feat: deliver LP1 isolated local proof topology - #5
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3eec7dff1d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| cap_drop: | ||
| - ALL |
There was a problem hiding this comment.
When the proof profile runs, local-dns starts as root with every capability removed, while its entrypoint invokes dnsmasq with --user=nobody --group=nogroup. The dnsmasq --user documentation states that dnsmasq changes its user ID after startup, but that transition requires CAP_SETUID and CAP_SETGID; without them it exits before becoming healthy, so the new live LP1 workflow cannot pass. Run the container directly as the unprivileged user, which is possible on port 5353, or retain the narrowly required capabilities.
Useful? React with 👍 / 👎.
| umask 0007 | ||
| chmod 0750 "$ca_dir" | ||
|
|
||
| if [[ ! -s "$ca_dir/ca.key" || ! -s "$ca_dir/ca.crt" ]]; then |
There was a problem hiding this comment.
When an operator reuses an external lp1-ca-data volume after the generated seven-day validity period, this nonempty-file check skips CA regeneration, and the equivalent leaf check does the same. The proof client only verifies the signature and constructs a TLS context; neither operation validates the certificate dates, so the rehearsal can report certificate health while retaining expired CA and leaf material. Check validity before reuse and regenerate the affected chain when it has expired or is near expiry.
Useful? React with 👍 / 👎.
|
|
||
| const application = await waitForHealthy('gulogulo-proof'); | ||
| await waitForHealthy('local-ca'); | ||
| await waitForHealthy('local-dns'); |
There was a problem hiding this comment.
If docker compose up --detach creates the project network, volumes, or some containers and then fails—for example because one loopback port is already occupied—execution never reaches this assignment, so the finally block skips compose down. That leaves the supposedly disposable LP1 project behind and can make later runs collide with stale resources; enable cleanup before invoking up, or run down unconditionally for this uniquely named project.
Useful? React with 👍 / 👎.
1 participant
Summary
Validation
The milestone branch is intended to be deleted after this PR is merged and the post-merge checks are green.