Overlays without units, and manifest secrets with a file policy: gaps found by 0041 step 6 #62

New issue

Open

opened 2026-10-01 01:30:04 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-10-01 01:30:04 -03:00

(Migrated from github.com)

Found by step 6 of handbook decision 0041 (Keel-Linux/common#21, the Keel Web overlays), measured with keel 0.14.0 on the Core image of step 4 with a spec naming the web appliance and coraza: enabled, anubis: enabled.

1. Overlays without a unit are never converged. apply --system enables and starts an overlay's units; Coraza is an Nginx module and has none, so turning it on in the spec writes Monit's waf-blocks check and loads nothing (the check fails with 204). keel-overlay-coraza ships /usr/lib/keel/overlays/coraza/state enabled|disabled, which links the module, reloads, checks the probe and rolls back (corazawaf/coraza-nginx#139). keel should run /usr/lib/keel/overlays/<name>/state enabled|disabled when an overlay's state changes and the file exists, after the overlays it requires and before its dependants, and fail the step when it fails.

2. diff and inspect cannot read such an overlay ("not compared: runs no unit"). The hook could answer a status call.

3. The Anubis signing key does not follow the spec's secret. secrets.anubis_signing_key: {generate: true} makes a short token for the first boot conf (KEEL_SECRET_ANUBIS_SIGNING_KEY), not a 32-byte ed25519 seed, and no file Anubis reads. The overlay now makes its key at the first start of anubis@keel.service into /etc/anubis/keel.key, links a {file: PATH} the spec names instead, and refuses to make one on a database replica or where /etc/anubis/keel.key.from-primary exists. keel should:

have the emitter write anubis_signing_key: {file: /etc/anubis/keel.key} for a generated key;
on a node that receives the shared secrets of its primary (0028, the manifest's shared: true), put the primary's key in place before enabling the overlay, and write the from-primary marker until it has, since the spec has no role for a web node.

4. Monit re-encodes the waf-blocks path (%3C sent as %253C). The Core Rule Set still blocks it (403, measured), but the renderer may want to say so or pass the path decoded.

Found by step 6 of handbook decision 0041 (Keel-Linux/common#21, the Keel Web overlays), measured with keel 0.14.0 on the Core image of step 4 with a spec naming the `web` appliance and `coraza: enabled`, `anubis: enabled`. **1. Overlays without a unit are never converged.** `apply --system` enables and starts an overlay's units; Coraza is an Nginx module and has none, so turning it on in the spec writes Monit's `waf-blocks` check and loads nothing (the check fails with 204). keel-overlay-coraza ships `/usr/lib/keel/overlays/coraza/state enabled|disabled`, which links the module, reloads, checks the probe and rolls back (corazawaf/coraza-nginx#139). keel should run `/usr/lib/keel/overlays/<name>/state enabled|disabled` when an overlay's state changes and the file exists, after the overlays it `requires` and before its dependants, and fail the step when it fails. **2. `diff` and `inspect` cannot read such an overlay** ("not compared: runs no unit"). The hook could answer a `status` call. **3. The Anubis signing key does not follow the spec's secret.** `secrets.anubis_signing_key: {generate: true}` makes a short token for the first boot conf (`KEEL_SECRET_ANUBIS_SIGNING_KEY`), not a 32-byte ed25519 seed, and no file Anubis reads. The overlay now makes its key at the first start of `anubis@keel.service` into `/etc/anubis/keel.key`, links a `{file: PATH}` the spec names instead, and refuses to make one on a database replica or where `/etc/anubis/keel.key.from-primary` exists. keel should: - have the emitter write `anubis_signing_key: {file: /etc/anubis/keel.key}` for a generated key; - on a node that receives the shared secrets of its primary (0028, the manifest's `shared: true`), put the primary's key in place before enabling the overlay, and write the `from-primary` marker until it has, since the spec has no role for a web node. **4. Monit re-encodes the waf-blocks path** (`%3C` sent as `%253C`). The Core Rule Set still blocks it (403, measured), but the renderer may want to say so or pass the path decoded.