feat(dns): enable supervises the proxy, disable takes it away - #470
Merged
Conversation
Two commands were supposed to be the whole of it — install/upgrade, then `dns enable` — and getting a desktop working took eleven manual steps instead. The largest missing piece: moshpit-proxy ships no unit of its own, so on every machine that installed it, it sat there installed, trusted and never started. Indistinguishable from absent — nothing on 443, no certificate, and `dns enable` correctly reporting no proxy on a box that had one. `dns enable` now writes and starts that unit before it goes looking for a proxy, and waits for 443 to actually be held rather than trusting Type=simple's idea of "active". The unit runs the wrapper with a PATH containing the interpreter running this code — the mistake that has now bitten three times in this codebase, made deliberately once here — drops to the operator's account so the local root in ~/.moshpit is reachable, and is granted CAP_NET_BIND_SERVICE rather than running as root. Validated against the hand-written unit on the one machine where this has been working for months, which reached the same shape. Non-fatal in every direction. A machine without a working proxy resolves Moshpit names and cannot verify them; a machine whose DNS was refused because an optional component would not start is worse. `dns disable` stops and removes it, gated on the restore point rather than on what happens to be in /etc — a proxy unit this tool never installed is somebody else's, and stopping it for sharing a filename is exactly the guessing the manifest exists to prevent. `captureRestorePoint` gains `extraPaths` so both units are recorded the same way as everything else: prior content, or null for "was not here". Null is the load-bearing value — it is what removes a unit this run created and what preserves one that was already there. The trust anchor needed nothing: `applyTrust` has always installed the local root into /usr/local/share/ca-certificates and `applyUntrust` removes it. That step simply never ran, because every enable died before reaching it. Suite: 2741 tests, 0 failures. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ThnQwoieWt8VR6N7gtgnhp
ThreatCrush Security Scan1 finding(s) in the 3 file(s) this pull request changes. HIGH/CRITICAL: 1
90 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 7 | **MEDIUM**: 73 | **LOW**: 10Not introduced by this pull request. The full set is in the Security tab.
…and 70 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commands were meant to be the whole of it —
install/upgrade, thendns enable. Getting a desktop working today took eleven manual steps.The largest missing piece: moshpit-proxy ships no unit of its own, so on every machine that installed it, it sat there installed, trusted and never started. That's indistinguishable from absent — nothing on 443, no certificate, and
dns enablecorrectly reporting no proxy on a box that had one.enable
Writes and starts that unit before it goes looking for a proxy, and waits for 443 to actually be held rather than trusting
Type=simple's idea of "active".The unit runs the wrapper with a
PATHcontaining the interpreter running this code — the mistake that has now bitten three separate times in this codebase, made deliberately once here — drops to the operator's account so the local root in~/.moshpitis reachable, and is grantedCAP_NET_BIND_SERVICErather than running as root.Validated against the hand-written unit on the one machine where this has worked for months; it independently reached the same shape (
User=, absolute mise node path,MOSHPIT_PROXY_TLDS,Restart=always).Non-fatal in every direction. A machine without a working proxy resolves Moshpit names and can't verify them. A machine whose DNS was refused because an optional component wouldn't start is worse.
disable
Stops and removes it — gated on the restore point, not on what's in
/etc. A proxy unit this tool never installed is somebody else's, and stopping it for sharing a filename is exactly the guessing the manifest exists to prevent.captureRestorePointgainsextraPaths, so both units are recorded like everything else: prior content, ornullfor "was not here".nullis the load-bearing value — it removes a unit this run created, and preserves one that was already there.The trust anchor needed nothing
applyTrusthas always installed the local root into/usr/local/share/ca-certificatesandapplyUntrustremoves it. That step simply never ran, because everyenabledied before reaching it. That's why curl failed withunable to get local issuer certificatewhile Chrome (NSS, set up bymoshpit-trust) would have worked.Verification
systemd-analyze verifypasses on the generated unit. 7 new tests. Suite: 2741 tests, 0 failures.Caveat worth stating:
dns enablecannot be end-to-end tested on the dev box — it would take its DNS down, and it's an origin with nginx on 443 so the proxy can't run there. Every piece here is unit-tested and the proxy step is non-fatal by construction, but the full path needs one real desktop run.🤖 Generated with Claude Code
https://claude.ai/code/session_01ThnQwoieWt8VR6N7gtgnhp