lfg2025/archy
1
0
Fork 0
Code Issues 11 Pull Requests Actions Packages Projects Releases 12 Wiki Activity

Preserve app gate TLS access through provisioning and certificate rotation

Browse Source
This commit is contained in:
archipelago
2026-10-06 15:19:38 -04:00
parent 719e723816
commit 9f0df2ac44
9 changed files with 200 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
image-recipe/_archived/build-auto-installer-iso.sh
+5 -1
View File
@@ -2117,9 +2117,13 @@ gen_tls() {
&& [ -s "$SSL_DIR/archipelago.crt.new" ] \
&& tls_pair_matches "$SSL_DIR/archipelago.key.new" "$SSL_DIR/archipelago.crt.new"; then
chmod 600 "$SSL_DIR/archipelago.key.new"
if getent passwd archipelago >/dev/null 2>&1; then
chgrp "$(id -gn archipelago)" "$SSL_DIR/archipelago.key.new" || return 1
chmod 640 "$SSL_DIR/archipelago.key.new" || return 1
fi
mv "$SSL_DIR/archipelago.key.new" "$SSL_DIR/archipelago.key" \
&& mv "$SSL_DIR/archipelago.crt.new" "$SSL_DIR/archipelago.crt" || return 1
chmod 600 "$SSL_DIR/archipelago.key"
# Keep staged permissions: nginx and the app gate both read this leaf.
return 0
fi
rm -f "$SSL_DIR/archipelago.key.new" "$SSL_DIR/archipelago.crt.new"