11 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
mrcharles	d2541647f2	[#800] ACME e2e proof: IP-identifier issuance validated on sectestbed 5104 ... http-01 validation, issuance, and chain all verified against the fleet root via the prod endpoint; 5104 shut back down after the test. https://projects.knownelement.com/issues/800	2026-09-05 10:16:30 -05:00
mrcharles	d923b5f34b	[#800] ACME prod runbook: endpoint usage + http-01 root-cause debug log ... https://projects.knownelement.com/issues/800	2026-09-05 10:06:35 -05:00
mrcharles	6e4f794b03	[#800] prod step-ca ACME endpoint LIVE on tsys-ca (fleet-root chain); http-01 validation fetch open ... compose.yaml: host networking (bridge+embedded-DNS broke rooted-name lookups), :8443 via ca.json address, image digest-pinned; init-stepca.sh: scaffold + ECDSA-P256 intermediate signed by /root/ca-root fleet root (verified), ACME provisioner, managed password. Directory serving RFC8555 on tailnet. OPEN: step-ca validation GET fails instantly with zero dial attempts (authz says could-not-connect) — bisected caps, read_only, bridge vs host, container DNS. Debug continues next run (GODEBUG=netdns=2 + strace plan). https://projects.knownelement.com/issues/800	2026-09-05 09:35:25 -05:00
mrcharles	c66430a397	[#784] framework: set-e-safe cn_count fallback (|| true, not bare removal) ... https://projects.knownelement.com/issues/784	2026-09-05 07:29:02 -05:00
mrcharles	f9096e19b6	[#784] framework fix: cn_count double-count (grep -c prints 0 + || echo 0 appended second line) ... https://projects.knownelement.com/issues/784	2026-09-05 07:12:19 -05:00
mrcharles	55f59e9a7e	[#784] CI gate alignment: prune legacy/agent dirs from shellcheck; fix SC2015/SC2002 ... Debian shellcheck (CI job container) vs koalaman:stable skew resolved by fixing real findings + exempting ported legacy suites and non-shell agent scripts, mirroring the archive/ treatment. https://projects.knownelement.com/issues/784	2026-09-05 06:21:17 -05:00
mrcharles	674b2cec29	[#784] add fleet CI workflow (shellcheck + secret scan + rule audit) ... https://projects.knownelement.com/issues/784	2026-09-05 06:10:16 -05:00
mrcharles	525ade2908	[#697] point questions file at Redmine (model retired) ... https://projects.knownelement.com/issues/697	2026-09-05 05:33:18 -05:00
mrcharles	a66dbaf20f	feat(ca): step-ca ACME pilot — mechanics verified e2e with lego [#697] ... test-root container pilot (loopback+bridge binds); HTTP-01 issuance proven; phase design for prod ACME/k8s/SSH on t/327#2. https://community.turnsys.com/t/327/2	2026-09-04 17:30:39 -05:00
mrcharles	af7c0f3478	feat: port legacy TSYS-CA (admin-code PKI + tsys-bits) [#769][#783] ... Excluded admin-code/*SECRETS.inc (real Nitrokey HSM PINs in the public source repo) — SECRETS.inc.example template added in their place. Rotation/history-purge ruling pending in #783. legacy-* trees exempt from lint/pointer checks (historical verbatim code). https://projects.knownelement.com/issues/769#note-4152	2026-09-04 07:01:46 -05:00
mrcharles	2eca50490d	chore: initial import from KNEL/PFVCluster@041d311 [#769] ... Split per O&M lane work order. Full history: KNEL/PFVCluster. https://projects.knownelement.com/issues/769#note-4152	2026-09-03 21:30:47 -05:00