From 9016c3a43be886bb07a5f3a23bd1d336fafa11fa Mon Sep 17 00:00:00 2001 From: dtoro Date: Wed, 29 Jul 2026 18:49:37 +0200 Subject: [PATCH] revert(seeds): drop TLS certificate entities (needs container reachability first) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The cert-expiry builder and checkCertExpiry probe are correct, but the scheduler container can't reach *.hubris.network:443 — its DNS forwards to the host resolver, which doesn't know the split-horizon zone, and overriding the container DNS would break docker service-name resolution. Seeding the 20 cert entities now produced 20 false-down certificates. Keep the builder (committed), drop the entities + edges until the scheduler can reach Caddy (extra_hosts mapping, or a SNI-dial enhancement) — then re-add them. --- seeds/inventory.yaml | 45 -------------------------------------------- 1 file changed, 45 deletions(-) diff --git a/seeds/inventory.yaml b/seeds/inventory.yaml index 9853fde..aa1a475 100644 --- a/seeds/inventory.yaml +++ b/seeds/inventory.yaml @@ -339,30 +339,6 @@ entities: - {slug: "ingress:sab.hubris.network", type: ingress-route, name: sab.hubris.network, attributes: {forward_auth: true}} - # ─── TLS certificates (Caddy-managed, *.hubris.network) ─────────── - # One entity per public hostname; the cert-expiry checker dials each on - # :443 and reads NotAfter. The cn/name is the hostname the checker dials. - - {slug: "cert:proxmox.hubris.network", type: certificate, name: proxmox.hubris.network} - - {slug: "cert:git.hubris.network", type: certificate, name: git.hubris.network} - - {slug: "cert:auth.hubris.network", type: certificate, name: auth.hubris.network} - - {slug: "cert:media.hubris.network", type: certificate, name: media.hubris.network} - - {slug: "cert:cloud.hubris.network", type: certificate, name: cloud.hubris.network} - - {slug: "cert:paperless.hubris.network", type: certificate, name: paperless.hubris.network} - - {slug: "cert:matrix.hubris.network", type: certificate, name: matrix.hubris.network} - - {slug: "cert:photos.hubris.network", type: certificate, name: photos.hubris.network} - - {slug: "cert:artifacto.hubris.network", type: certificate, name: artifacto.hubris.network} - - {slug: "cert:trmnl.hubris.network", type: certificate, name: trmnl.hubris.network} - - {slug: "cert:zimaos.hubris.network", type: certificate, name: zimaos.hubris.network} - - {slug: "cert:teddy.hubris.network", type: certificate, name: teddy.hubris.network} - - {slug: "cert:mcp.hubris.network", type: certificate, name: mcp.hubris.network} - - {slug: "cert:house.hubris.network", type: certificate, name: house.hubris.network} - - {slug: "cert:books.hubris.network", type: certificate, name: books.hubris.network} - - {slug: "cert:seanime.hubris.network", type: certificate, name: seanime.hubris.network} - - {slug: "cert:roms.hubris.network", type: certificate, name: roms.hubris.network} - - {slug: "cert:jellyseerr.hubris.network", type: certificate, name: jellyseerr.hubris.network} - - {slug: "cert:qbit.hubris.network", type: certificate, name: qbit.hubris.network} - - {slug: "cert:sab.hubris.network", type: certificate, name: sab.hubris.network} - # ─── Governance ──────────────────────────────────────────────────── - {slug: "person:dtoro", type: person, name: dtoro, attributes: {matrix_id: "@dtoro:avispero"}} @@ -510,27 +486,6 @@ relationships: - {source: "ingress:jellyseerr.hubris.network", target: "service:caddy", type: served-by} - {source: "ingress:qbit.hubris.network", target: "service:caddy", type: served-by} - {source: "ingress:sab.hubris.network", target: "service:caddy", type: served-by} - # Each public route is served with its TLS certificate. - - {source: "ingress:proxmox.hubris.network", target: "cert:proxmox.hubris.network", type: uses-certificate} - - {source: "ingress:git.hubris.network", target: "cert:git.hubris.network", type: uses-certificate} - - {source: "ingress:auth.hubris.network", target: "cert:auth.hubris.network", type: uses-certificate} - - {source: "ingress:media.hubris.network", target: "cert:media.hubris.network", type: uses-certificate} - - {source: "ingress:cloud.hubris.network", target: "cert:cloud.hubris.network", type: uses-certificate} - - {source: "ingress:paperless.hubris.network", target: "cert:paperless.hubris.network", type: uses-certificate} - - {source: "ingress:matrix.hubris.network", target: "cert:matrix.hubris.network", type: uses-certificate} - - {source: "ingress:photos.hubris.network", target: "cert:photos.hubris.network", type: uses-certificate} - - {source: "ingress:artifacto.hubris.network", target: "cert:artifacto.hubris.network", type: uses-certificate} - - {source: "ingress:trmnl.hubris.network", target: "cert:trmnl.hubris.network", type: uses-certificate} - - {source: "ingress:zimaos.hubris.network", target: "cert:zimaos.hubris.network", type: uses-certificate} - - {source: "ingress:teddy.hubris.network", target: "cert:teddy.hubris.network", type: uses-certificate} - - {source: "ingress:mcp.hubris.network", target: "cert:mcp.hubris.network", type: uses-certificate} - - {source: "ingress:house.hubris.network", target: "cert:house.hubris.network", type: uses-certificate} - - {source: "ingress:books.hubris.network", target: "cert:books.hubris.network", type: uses-certificate} - - {source: "ingress:seanime.hubris.network", target: "cert:seanime.hubris.network", type: uses-certificate} - - {source: "ingress:roms.hubris.network", target: "cert:roms.hubris.network", type: uses-certificate} - - {source: "ingress:jellyseerr.hubris.network", target: "cert:jellyseerr.hubris.network", type: uses-certificate} - - {source: "ingress:qbit.hubris.network", target: "cert:qbit.hubris.network", type: uses-certificate} - - {source: "ingress:sab.hubris.network", target: "cert:sab.hubris.network", type: uses-certificate} - {source: "ingress:secrets.hubris.network", target: "service:secrets-issuance", type: routes-to} - {source: "ingress:house.hubris.network", target: "service:house", type: routes-to}