main
tag: launch-2026-06-01
tag: magicmirror-v0.1.1
tag: magicmirror-v0.3.0
tag: mnw-cli-v0.1.2
tag: mnw-cli-v0.1.3
tag: mnw-cli-v0.1.4
tag: pom-v0.4.1
tag: pom-v0.4.2
tag: pom-v0.4.3
tag: pom-v0.4.4
tag: pom-v0.4.5
tag: wam-v0.3.0
tag: wam-v0.3.1
Files
Commits
Tags
Notes
Issues
Ship a one-package ca-certificates refresh timer for prod
prod-1's Unattended-Upgrade::Allowed-Origins covers noble, noble-security and
the two ESM security pockets, and leaves noble-updates out: a dry run showed
adding it would upgrade 40 packages including cloud-init, netplan and
apparmor, which is a real way to lose the single production host. But
ca-certificates ships to noble-updates, and has reached noble-security only by
Ubuntu's publishing habit rather than by any rule.
This closes that one gap on a mechanism. Blast radius is exactly
ca-certificates plus openssl. Package-Whitelist cannot do the job -- it
filters within the allowed origins and never adds one -- and strict mode
silently ends security patching for everything not whitelisted.
Policy and what would have to be true to revisit it: wiki prod-patching-policy.
3 files changed,
+61 insertions,
-0 deletions
1
+
[Unit]
2
+
# Policy and what was ruled out: wiki note prod-patching-policy, and
3
+
# setup-ca-certificates-refresh.sh beside this file.
4
+
Description=Refresh ca-certificates
5
+
6
+
[Service]
7
+
Type=oneshot
8
+
Environment=DEBIAN_FRONTEND=noninteractive
9
+
# Two commands, one package. Unattended-upgrades on this host does not read
10
+
# noble-updates (see the wiki note), and ca-certificates has historically
11
+
# reached noble-security only by Ubuntu's habit rather than by any guarantee.
12
+
# This closes that one gap without broadening what else may install itself
13
+
# unattended on the single production host.
14
+
ExecStart=/usr/bin/apt-get -q update
15
+
ExecStart=/usr/bin/apt-get -q -y --only-upgrade install ca-certificates
16
+
17
+
[Install]
18
+
WantedBy=multi-user.target
1
+
[Unit]
2
+
Description=Daily ca-certificates refresh
3
+
4
+
[Timer]
5
+
OnCalendar=daily
6
+
RandomizedDelaySec=1h
7
+
Persistent=true
8
+
9
+
[Install]
10
+
WantedBy=timers.target
1
+
#!/bin/bash
2
+
# Install the one-package ca-certificates refresh timer on the Makenotwork
3
+
# production host. Idempotent: safe to re-run.
4
+
#
5
+
# Why this exists at all: prod's Unattended-Upgrade::Allowed-Origins covers
6
+
# noble, noble-security and the two ESM security pockets, and deliberately
7
+
# leaves noble-updates out. ca-certificates is published to noble-updates and
8
+
# has reached noble-security too, but by Ubuntu's publishing habit rather than
9
+
# by any rule. This timer closes that one gap on a mechanism instead of a
10
+
# habit, and its blast radius is exactly ca-certificates plus openssl.
11
+
#
12
+
# What was ruled out, so it is not re-derived: Unattended-Upgrade::Package-
13
+
# Whitelist filters *within* the allowed origins and never adds one, confirmed
14
+
# by dry-run on this host. Strict mode is worse -- it pins every allowed origin
15
+
# to -1 and lifts only whitelisted names, silently ending security patching for
16
+
# everything else.
17
+
#
18
+
# Full policy, including what would have to be true to revisit it: wiki note
19
+
# `prod-patching-policy`.
20
+
21
+
set -euo pipefail
22
+
23
+
if [ "$(id -u)" -ne 0 ]; then
24
+
echo "run as root on the production host" >&2
25
+
exit 1
26
+
fi
27
+
28
+
cd "$(dirname "$0")"
29
+
install -m 0644 ca-certificates-refresh.service /etc/systemd/system/
30
+
install -m 0644 ca-certificates-refresh.timer /etc/systemd/system/
31
+
systemctl daemon-reload
32
+
systemctl enable --now ca-certificates-refresh.timer
33
+
systemctl list-timers ca-certificates-refresh.timer --no-pager