Skip to content

WolfStack v25.21.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Aug 08:20
· 23 commits to master since this release
v25.21.0
e3f006c

v25.21.0: LXC containers get a Certificates page — certbot for the web server inside the container

A container running its own web server had no certificate lifecycle at all:
the host Cert Manager runs certbot on the node for WolfProxy, and its certs
are invisible inside an LXC container, so anyone serving sites from Apache2
or WolfServe in a container was dropping to the console to run certbot by
hand — and nothing ever attached the result to the vhosts.

Every LXC row now has a Certificates button. The page detects the web
server inside the container (WolfServe, Apache2, or httpd — systemctl with
a pidof/pgrep fallback for containers without systemd) and shows "Nothing
is installed" when there is none. With one present, it reads the shared
Apache-layout vhost configs and lists every site with its domains, enabled
state, and current HTTPS status, then manages the full lifecycle inside the
container over the configurator's ExecTarget transport (lxc-attach / pct
exec / docker exec):

  • one-click certbot install via the container's own package manager
    (apt/dnf/yum/pacman/apk), verified after the install rather than trusted
  • issue via webroot HTTP-01 served from the site's DocumentRoot through the
    running web server — no downtime, domains and email prefilled from the
    vhost and the host Cert Manager settings; wildcards are refused with a
    pointer to the host page's DNS-01 flow, since webroot cannot validate them
  • the new cert is attached to the site automatically, and any cert can be
    attached to any site: existing SSL paths are rewritten in place, an
    HTTP-only vhost gets its :80 block cloned into a :443 block with SSLEngine
    on. Every attach runs configtest (wolfserve --test fallback) and ROLLS THE
    FILE BACK on failure, so a bad attach can never leave a config the web
    server refuses to load; a missing SSL module produces an a2enmod ssl /
    mod_ssl hint instead of a bare parse error
  • renew and delete per cert, with a warning when a site still references the
    cert being deleted; issued certs carry a --deploy-hook that reloads
    Apache/WolfServe so certbot's own timer inside the container completes
    unattended renewals end to end

Six new /api/containers/{runtime}/{id}/certs/* endpoints (mutating ones
behind the operator gate, certbot runs on the blocking pool). The vhost
parsing, SSL-path rewrite, and :443-clone logic is unit-tested; the live
container flow has not yet been exercised against a real Let's Encrypt
issuance.

Co-Authored-By: CodeWolf paul@wolf.uk.com
Co-Authored-By: Wolf Software Systems Ltd paul@wolf.uk.com

Verifying this release

Each binary is signed via cosign keyless OIDC (no key distribution — signing identity is the GitHub Actions workflow itself, anchored to the Sigstore Fulcio CA and the Rekor transparency log) and ships with a SLSA build provenance attestation.

Verify the cosign signature:

cosign verify-blob \
  --bundle wolfstack-x86_64.cosign.bundle \
  --certificate-identity-regexp 'https://github.com/wolfsoftwaresystemsltd/WolfStack/\.github/workflows/release\.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  wolfstack-x86_64

Verify the build provenance:

gh attestation verify wolfstack-x86_64 --repo wolfsoftwaresystemsltd/WolfStack

Verify the SHA-256 checksum:

sha256sum -c SHA256SUMS

Artifacts

  • wolfstack-x86_64 / wolfstack-aarch64 / wolfstack-armv7 — static musl binaries (Linux x86_64, ARM64 / Raspberry Pi 4+, and 32-bit ARM).
  • wolfstack-<arch>.cosign.bundle — cosign signature bundle (cert + signature + Rekor entry).
  • SHA256SUMS — checksums for both binaries.

For per-version history see CHANGELOG.md.

Assets 9
Loading