fix: apache2ctl configtest at first boot, not in the build #15

Open

marcos-mendez wants to merge 2 commits from fix/configtest-at-first-boot into master

marcos-mendez commented

2026-09-30 08:10:46 -03:00

(Migrated from github.com)

On common 19.x conf.d/main failed at apache2ctl configtest: wordpress.conf (443 vhost) and mods-available/ssl.conf name /etc/ssl/private/cert.pem, which common's removelists-final now takes out of every layer (keel-core#8). The parent layer arrives without it, so the check could only fail.

firstboot.d/40wordpress runs apache2ctl configtest after 15regen-sslcert and before restarting Apache. A failure is fatal to 40wordpress, which then does not restart Apache; inithooks logs it and runs the next hook. Same place keel-nodebb runs nginx -t (its 40nodebb hook); keel-lamp runs configtest in its boot test.
conf.d/main drops the build time configtest and asserts it left no cert.pem or cert.key.
Boot test: bt_shared_keys_verdict reads the assembled rootfs before the first boot and fails on any certificate or private key from common's removelist (TLS pair, snakeoil, miniserv.pem, turnkey-ssl copies, SSH host keys), dangling symlinks included; bt_configtest_verdict reads the inithooks log for the passing configtest line.
Changelog 19.0 (6); COVERAGE.md updated (238 bats tests, 99.16 percent, lowest file 97.83, gate stays 97).

Required check expected to fail: appliance / boot-published-layer is required by branch protection, and it boots the layer the mirror publishes, not this branch. That layer carries 8 private keys (cert.pem, cert.key, miniserv.pem, the turnkey-ssl pair, 3 SSH host keys) plus 3 SSH host .pub files, which the new verdict names. It clears only once a layer built from this fix is published, which is an attended release by the maintainer.

Test plan

bats tests/ all pass, COVERAGE_THRESHOLD=97 tests/coverage.sh passes
layer builds on common 19.x
boot test on the rebuilt layer: no key in the assembled image, configtest passing in the inithooks log

On common 19.x `conf.d/main` failed at `apache2ctl configtest`: `wordpress.conf` (443 vhost) and `mods-available/ssl.conf` name `/etc/ssl/private/cert.pem`, which common's `removelists-final` now takes out of every layer (keel-core#8). The parent layer arrives without it, so the check could only fail. - `firstboot.d/40wordpress` runs `apache2ctl configtest` after 15regen-sslcert and before restarting Apache. A failure is fatal to 40wordpress, which then does not restart Apache; inithooks logs it and runs the next hook. Same place keel-nodebb runs `nginx -t` (its 40nodebb hook); keel-lamp runs configtest in its boot test. - `conf.d/main` drops the build time configtest and asserts it left no `cert.pem` or `cert.key`. - Boot test: `bt_shared_keys_verdict` reads the assembled rootfs before the first boot and fails on any certificate or private key from common's removelist (TLS pair, snakeoil, miniserv.pem, turnkey-ssl copies, SSH host keys), dangling symlinks included; `bt_configtest_verdict` reads the inithooks log for the passing configtest line. - Changelog 19.0 (6); COVERAGE.md updated (238 bats tests, 99.16 percent, lowest file 97.83, gate stays 97). **Required check expected to fail:** `appliance / boot-published-layer` is required by branch protection, and it boots the layer the mirror publishes, not this branch. That layer carries 8 private keys (`cert.pem`, `cert.key`, `miniserv.pem`, the turnkey-ssl pair, 3 SSH host keys) plus 3 SSH host `.pub` files, which the new verdict names. It clears only once a layer built from this fix is published, which is an attended release by the maintainer. Test plan - [x] `bats tests/` all pass, `COVERAGE_THRESHOLD=97 tests/coverage.sh` passes - [ ] layer builds on common 19.x - [ ] boot test on the rebuilt layer: no key in the assembled image, configtest passing in the inithooks log

Some required checks are missing.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions