Run zz-ssl-ciphers when a child overlay carries the mark #7

Merged

marcos-mendez merged 1 commit from fix/layer-ssl-ciphers-overlay into 19.x

2026-09-26 22:36:20 -03:00

marcos-mendez commented

2026-09-26 22:32:16 -03:00

(Migrated from github.com)

layer_child_conf added turnkey.d/zz-ssl-ciphers to a child layer only when
one of the conf scripts the child runs mentioned ZZ_SSL_CIPHERS, which is
how the apache conf reads it. nginx keeps the mark in an overlay file instead,
overlays/nginx/etc/nginx/snippets/ssl.conf, so a layer built on an nginx
stack kept the literal string as its cipher list:

ssl_ciphers 'ZZ_SSL_CIPHERS';

and nginx refused to start:

[emerg] SSL_CTX_set_cipher_list("ZZ_SSL_CIPHERS") failed
(SSL: error:0A0000B9:SSL routines::no cipher match)
nginx: configuration file /etc/nginx/nginx.conf test failed

Measured tonight on a container assembled from the rebuilt nodebb layer: the
first boot hook that sets the forum up runs nginx -t and fails there, so the
appliance never serves. The layer built before this was only correct because
the build host was running a checkout that carried this change and had never
pushed it.

The scan moves into layer_needs_ssl_ciphers, which checks the conf scripts
as before and then the overlays the child applies. bt-layer computes
build_overlays first and passes the overlays path and that list.

Test plan:

tests/layer, two cases added: an overlay that carries the mark
(turnkey.d/hostname turnkey.d/zz-ssl-ciphers nginx) and one that does
not (turnkey.d/hostname nginx)
tests/coverage.sh: bin/layer-lib 207 of 208, bt-layer 101 of 102,
the other four measured files at 100; gate 99
rebuild of the nodebb layer with this on the build host, and the
appliance gate of keel-nodebb against the republished chain

`layer_child_conf` added `turnkey.d/zz-ssl-ciphers` to a child layer only when one of the conf scripts the child runs mentioned `ZZ_SSL_CIPHERS`, which is how the apache conf reads it. nginx keeps the mark in an overlay file instead, `overlays/nginx/etc/nginx/snippets/ssl.conf`, so a layer built on an nginx stack kept the literal string as its cipher list: ssl_ciphers 'ZZ_SSL_CIPHERS'; and nginx refused to start: [emerg] SSL_CTX_set_cipher_list("ZZ_SSL_CIPHERS") failed (SSL: error:0A0000B9:SSL routines::no cipher match) nginx: configuration file /etc/nginx/nginx.conf test failed Measured tonight on a container assembled from the rebuilt nodebb layer: the first boot hook that sets the forum up runs `nginx -t` and fails there, so the appliance never serves. The layer built before this was only correct because the build host was running a checkout that carried this change and had never pushed it. The scan moves into `layer_needs_ssl_ciphers`, which checks the conf scripts as before and then the overlays the child applies. `bt-layer` computes `build_overlays` first and passes the overlays path and that list. Test plan: - [x] `tests/layer`, two cases added: an overlay that carries the mark (`turnkey.d/hostname turnkey.d/zz-ssl-ciphers nginx`) and one that does not (`turnkey.d/hostname nginx`) - [x] `tests/coverage.sh`: bin/layer-lib 207 of 208, bt-layer 101 of 102, the other four measured files at 100; gate 99 - [ ] rebuild of the nodebb layer with this on the build host, and the appliance gate of keel-nodebb against the republished chain