Promote aee8fb7ba3 to main #769

Merged

binjovi-bot merged 1 commit from trunk into main 2026-09-14 20:31:03 +00:00

Conversation 0 Commits 1 Files changed 6 +107 -8

binjovi-bot commented 2026-09-14 20:31:02 +00:00

Collaborator

Copy link

No description provided.

binjovi-bot added 1 commit 2026-09-14 20:31:02 +00:00

fix(forge): the chain hosts keep time, and the converge scripts default to the production CA ... aee8fb7ba3

Measured 2026-09-14: freebsd-fsn1 ran 34 s and omnios-hel1 117 s behind UTC.
Nothing synchronised either clock, and snapshot names, certificate validity
and token lifetimes on both tiers read it.

scripts/freebsd/forge-jail.sh gains a "Host clock" step: ntpd_enable and
ntpd_sync_on_start (-g, so a large offset is stepped rather than refused),
started if not running. The host carries its public address on lo0 as well
as em0 (k3s and pf plumbing); ntpd 4.2.8p18 binds every address per
interface, fails the lo0 duplicate with EADDRINUSE and then dies with
SIGSEGV, so ntp.conf gets `interface ignore lo0`. One `interface listen` rule
makes ntpd ignore every address no rule names (measured: with only loopback
listed, em0 got no socket, the pool associations never reached, and the
clock stayed 36 s out), so loopback and the default-route NIC are named
explicitly. Idempotent: each rule is appended once.

scripts/omnios/forge-zone.sh gains the same step with chrony, which OmniOS
ships (service/network/ntp is renamed away): the pool line and `makestep
1.0 3` are ensured in /etc/inet/chrony.conf, the service is enabled without
-s -- on a first enable svcadm reports "unsatisfied dependencies" and exits 4
while they are still coming up, and chrony is online seconds later -- and
the script waits for online itself. Configuration edits restart the
service; nothing else touches it.

Both guards assert the time service (ntpd running / chrony online) and at
most 5 s of skew against the machine running them, which macOS keeps within
milliseconds of NTP.

ACME_CA now defaults to letsencrypt. Both identifiers were approved for
LE-prod earlier today and the first converge issued them; the staging
default was a live footgun, and it fired: one routine converge without
ACME_CA re-issued STAGING certificates on both tiers, and every TLS client
-- the converge's own account step included -- stopped verifying. Re-issue
happens only when the installed CA or CN differs, never on every run
(LE-prod allows five certificates per identifier per 168 h; this used two
of each today).

Both converges ran to EXIT=0 with production certificates back; both guards
pass with the skew now under a second.

Claude-Session: https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6

binjovi-bot merged commit aee8fb7ba3 into main 2026-09-14 20:31:03 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!769

No description provided.