certctl

mirror of https://github.com/shankar0123/certctl.git synced 2026-06-07 14:51:30 +00:00

Files

T

shankar0123 25996f86fa fix(deploy): wire CERTCTL_DEMO_MODE_ACK_TS into the demo overlay path

Phase 2 SEC-H3 (commit 69a2b5c) added a fail-closed requirement: when
CERTCTL_DEMO_MODE_ACK=true, the server refuses to start unless
CERTCTL_DEMO_MODE_ACK_TS=<unix-epoch> is set and within the last 24h.
The demo overlay (docker-compose.demo.yml) sets DEMO_MODE_ACK=true
but didn't supply the paired TS, so:

  Failed to load configuration: phase-2 SEC-H3 fail-closed guard
  (missing TS): CERTCTL_DEMO_MODE_ACK=true requires
  CERTCTL_DEMO_MODE_ACK_TS=<unix-epoch> set within the last 24h —
  refuse to start.

This bricks the cold-DB compose smoke job, the README quickstart
(`docker compose -f .yml -f demo.yml up`), and every operator using
the demo overlay locally — symptom: certctl-server container restart
loop with the SEC-H3 message above.

Fix is three-piece:

1. deploy/docker-compose.demo.yml passes the TS through from the
   shell env via `CERTCTL_DEMO_MODE_ACK_TS: "${CERTCTL_DEMO_MODE_ACK_TS:-}"`.
   The overlay can't hardcode the value (it would rot the next day)
   and SEC-H3 is designed to refresh on every up.

2. deploy/demo-up.sh — new helper that mints
   `CERTCTL_DEMO_MODE_ACK_TS=$(date +%s)` and forwards args to
   `docker compose up`. The SEC-H3 error message points operators
   at it. Replaces the bare `docker compose -f ... up` invocation
   in the overlay's docstring + README quickstart references.

3. .github/workflows/ci.yml cold-db-compose-smoke job exports a fresh
   TS before the initial up-d AND re-emits it into /tmp/_smoke.env so
   the force-recreate at step 4 inherits the value (--env-file replaces
   the shell-env source for compose-file interpolation, so omitting the
   re-emission would re-trip the guard).

Other CI compose surfaces verified clean:
- docker-compose.test.yml uses auth=api-key (not demo-mode); not
  affected.
- security-deep-scan.yml uses the base compose without the demo
  overlay; not affected.

Verified locally: YAML parses, bash syntax check passes on demo-up.sh,
overlay's docstring + the SEC-H3 error message now agree on the helper
script's existence.

2026-05-13 20:48:20 +00:00

helm

config: default hardening + operator docs (Phase 2 closure — SEC-H1, SEC-H3, SEC-M4, DEPL-H1, DEPL-M2 + doc-only carve-outs)

2026-05-13 19:50:00 +00:00

test

ci: supply-chain hardening (Phase 1 closure — RED-1, RED-2, TEST-L2)

2026-05-13 19:30:53 +00:00

.env.example

fix(security): close BUNDLE 2 — safe first run, demo mode, agent bootstrap

2026-05-13 00:14:59 +00:00

demo-up.sh

fix(deploy): wire CERTCTL_DEMO_MODE_ACK_TS into the demo overlay path