kai/web-terminal
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs: re-assess R1 as a real CP native-CA wiring task (done in A2-prep)

Browse Source
This commit is contained in:
Yaojia Wang
2026-07-18 15:04:04 +02:00
parent af630143de
commit 6e04eb0661
1 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/PLAN_ZERO_TOUCH_ROLLOUT.md
View File

@@ -141,13 +141,17 @@ dual-trust migration window.
## 8. Top risks ## 8. Top risks
- **[R1] Production CA/KMS material for the new CP (§3.1)** — **VERIFIED 2026-07-18: DOWNGRADED.** The - **[R1] Production native-CA wiring in the new CP (§3.1)** — **RE-ASSESSED 2026-07-18: a real (small–medium)
P-256 CA private keys + certs already exist on the VPS (`/etc/relay/{ca(root+intermediate),device-ca, CODE task, the hard prerequisite for the VPS deploy.** The P-256 CA keys + certs exist on the VPS
frp-client-ca}/*.key.pem`). The new CP wants them wired as `NATIVE_FRP_CLIENT_CA_*` / `NATIVE_DEVICE_CA_*` (`/etc/relay/{device-ca,frp-client-ca}/*.key.pem`), BUT: (1) `env.ts` does **not** define
KMS-ref + cert-DER (the old `control-plane.env` only carries the intermediate ref). So this is a `NATIVE_FRP_CLIENT_CA_*` / `NATIVE_DEVICE_CA_*` (native-ca.ts:16 flags this as the "concrete follow-up");
**config-wiring task** (point CP at the existing keys, possibly via a file/local-KMS shim — confirm (2) `buildNativeCas` exists but is **never called from `server.ts`** — the prod boot doesn't wire the
`control-plane/src/boot/native-ca.ts` + `ca-wiring.ts` accept a file path vs strict KMS), **not** a native CAs at all (the 246 tests inject dev `inProcessP256CaSigner`s); (3) production wants a KMS resolver
"build a CA" sub-project. No longer a showstopper for Track A. and there is no file-backed signer to load the on-disk PEM keys. **Task A2-prep (do before deploy):** add
the `NATIVE_*` env vars + a file-backed `KmsResolver` (load PEM P-256 key → sign) + call `buildNativeCas`
in `server.ts` and thread the CAs into the enroll services, TDD + reviewed. File-key custody (not KMS) is
acceptable for the single-owner VPS (mirrors the existing `CA_INTERMEDIATE_KEY_PATH` file fallback);
document the KMS upgrade as future.
- **[R2] frps control-channel CA mismatch** — must be `frp-client-CA`, not `device-CA`; crossed = silent - **[R2] frps control-channel CA mismatch** — must be `frp-client-CA`, not `device-CA`; crossed = silent
1006/handshake failure (this class of bug already cost days in M1). 1006/handshake failure (this class of bug already cost days in M1).
- **[R3] nginx dNSName→Host binding** — the load-bearing isolation control; needs positive **and** - **[R3] nginx dNSName→Host binding** — the load-bearing isolation control; needs positive **and**