Document the transport and PKI keys, and the 1.6 rename - #126
Open
darksidemilk wants to merge 2 commits into
Open
Document the transport and PKI keys, and the 1.6 rename#126darksidemilk wants to merge 2 commits into
darksidemilk wants to merge 2 commits into
Conversation
The .fogsettings page was rewritten for 1.6 in #119 and is otherwise current, but the settings this release is actually about were missing from it: httpsRedirect, publicWebCert and rebuildIpxeWithMyCA had no entry at all, and neither did netbootProtoForced, webCertFile, webKeyFile or bootDelay. Three entries were wrong rather than absent. netbootProto said HTTPS netboot 'needs an iPXE rebuilt to trust that CA'. That is the pre-ADR-0015 rule. It defaults to http and moves to https when either publicWebCert or rebuildIpxeWithMyCA is set; a public certificate needs no rebuild, because iPXE cross-certifies public roots on its own. httpProto was described as 'http or https for the web interface', which reads like a preference. It is a record: the installer sets it to https on every run, so --install-mode http-only lowers it for that run and does not persist. acmeLeaf said nothing sets it for you. The installer may infer it once from the certificate it finds. The callout now also states the thing that catches people out -- acmeLeaf and publicWebCert answer different questions, who renews the leaf versus what it chains to, and neither implies the other. The removed-settings table claimed dnsbootimage and donate are stripped on upgrade. They are not in deprecatedKeys, so they survive untouched; the row is gone. In its place is the set that IS stripped now: the pre-1.6 lower-case spellings of the transport and PKI keys, with a note that an existing file migrates itself on the first 1.6 run and that the two lookalikes -- the storage-node sslpath field and PHP's own httpproto -- are unaffected. Also: --install-mode added to the precedence list, where its position relative to the discrete options is the whole reason it composes; and a new table for the handful of settings the installer reads but never writes, which have no option and no prompt, so adding the line by hand is the only way to set them. Kept the page's existing shape throughout -- sections plus a table per group -- and updated the example, which showed httpProto='http' on a server where it is always https. Verified with a full Quartz build: no errors, unparsed-wikilink count still 12. The one unresolved target, netboot-transport-and-pki, is the sibling branch's new page. Co-Authored-By: Claude <noreply@anthropic.com>
httpsRedirect's entry gave fog-client as the only way FOG's root reaches a machine. It is the common one, and many sites already have it on everything, but your own deployment tooling, your own external CA, or a public CA are all routes to the same place. The entry now says the default is off because FOG cannot know which one you used -- not because there is only one. rebuildIpxeWithMyCA said it adds 10-25 minutes to 'this install and every future one'. It does not: the build is stamped against the pinned iPXE version, the embedded CA and the staged binary, and skipped when all three match, so a routine upgrade costs nothing. Rebuilt: no errors, unparsed-wikilink count still 12. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of
FOGProject/fogproject#1120(Phase 3). Depends on #124 for the link target, and documents the key names fromFOGProject/fogproject#1199.The
.fogsettingspage was rewritten for 1.6 in #119 and is otherwise current — this keeps that format and edits in place, it does not restructure. But the settings this release is actually about were missing from it.Missing entirely
httpsRedirect,publicWebCert,rebuildIpxeWithMyCA,netbootProtoForced,webCertFile,webKeyFile,bootDelay.Wrong rather than absent
netbootProtosaid HTTPS netboot "needs an iPXE rebuilt to trust that CA". That is the pre-ADR-0015 rule. It defaults tohttpand moves tohttpswhen eitherpublicWebCertorrebuildIpxeWithMyCAis set; a public certificate needs no rebuild, because iPXE cross-certifies public roots on its own.httpProtowas described as "httporhttpsfor the web interface", which reads like a preference. It is a record: the installer sets it tohttpson every run, so--install-mode http-onlylowers it for that run and does not persist.acmeLeafsaid nothing sets it for you; the installer may infer it once. The callout now also states the thing that catches people out —acmeLeafandpublicWebCertanswer different questions (who renews the leaf vs what it chains to) and neither implies the other.The removed-settings table claimed
dnsbootimageanddonateare stripped on upgrade. They are not indeprecatedKeys, so they survive untouched. That row is gone, replaced by the set that is stripped now — the pre-1.6 lower-case spellings — with a note that an existing file migrates itself on the first 1.6 run, and that the two lookalikes (the storage-nodesslpathfield and PHP's ownhttpproto) are unaffected.Added
--install-modein the precedence list, where its position relative to the discrete options is the whole reason it composes; and a table for the settings the installer reads but never writes (snapinLocation,storageLocationCapture, the timeout and port-range keys), which have no option and no prompt, so adding the line by hand is the only way to set them.The example showed
httpProto='http'on a server where it is alwayshttps.Verified
Full Quartz build: no errors, unparsed-wikilink count still 12.