Serve a name the moment it is pointed, with nobody touching the box - #12
Merged
ralyodio merged 1 commit intoAug 3, 2026
Merged
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
setup-origin.sh made serving one name one command. It was still one command per name, run by hand, over ssh, and forgetting it left the name resolving to a box that answers with the wrong certificate — or refuses it outright, because a name with no published pin is a name clients will not accept. moshpit-reconcile.sh asks the registry which names point at this host and configures the ones that are not configured yet. Pointing a name in the dashboard becomes the only step there is; the site is up about a minute later. Endings are listed in config rather than discovered, because GET /api/moshpit/tlds returns 200 of the ~5,700 claimed — the default page size — so discovery would serve a subset while looking complete. Idempotent and quiet: a name is only reconfigured when its nginx block is missing or the published pin is not the key actually being served. Without that check every pass would reload nginx, forever. It also treats a mismatched pin as work to do, which is the case that silently breaks a name after a certificate is regenerated. A briefly unreachable registry skips that ending for the pass rather than looking like "nothing is pointed here", which would otherwise be indistinguishable from names having been removed. Verified end to end against the live registry: claimed auto.hacker, pointed it at this host, and the next pass issued the certificate, wrote the nginx block, published the pin and served the site — 200 with the pin enforced. The pass after that changed nothing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Copy link
Copy Markdown
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
Sorry, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
setup-origin.sh made serving a name one command. This makes it none.
The problem
One command per name, run by hand, over ssh. Forget it and the name resolves to a box that answers with the wrong certificate — or gets refused outright, because a name with no published pin is a name clients will not accept. Every name added so far (chovy.hacker, seo.rank, alt.2600) needed somebody to remember.
What this does
moshpit-reconcile.sh asks the registry which names point at this host and configures the ones that are not configured yet. Pointing a name in the dashboard becomes the only step there is; the site is up about a minute later.
Plus a systemd timer (60s, jittered, Persistent=true).
Decisions worth flagging
Endings are listed in config, not discovered. GET /api/moshpit/tlds returns 200 of the ~5,700 claimed — the default page size — so discovery would serve a subset while looking complete. That is the same silent-truncation shape as the systemd-resolved domain cap that has bitten this project twice. A box serving three endings can say so in one line.
A mismatched pin counts as work to do, not just a missing one. Regenerating a certificate without republishing leaves the name refused by every client while the box looks healthy — the check compares what nginx actually serves against what the registry publishes.
Idempotent and quiet. Without the "already served" check every pass would reload nginx, forever.
A briefly unreachable registry skips that ending for the pass rather than being read as "nothing is pointed here" — otherwise a network blip is indistinguishable from every name having been removed, and the difference matters if that ever drives removal.
The API key is in /etc/moshpit/reconcile.conf (0600), not the unit file. Unit files are world-readable and systemctl cat prints them.
Verified end to end, against the live registry
Not a mock. Claimed auto.hacker, pointed it at the host, and let the reconciler run:
The pass after that changed nothing. The timer has been running on the box since, firing every ~64s and reporting all four names already served.
sh -n clean.
Not covered by this
This is the origin side. A visitor still needs moshpit-proxy running locally for curl alt.2600 to work without -k, because the origin certificate is necessarily self-signed — no CA will issue for an ending outside the DNS root. That is a separate install on the visitor's machine, which install.sh already handles.
🤖 Generated with Claude Code