v0.85.0 — enable stops asking for help
Three bugs that were, between them, the manual setup
Getting a desktop resolving and verifying Moshpit names took eleven steps by hand. Three defects account for nearly all of them, and none was in the part anybody was looking at.
The proxy was looked for in root's home. dns enable escalates, so homedir() there is /root — which is where moshpit-proxy is definitively not installed. The command reported "no pinned-TLS proxy installed" on a machine that had one running and serving, and advised installing what was already there. The same mistake pointed the generated unit's MOSHPIT_PROXY_DIR at /root/.moshpit, where the local root it needs does not exist either. There is an operatorHome in this codebase written for exactly this error; it is used now.
The trust check could never pass. It refused any root that did not permit every claimed ending. But the root is minted by moshpit-proxy for the endings it was configured to serve — a handful — while the registry has sold 18224 and counting. So it refused a perfectly good root on the grounds that it did not also cover eighteen thousand endings nobody on that machine was trying to reach. The advice it offered was to regenerate the root, which cannot help: the new one is scoped to the same handful.
A root that covers some of what you resolve is worth exactly what it covers. It installs now, and the shortfall is reported rather than fatal. A root that covers none of them is still refused — that is the wrong root, not a partial one. And the check that actually matters is untouched: a root permitting an ending we do not resolve can vouch for names outside the namespace it is trusted for, and is refused as before.
Both refusals printed the whole list. At 18224 endings that is several screens of terminal, which is not a diagnostic — it is the reason the sentence explaining the problem goes unread. Lists are capped at eight and a count.
What that adds up to
The proxy service installs, because the wrapper is where the command finally looks. The local root reaches the system trust store, because a partial root is no longer refused — and that store is what curl reads. moshpit-trust sets up NSS, which is Chrome and Firefox; nothing had been putting the root where everything else looks.
Still open
http:// on a Moshpit name goes to port 80 on the machine, which is whatever web server is running there. Proxy mode points names at loopback and the proxy owns 443 only, and DNS carries an address with nowhere to put a port. Closing that needs the proxy to take :80 as well.