v0.1.0 — a name serves itself

First release. A Moshpit name now goes from "pointed in the dashboard" to "serving over TLS" without anyone touching the box.

The problem this solves

No CA will issue a certificate for .hacker, .rank or .2600 — the CA/Browser Forum stopped issuing for endings outside the DNS root in 2015. So a Moshpit site is either plaintext, or it presents a certificate every browser rejects.

The answer here is a pin: SHA-256 over the origin's SubjectPublicKeyInfo, published in the registry. It replaces the certificate authority rather than supplementing it — one exact key, named by its owner, instead of delegating trust to whichever of ~150 CAs will sign. It is also the part of the design that survives a quantum adversary: a chain is authenticated by RSA or ECDSA signatures, which Shor's algorithm breaks; a pin is authenticated by a hash, and Grover's only halves preimage resistance.

What is in it

moshpit-proxy — runs on the visitor's machine. Terminates TLS with a locally-trusted certificate and verifies the origin against its published pin. Reports whether each origin leg negotiated X25519MLKEM768, and can refuse any that did not.

moshpit-trust — sets a computer up to open Moshpit sites, across NSS, the macOS keychain and per-profile Firefox stores. It asks once, verifies by reading back what it wrote, and never shows the user the word "certificate".

scripts/setup-origin.sh — key, certificate, nginx block, reload, then publishes the pin and sets the target through the registry API. One command, and it re-reads the pin from the endpoint clients actually query rather than trusting its own 201.

scripts/moshpit-reconcile.sh + systemd timer — asks the registry which names point at this host and configures the ones that are not configured yet. Pointing a name becomes the only step there is.

nginx/moshpit-origin.conf — TLS 1.3 only, X25519MLKEM768 first, no HSTS, session tickets off.

Verified against a live deployment

Not a mock. chovy.hacker, seo.rank and alt.2600 are served by this code, each with a published pin that matches the key nginx actually presents. auto.hacker was claimed and pointed with nothing done on the box, and the reconciler had it serving a minute later:

$ curl -k --pinnedpubkey "sha256//<published pin>" https://auto.hacker/
200

51 tests pass.

Known sharp edges

• The visitor side is a real install. Without moshpit-proxy running locally, curl alt.2600 fails on a self-signed certificate — correctly, since the pin is the only thing that makes it trustworthy and curl does not know about it.
• Adding an origin block to a box that has never declared default_server can silently make the new name the default vhost for :443. The script warns rather than editing an unrelated site's config.

🤖 Generated with Claude Code