Josh Siviour
58e0f2879f
Image import shelled out to virt-customize to install the deployment CA into an imported image's trust store. The step was best-effort and skipped whenever virt-customize was absent, which is the default: nothing in provisioning installs guestfs-tools on a node. When it did run it mutated the image after its checksum had been verified, it could not handle Windows guests, and it tied CA rotation to re-importing every affected AMI. Nothing the stack launches depended on it. ECS container instances, EKS k3s servers and BootDirect microVMs all receive the gateway CA at launch via user-data or fw_cfg, and boot itself needs no CA because IMDS is plain HTTP. The only uncovered case is a customer instance whose own workload calls a Spinifex HTTPS endpoint, which needs a pull mechanism rather than an image mutation. The IMDS responder now serves the CA at /spinifex/ca.pem, outside the /latest tree so the AWS-compatible surface stays byte-identical to EC2's. The route is token-free because a CA certificate is public material and the console already serves it unauthenticated; the X-Forwarded-For SSRF guard still applies. The PEM is cached and re-read on modtime change, so rotating ca.pem on a node reaches guests without restarting vpcd.
title, description, category, tags, resources
| title | description | category | tags | resources | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Source Install | Build Spinifex from source for development, custom builds, or contributing. | Install |
|
|
Source Installation
Build Spinifex from source for development, custom builds, or contributing.
Table of Contents
Overview
This guide builds Spinifex from source. For production deployments, the binary installer is recommended.
Supported Operating Systems:
- Ubuntu 26.04
- Debian 13
Instructions
Step 1. Install Dependencies
mkdir -p ~/Development/mulga && cd ~/Development/mulga
git clone https://github.com/mulgadc/spinifex.git
sudo make -C spinifex quickinstall
export PATH=$PATH:/usr/local/go/bin
Step 2. Clone Sibling Repositories
cd spinifex
./scripts/clone-deps.sh
This clones Predastore (S3) and Viperblock (EBS) alongside Spinifex.
Step 3. Development Initialisation
./scripts/dev-install.sh
This bootstraps a single-node development environment: builds binaries, configures OVN, initialises the cluster, installs the CA certificate, and starts all services.
Step 4. Verify Installation
export AWS_PROFILE=spinifex
aws ec2 describe-instance-types
If this returns a list of available instance types, your installation is working.
Congratulations! Spinifex is installed from source.
Continue to Setting Up Your Cluster to import an AMI, create a VPC, and launch your first instance.
Troubleshooting
Go Not Found in PATH
export PATH=$PATH:/usr/local/go/bin
CA Certificate Not Trusted
On a node or any host running spx/aws against the cluster:
sudo cp /etc/spinifex/ca.pem /usr/local/share/ca-certificates/spinifex-ca.crt
sudo update-ca-certificates
Inside a guest VM there is no /etc/spinifex; fetch the CA from IMDS instead:
sudo curl -fsS http://169.254.169.254/spinifex/ca.pem \
-o /usr/local/share/ca-certificates/spinifex-ca.crt
sudo update-ca-certificates