automatic TLS #236
Merged
automatic TLS #236
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
it was either this or support host networking, which turned out to be a rat's nest. this feels more generally useful, but the story is a little incomplete; host->thunk uses a trusted CA, but there's no magic CA trusting for thunk->thunk yet.
this was preventing reaping since that happens in a separate goroutine
guessing this is the root cause for stuck zombies signal.Notify expects the channel to never block
this is handled by a search domain now
cert installation requires spawning a child process, so we don't want to be listening for SIGCHLD yet
previously if the thunk failed we'd keep waiting on the health check; now it'll be interrupted
certstrap checks perms, can't exceed r--r--r--
the runtime is the only thing that depends on basstls, but it relies on it being initialized. so now it just initializes it too. the alternative is making sure to initialize it everywhere the runtime is used (docs, tests, irl), which feels messy.
regenerating them all the time means we can't dedupe services
otherwise running tls.bass directly on the host (as opposed to via bass) fails
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bass now generates a "Bass CA" to the user's
~/.config/bass/tls/and uses it to mint certificates for thunks that need them.Use
(with-tls thunk ./cert.pem ./key.pem)to have the runtime generate a TLS certificate and private key for the thunk at the specified paths. The certificate will be valid for the thunk addr's$host(same as the container'shostname).resolv.confso that the host can resolve thunk addrs.The first two tasks make it possible to run an image registry thunk like Nixery or a pull-through registry mirror and use its addr for another thunk's image.
bonus material
masternow that necessary prs are mergedFootnotes
side note: not 100% sure the GOMAXPROCS removal is needed, but I'm also not sure it was needed in the first place 🤷♂️ ↩