WIP: Serve depot HTTPS with ACME HTTP and DNS challenges

forge commented

2026-09-23 08:41:30 +00:00

First-time contributor

Implements the TLS/ACME part of #41. pkg6depotd can serve direct HTTPS from certificate files or obtain and renew them through ACME HTTP-01 or DNS-01 with Cloudflare and Gandi. Invalid TLS configuration fails closed; renewal swaps validated certificates for new connections, provider challenge cleanup survives restarts, and startup backoff persists. The IPS sample, SMF refresh method, README and pkg6depotd(8) describe setup.

Validation: 67/67 depot tests pass locally, including the real HTTPS binary, mocked ACME CA and both DNS APIs, seeded unrelated TXT preservation, failure/recovery, certificate reload, and startup backoff. cargo fmt and mandoc checks pass. Independent Opus review found no release blocker after its Gandi API endpoint question was checked against the official LiveDNS docs. Native illumos CI, SMF install/refresh, and live staging CA/provider runs remain pending. This PR stacks on #43 and remains WIP until integrated release-candidate verification.

Implements the TLS/ACME part of #41. pkg6depotd can serve direct HTTPS from certificate files or obtain and renew them through ACME HTTP-01 or DNS-01 with Cloudflare and Gandi. Invalid TLS configuration fails closed; renewal swaps validated certificates for new connections, provider challenge cleanup survives restarts, and startup backoff persists. The IPS sample, SMF refresh method, README and pkg6depotd(8) describe setup. Validation: 67/67 depot tests pass locally, including the real HTTPS binary, mocked ACME CA and both DNS APIs, seeded unrelated TXT preservation, failure/recovery, certificate reload, and startup backoff. cargo fmt and mandoc checks pass. Independent Opus review found no release blocker after its Gandi API endpoint question was checked against the official LiveDNS docs. Native illumos CI, SMF install/refresh, and live staging CA/provider runs remain pending. This PR stacks on #43 and remains WIP until integrated release-candidate verification.

forge added 1 commit

2026-09-23 08:41:31 +00:00

Serve depot HTTPS with ACME HTTP and DNS challenges

CI / illumos (OpenIndiana) build + nextest (pull_request) Successful in 26m20s

Details

CI / Linux (fmt / clippy / nextest / e2e / docs) (pull_request) Failing after 32m22s

Details

4031e6ae7a

forge referenced this pull request

2026-09-23 08:41:48 +00:00

V1: IPS/SMF deployment with direct TLS, proxy mode and ACME #41

forge referenced this pull request

2026-09-23 08:51:44 +00:00

v1 deployable pkg6 depot: pkg5 imports, retention, TLS, telemetry and release pipeline #46

toasterson referenced this pull request

2026-09-27 13:10:12 +00:00

v1 server release line: RC13 source, acceptance criteria (ADR-015) and glossary #54

toasterson commented

2026-09-27 13:12:54 +00:00

Owner

Superseded by #54, which brings the whole RC13 line (feat/historical-import, a strict superset of v1-integration-20260923) to main in one pull request, as decided in ADR-015 item 6. Nothing from this branch is lost; closing to keep one integration path.

Superseded by #54, which brings the whole RC13 line (`feat/historical-import`, a strict superset of `v1-integration-20260923`) to `main` in one pull request, as decided in ADR-015 item 6. Nothing from this branch is lost; closing to keep one integration path.

toasterson closed this pull request

2026-09-27 13:12:56 +00:00

CI / illumos (OpenIndiana) build + nextest (pull_request) Successful in 26m20s

Details

CI / Linux (fmt / clippy / nextest / e2e / docs) (pull_request) Failing after 32m22s

Details

Pull request closed

Please reopen this pull request to perform a merge.

Rows
Columns

WIP: Serve depot HTTPS with ACME HTTP and DNS challenges #47

Pull request closed