From 23173c024a282719642a32dad906a3163d3cfef1 Mon Sep 17 00:00:00 2001 From: archipelago Date: Thu, 6 Aug 2026 15:25:23 -0400 Subject: [PATCH] docs(13): record the app-port TLS work and its two remaining gaps Includes the rustls finding (it does not verify key/certificate pairing) so the explicit check is not later mistaken for redundant, and the archi-dev-box caveat: it has no HTTPS dashboard, so it cannot reproduce the iframe failure. Co-Authored-By: Claude Opus 5 (1M context) --- .../2026-08-06-open-operational-tasks.md | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/.planning/todos/pending/2026-08-06-open-operational-tasks.md b/.planning/todos/pending/2026-08-06-open-operational-tasks.md index 22858200..691936a6 100644 --- a/.planning/todos/pending/2026-08-06-open-operational-tasks.md +++ b/.planning/todos/pending/2026-08-06-open-operational-tasks.md @@ -44,6 +44,29 @@ request (protocol unverified, zero allowance), E-09 naive-user comprehension stu `ssl_verify_result=0`; rejected without it). **STILL OPEN:** app ports serve plain HTTP — putting the CA-signed leaf on them is what actually closes the bug. UX polish deferred by the operator ("we'll decide on the actual UX later"). +- **HTTPS on app ports — BUILT, NOT DEPLOYED.** `7515166a`: the gate serves TLS and plain + HTTP on the same port, chosen per connection by peeking the first byte (`0x16` = TLS + ClientHello; `peek` does not consume, so the acceptor sees it whole). Cert/key mtimes + stamped as a pair; 15s first-byte timeout; PKCS#8 + PKCS#1 both accepted. **Existing nodes + unaffected by construction** — non-TLS bytes take the identical old path, and a node with + no certificate serves plain HTTP exactly as today. 38/38 appgate tests. + **FINDING: rustls does NOT check that a key matches its certificate** — `with_single_cert` + accepted a mismatched pair and would only have failed mid-handshake in a browser. Proven by + test, then fixed with an explicit sign/verify pairing check. Do not remove it. + **STILL OPEN, both needed for "works first time":** + (a) nothing provisions the CA automatically — `setup-node-ca.sh` must be run by hand, and + existing nodes carry a bare self-signed leaf that is NOT CA-signed, so installing the CA + does nothing until the leaf is reissued. Needs a boot-time ensure, shaped like + `bootstrap::ensure_restart_policy()`. + (b) no "Refresh certificate" button in Settings → System → Node certificate, for when a + node gains an address. + Test target: archi-dev-box can prove the HTTP path is unbroken and that TLS answers on an + app port, but it has NO HTTPS dashboard (nginx has no 443 block; the 443 listener is + Tailscale serve → `127.0.0.1:8787`), so it cannot reproduce the original iframe failure. + Also: this box answers to BOTH `archi-dev-box` and `archi-thinkpad` — two memory notes + treat them as separate machines. +- **App frames follow the dashboard scheme — FIXED `f09ff102`** (http→http, https→https; + `pageScheme()` defaults to http so plain-HTTP nodes are untouched). - **App health UX — FIXED `c65ee03a`** (needs deploy to be real). A container that is up but not answering its probe now reads " is starting…" with its own pulsing icon while the 6×10s auto-retries are in flight; the hard failure copy returns once they are exhausted.