rob thijssen
4ee7da4f97
All checks were successful
build-prerelease / Resolve version stamps + change detection (push) Successful in 32s
build-prerelease / Lint (fmt + clippy) (push) Has been skipped
build-prerelease / Build neuron-blackwell (push) Has been skipped
build-prerelease / Build neuron-ampere (push) Has been skipped
build-prerelease / Build neuron-ada (push) Has been skipped
build-prerelease / Package helexa-neuron-ada RPM (push) Has been skipped
build-prerelease / Package helexa-neuron-ampere RPM (push) Has been skipped
build-prerelease / Package helexa-neuron-blackwell RPM (push) Has been skipped
build-prerelease / Test (push) Has been skipped
build-prerelease / Build cortex binary (push) Has been skipped
build-prerelease / Build helexa-bench binary (push) Has been skipped
build-prerelease / Package cortex RPM (push) Has been skipped
build-prerelease / Package helexa-bench RPM (push) Has been skipped
build-prerelease / Publish to rpm.lair.cafe (unstable) (push) Has been skipped
Inside the WireGuard mesh, bench.helexa.ai dead-ends at the OPNsense LAN
interface (only WAN :443 is port-forwarded), so add an internal path:
- asset/nginx/bench.internal.conf — server_name bench.internal, internal
"lair" CA cert, same SPA + /api→bob proxy. Mirrors the *.internal vhost
convention on oolon.kosherinata.internal.
- asset/systemd/step@.{service,timer} — replicate oolon's smallstep cert
renewal (step ca renew via mTLS, every 15 min, reload nginx).
- infra-setup.sh: install the step@ units + /etc/nginx/tls/{cert,key},
install the vhost + enable step@bench.timer once the cert exists; prints
the one-time issuance command otherwise.
Initial cert issuance (JWK provisioner) and bench.internal DNS are
operator steps.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
21 lines
845 B
Desktop File
21 lines
845 B
Desktop File
# Internal-CA cert renewal for %i.internal, driven by step@%i.timer.
|
|
# Replicated from oolon.kosherinata.internal (the kosherinata DC proxy).
|
|
# Renews an EXISTING cert via mTLS (step ca renew) — the initial cert
|
|
# must be issued once with a provisioner (see script/infra-setup.sh).
|
|
# Installed to /etc/systemd/system/step@.service.
|
|
[Unit]
|
|
Description=step cert renew for %i.internal
|
|
Documentation=https://smallstep.com/docs/step-ca/renewal
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecCondition=/usr/bin/step certificate needs-renewal \
|
|
/etc/nginx/tls/cert/%i.internal.pem
|
|
ExecStart=/usr/bin/step ca renew \
|
|
--force \
|
|
--ca-url https://ca.internal \
|
|
--root /etc/pki/ca-trust/source/anchors/root-internal.pem \
|
|
/etc/nginx/tls/cert/%i.internal.pem \
|
|
/etc/nginx/tls/key/%i.internal.pem
|
|
ExecStartPost=/usr/bin/systemctl reload nginx.service
|