admin-git/DealDocumentScreening
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix CA misconfig for Nomad.
Some checks failed
ci / Lint & typecheck (push) Successful in 30s
Details
ci / Unit tests (push) Successful in 1m5s
Details
ci / Integration tests (push) Failing after 25s
Details

Browse source
This commit is contained in:
febux 2026-09-14 00:16:39 +03:00
parent 8356886436
commit 3c511e10c8
3 changed files with 10 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
deploy/nomad/README.md
View file

@ -86,7 +86,7 @@ sudo cp deploy/nomad/nomad.hcl /etc/nomad.d/nomad.hcl
The API is reachable from the internet (Forgejo runner → VPS), so TLS is The API is reachable from the internet (Forgejo runner → VPS), so TLS is
mandatory. Use the script (CA + server cert with all required SANs in one mandatory. Use the script (CA + server cert with all required SANs in one
shot — hand-rolled openssl commands tend to miss `server.global.vps.nomad`, shot — hand-rolled openssl commands tend to miss `server.global.nomad`,
which `verify_server_hostname` requires): which `verify_server_hostname` requires):
```bash ```bash
@ -107,10 +107,10 @@ openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
# server cert — SANs must cover the RPC hostname AND how clients reach it # server cert — SANs must cover the RPC hostname AND how clients reach it
openssl req -newkey rsa:2048 -nodes \ openssl req -newkey rsa:2048 -nodes \
-keyout server.key -out server.csr \ -keyout server.key -out server.csr \
-subj "/CN=server.global.vps.nomad" -subj "/CN=server.global.nomad"
cat > server.ext <<'EOF' cat > server.ext <<'EOF'
subjectAltName = DNS:server.global.vps.nomad, DNS:localhost, IP:127.0.0.1, IP:<VPS_PUBLIC_IP> subjectAltName = DNS:server.global.nomad, DNS:server.global.vps.nomad, DNS:localhost, IP:127.0.0.1, IP:<VPS_PUBLIC_IP>
extendedKeyUsage = serverAuth, clientAuth extendedKeyUsage = serverAuth, clientAuth
EOF EOF

8
deploy/nomad/gen-tls.sh
View file

@ -24,13 +24,15 @@ openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
-keyout nomad-ca.key -out nomad-ca.crt \ -keyout nomad-ca.key -out nomad-ca.crt \
-subj "/CN=Contract-Check Nomad CA" -subj "/CN=Contract-Check Nomad CA"
# 2. server cert (serverAuth+clientAuth: the agent uses it for both roles) # 2. server cert (serverAuth+clientAuth: the agent uses it for both roles).
# With verify_server_hostname=true the RPC name is server.<REGION>.nomad
# (NOT server.<region>.<dc>.nomad) — region here is "global" (nomad.hcl).
openssl req -newkey rsa:2048 -nodes \ openssl req -newkey rsa:2048 -nodes \
-keyout server.key -out server.csr \ -keyout server.key -out server.csr \
-subj "/CN=server.global.vps.nomad" -subj "/CN=server.global.nomad"
cat > server.ext <<EOF cat > server.ext <<EOF
subjectAltName = DNS:server.global.vps.nomad, DNS:localhost, IP:127.0.0.1, IP:${ip} subjectAltName = DNS:server.global.nomad, DNS:server.global.vps.nomad, DNS:localhost, IP:127.0.0.1, IP:${ip}
extendedKeyUsage = serverAuth, clientAuth extendedKeyUsage = serverAuth, clientAuth
EOF EOF

4
deploy/nomad/nomad.hcl
View file

@ -25,8 +25,8 @@ tls {
cert_file = "/etc/nomad.d/tls/server.crt" cert_file = "/etc/nomad.d/tls/server.crt"
key_file = "/etc/nomad.d/tls/server.key" key_file = "/etc/nomad.d/tls/server.key"
# Requires the server cert SAN to carry server.global.vps.nomad # RPC cert-name convention is server.<region>.nomad (see gen-tls.sh);
# (region.region/datacenter convention) — the README cert command adds it. # the generated SAN list covers both region and region.dc forms.
verify_server_hostname = true verify_server_hostname = true
} }