Skip to content

v0.82.0 — the supervised bridge serves HTTPS

Choose a tag to compare

View all tags
@ralyodio ralyodio released this 30 Aug 15:01
v0.82.0
b3814d3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The supervised bridge never knew about the proxy

moshcode dns enable has always probed for the pinned-TLS proxy and passed it to the daemon it starts. With one on the machine, Moshpit names answer on loopback and TLS terminates at the proxy, which presents a certificate the local root covers. That is the entire mechanism by which https:// on a name no CA will ever sign for can work at all.

dns service, added in v0.78.0, never ran that probe. The unit it wrote started a bridge with no proxy mode, so every name answered its origin — and an origin serves a certificate nothing on the machine has any reason to trust.

The result is the worst shape a bug can take. On a machine with the proxy installed, trusted and running, http:// worked, the name resolved instantly, and https:// failed with self-signed certificate. Nothing in any output connected the two, and the supervised bridge that v0.78.0 exists to recommend was the one way to run Moshpit where HTTPS could not work.

dns service now runs the same probe, at generation time, and writes --proxy into the unit's ExecStart. It has to happen then: the unit runs at boot and has no way to go looking afterwards.

When no proxy is found the command says so, and says what that means for https://, rather than quietly writing a unit that resolves names it cannot serve:

!  no pinned-TLS proxy found on this machine
   names will answer their origin, and a stock client cannot verify those —
   https:// will fail even though the name resolves.

--no-proxy skips the probe. A machine that serves Moshpit names correctly finds nothing — it has nginx on 443, and pointing names at loopback there would hand every one of them to a web server that has never heard of them.

Together with v0.81.0, which installs the proxy from install.sh, an ordinary moshcode upgrade followed by moshcode dns service --write now produces a bridge that survives reboots, forwards clearnet, resolves Moshpit names, and serves them over HTTPS — with nothing left to do by hand.

Assets 2
Loading