max / makenotwork

Declare the OS trust store as an mt deploy precondition mt reads its outbound TLS trust anchors from the host CA bundle on all three of its outbound paths, and neither reqwest nor the AWS client offers bundled roots any more, so there is no in-binary fallback. Nothing said so, which made a thin or stale bundle present as a login outage on a node that passes /api/health rather than as a deploy failure.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-08-05 18:18 UTC

Signed with PGP, not checked

Commit: dc50bf6ece6b3298f5ac87cfe508307955729220

Parent: 279f524

1 file changed, +22 insertions, -2 deletions

M multithreaded/deploy/README.md +22 -2

			@@ -68,10 +68,30 @@
68	68		match, or the install is denied.
69	69
70	70		mt also needs what it has always needed on the box, none of which Sando touches:
71		-	the `multithreaded` postgres role and database, `/opt/multithreaded/.env`, and
72		-	`multithreaded.service` installed and enabled (`deploy/multithreaded.service`).
	71	+	the `multithreaded` postgres role and database, `/opt/multithreaded/.env`,
	72	+	`multithreaded.service` installed and enabled (`deploy/multithreaded.service`),
	73	+	and a working OS trust store (see below).
73	74		Sando installs the binary and restarts the unit; it does not create users,
74	75		databases, env files, or units, and it will not rewrite a config that drifted.
75	76
	77	+	### The OS trust store is a precondition
	78	+
	79	+	mt ships no trust anchors of its own. Every outbound TLS connection it makes
	80	+	reads the host CA bundle, which on a Debian-family box means `/etc/ssl/certs`
	81	+	kept current by the `ca-certificates` package. Three paths depend on it: the
	82	+	OAuth token exchange with the MNW server (`src/auth.rs`), link previews
	83	+	(`src/link_preview.rs`), and S3 or MinIO media through `s3-storage`. `reqwest`
	84	+	reads the store through `rustls-platform-verifier` and the AWS client through
	85	+	`rustls-native-certs`; neither offers bundled roots as an option any more, so
	86	+	there is no in-binary fallback to fall back to.
	87	+
	88	+	A host with a thin or stale bundle does not fail in a way that looks like a
	89	+	deploy problem. mt starts, `/api/health` passes because it only probes the
	90	+	database, and pages serve. The first outbound TLS request is a login attempt,
	91	+	because mt is an OAuth relying party, so the symptom is a login outage with a
	92	+	certificate error buried in the journal on a node that reports healthy. Check
	93	+	the bundle when provisioning a node, and keep `ca-certificates` on an update
	94	+	path rather than assuming it stays current.
	95	+
76	96		Rollback is the MNW server's rollback: the previous bundle still holds the
77	97		previous mt binary.