shim — which itself encoded the formula — with a module-level patch of
resolve_container that returns an opaque test-fixture string. Drop the
now-unused distro="arch" field from the _args() Namespace fixture
(deploy.handler stopped consuming it after the --distro arg removal).
Documentation aligned:
- docs/contributing/environment/variables.md: rewrite the INFINITO_CONTAINER
row to spell out the SPOT contract — set automatically by defaults.sh,
never re-derived elsewhere, callers re-source defaults.sh after
changing INFINITO_DISTRO mid-process.
- docs/contributing/artefact/files/compose.yml.md: replace the
INFINITO_DISTRO row (which described the now-removed
`infinito_nexus_${INFINITO_DISTRO:-debian}` interpolation) with an
INFINITO_CONTAINER row noting the strict ${INFINITO_CONTAINER:?...} read.
Verified:
- Formula derivation: 1 production hit (the SPOT in defaults.sh:18).
- INFINITO_CONTAINER fallback patterns (:-/:=): 0.
- --distro CLI arg refs: 0 (one comment explaining the removal).
- make test green: 1553 unit + 168 integration tests, no skipped suites.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
80 lines
2.2 KiB
Bash
Executable File
80 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
|
||
# -----------------------------------------------------------------------------
|
||
# Trust Infinito Root CA from running container on the host system
|
||
# -----------------------------------------------------------------------------
|
||
|
||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
|
||
# Source project defaults so INFINITO_CONTAINER auto-derives from
|
||
# INFINITO_DISTRO (single SPOT in scripts/meta/env/defaults.sh) — callers
|
||
# only need to set INFINITO_DISTRO.
|
||
# shellcheck source=scripts/meta/env/defaults.sh
|
||
source "${SCRIPT_DIR}/../../../meta/env/defaults.sh"
|
||
|
||
CONTAINER_NAME="${INFINITO_CONTAINER}"
|
||
CA_SRC_PATH="/etc/infinito.nexus/ca/root-ca.crt"
|
||
CA_DST_DIR="/etc/infinito.nexus/ca"
|
||
CA_DST_PATH="${CA_DST_DIR}/root-ca.crt"
|
||
CA_TRUST_NAME="infinito-root-ca"
|
||
|
||
WITH_CA_TRUST_SCRIPT="${SCRIPT_DIR}/../../../../roles/sys-ca-selfsigned/files/with-ca-trust.sh"
|
||
|
||
log() {
|
||
echo "[trust-ca] $*" >&2
|
||
}
|
||
|
||
require() {
|
||
if ! command -v "$1" >/dev/null 2>&1; then
|
||
echo "[trust-ca] ERROR: required command not found: $1" >&2
|
||
exit 1
|
||
fi
|
||
}
|
||
|
||
# --- checks ------------------------------------------------------------------
|
||
|
||
require docker
|
||
require sudo
|
||
|
||
if [ -z "$CONTAINER_NAME" ]; then
|
||
echo "[trust-ca] ERROR: INFINITO_CONTAINER is not set" >&2
|
||
exit 2
|
||
fi
|
||
|
||
if [ ! -f "$WITH_CA_TRUST_SCRIPT" ]; then
|
||
echo "[trust-ca] ERROR: with-ca-trust.sh not found at $WITH_CA_TRUST_SCRIPT" >&2
|
||
exit 3
|
||
fi
|
||
|
||
log "Using container: $CONTAINER_NAME"
|
||
log "CA source path (container): $CA_SRC_PATH"
|
||
log "CA destination path (host): $CA_DST_PATH"
|
||
|
||
# --- extract CA ---------------------------------------------------------------
|
||
|
||
log "Extracting Root CA from container"
|
||
sudo mkdir -p "$CA_DST_DIR"
|
||
|
||
sudo docker cp \
|
||
"${CONTAINER_NAME}:${CA_SRC_PATH}" \
|
||
"$CA_DST_PATH"
|
||
|
||
sudo chmod 0644 "$CA_DST_PATH"
|
||
|
||
# --- trust CA -----------------------------------------------------------------
|
||
|
||
log "Installing CA into host trust store"
|
||
|
||
sudo \
|
||
CA_TRUST_CERT="$CA_DST_PATH" \
|
||
CA_TRUST_NAME="$CA_TRUST_NAME" \
|
||
VERBOSE=1 \
|
||
bash "$WITH_CA_TRUST_SCRIPT"
|
||
|
||
log "CA trust installation completed successfully"
|
||
|
||
echo
|
||
echo "✅ Root CA trusted on host system"
|
||
echo "ℹ️ Restart browsers (Chrome / Firefox) if already running"
|