inbuxa/inbuxa-server
1
0
Fork 0
Code Issues Pull Requests 1 Actions 1 Packages Projects Releases Wiki Activity

Specs: ufw is in the way of the ACME test, and the rules say so

Browse Source 
/etc/ufw/user.rules is world-readable, so this needed no privilege after
all. The default input policy is DROP and 8899 is not among the allowed
ports, so pebble's connection to the suite's listener is dropped. That
matches the live run, where twelve probes from a container completed no
handshake while the same openssl reached pebble's own TLS port.

The nc readings that pointed the other way — instant refusals on closed
ports, where a DROP should hang — are still unexplained, and are left on
the page as unexplained rather than quietly dropped, since they are what
sent an earlier pass through this page in the wrong direction.

Nobody has added the allow rule and re-run the suite, so the fix is
written down as a prediction. The cutover draft says the same: the test
failing here is not evidence that renewal works on the host.
This commit is contained in:
jcoffey-dev
2026-09-19 21:27:40 -07:00
parent 26759a1847
commit 63fe315457
2 changed files with 32 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/spec/cutover.md
+6 -5
View File
@@ -15,11 +15,12 @@ has to do things nothing has yet asked of it:
- hold INBUXA's ports (25, 465, 587, 143, 993, 110, 995, 443) under load,
as an unprivileged user with `CAP_NET_BIND_SERVICE`;
- keep certificates renewing. ACME renewal was found broken and fixed
(`309835b`), and the remaining test failure is unexplained
(`container-tests.md`, "What a plain regression leaves failing"). A
certificate that fails to renew is a 90-day fuse, not an outage on the
day, so it is the first thing to watch and the least likely to announce
itself;
(`309835b`), and the test that still fails here fails for a reason local
to this machine: `ufw` drops the port pebble validates against
(`container-tests.md`). That is not evidence the renewal works on the
host, only that the failure isn't the fork's. A certificate that fails to
renew is a 90-day fuse, not an outage on the day, so it is the first thing
to watch and the least likely to announce itself;
- write to a store that the Enterprise build wrote until an hour earlier.
The rehearsal below exists to turn those from assumptions into observations.