max / makenotwork

1.4 KB · 34 lines History Blame Raw

1	#!/bin/bash
2	# Install the one-package ca-certificates refresh timer on the Makenotwork
3	# production host. Idempotent: safe to re-run.
4	#
5	# Why this exists at all: prod's Unattended-Upgrade::Allowed-Origins covers
6	# noble, noble-security and the two ESM security pockets, and deliberately
7	# leaves noble-updates out. ca-certificates is published to noble-updates and
8	# has reached noble-security too, but by Ubuntu's publishing habit rather than
9	# by any rule. This timer closes that one gap on a mechanism instead of a
10	# habit, and its blast radius is exactly ca-certificates plus openssl.
11	#
12	# What was ruled out, so it is not re-derived: Unattended-Upgrade::Package-
13	# Whitelist filters within the allowed origins and never adds one, confirmed
14	# by dry-run on this host. Strict mode is worse -- it pins every allowed origin
15	# to -1 and lifts only whitelisted names, silently ending security patching for
16	# everything else.
17	#
18	# Full policy, including what would have to be true to revisit it: wiki note
19	# `prod-patching-policy`.
20
21	set -euo pipefail
22
23	if [ "$(id -u)" -ne 0 ]; then
24	echo "run as root on the production host" >&2
25	exit 1
26	fi
27
28	cd "$(dirname "$0")"
29	install -m 0644 ca-certificates-refresh.service /etc/systemd/system/
30	install -m 0644 ca-certificates-refresh.timer /etc/systemd/system/
31	systemctl daemon-reload
32	systemctl enable --now ca-certificates-refresh.timer
33	systemctl list-timers ca-certificates-refresh.timer --no-pager
34