From 6e04eb0661b0467ccc08a019aff3655215481a28 Mon Sep 17 00:00:00 2001 From: Yaojia Wang Date: Sat, 18 Jul 2026 15:04:04 +0200 Subject: [PATCH] docs: re-assess R1 as a real CP native-CA wiring task (done in A2-prep) --- docs/PLAN_ZERO_TOUCH_ROLLOUT.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/docs/PLAN_ZERO_TOUCH_ROLLOUT.md b/docs/PLAN_ZERO_TOUCH_ROLLOUT.md index 948f8c9..c3b0a15 100644 --- a/docs/PLAN_ZERO_TOUCH_ROLLOUT.md +++ b/docs/PLAN_ZERO_TOUCH_ROLLOUT.md @@ -141,13 +141,17 @@ dual-trust migration window. ## 8. Top risks -- **[R1] Production CA/KMS material for the new CP (§3.1)** — **VERIFIED 2026-07-18: DOWNGRADED.** The - P-256 CA private keys + certs already exist on the VPS (`/etc/relay/{ca(root+intermediate),device-ca, - frp-client-ca}/*.key.pem`). The new CP wants them wired as `NATIVE_FRP_CLIENT_CA_*` / `NATIVE_DEVICE_CA_*` - KMS-ref + cert-DER (the old `control-plane.env` only carries the intermediate ref). So this is a - **config-wiring task** (point CP at the existing keys, possibly via a file/local-KMS shim — confirm - `control-plane/src/boot/native-ca.ts` + `ca-wiring.ts` accept a file path vs strict KMS), **not** a - "build a CA" sub-project. No longer a showstopper for Track A. +- **[R1] Production native-CA wiring in the new CP (§3.1)** — **RE-ASSESSED 2026-07-18: a real (small–medium) + CODE task, the hard prerequisite for the VPS deploy.** The P-256 CA keys + certs exist on the VPS + (`/etc/relay/{device-ca,frp-client-ca}/*.key.pem`), BUT: (1) `env.ts` does **not** define + `NATIVE_FRP_CLIENT_CA_*` / `NATIVE_DEVICE_CA_*` (native-ca.ts:16 flags this as the "concrete follow-up"); + (2) `buildNativeCas` exists but is **never called from `server.ts`** — the prod boot doesn't wire the + native CAs at all (the 246 tests inject dev `inProcessP256CaSigner`s); (3) production wants a KMS resolver + and there is no file-backed signer to load the on-disk PEM keys. **Task A2-prep (do before deploy):** add + the `NATIVE_*` env vars + a file-backed `KmsResolver` (load PEM P-256 key → sign) + call `buildNativeCas` + in `server.ts` and thread the CAs into the enroll services, TDD + reviewed. File-key custody (not KMS) is + acceptable for the single-owner VPS (mirrors the existing `CA_INTERMEDIATE_KEY_PATH` file fallback); + document the KMS upgrade as future. - **[R2] frps control-channel CA mismatch** — must be `frp-client-CA`, not `device-CA`; crossed = silent 1006/handshake failure (this class of bug already cost days in M1). - **[R3] nginx dNSName→Host binding** — the load-bearing isolation control; needs positive **and**