code wiki / (root) / nx_cert_autorenew.nx

nx_cert_autorenew.nx

buildroot/runtime/nx_cert_autorenew.nx

24222 B360 linesdepth 19pulls 118 transitivereach 0 importersview sourcekind tooltopic cert
docsdependenciesstructsconstsfunctions

about

nx_cert_autorenew.nx -- SOVEREIGN AUTO-RENEWAL for the per-domain wildcard TLS certs. Closes the gap that started this whole arc: a per-domain wildcard cert SILENTLY lapsed because nothing renewed it. This organ MONITORS the live SNI certs and RENEWS any inside the 21d warn window -- unattended. COMPOSES ONLY PROVEN PIECES (rule 15 DRY; no new high-stakes mechanism): nx_cert_autorenew_lib -- domain->path mapping + WARN/EXPIRED trigger (gate-proven) nx_cert_monitor -- CM_* verdict vocabulary + cm_status (local re-parse) + cm_name nx_tls13_client_session_run + nx_trust_store_load_from_certdata -- the SAME live TLS-1.3-with-SNI probe nx_torrent_live_probe uses (validates the SERVED cert against the Mozilla CA store at a chosen epoch) _offc/nx_secret_cli.elf get porkbun -- Porkbun creds from the vault -> /tmp/nxsecret.out _offc/nx_sov_build_run.elf + /tmp/nx_acme_dns01_issue.sov.elf <domain> -- LE-1.3 DNS-01 wildcard issuance _offc/nx_aw_send.elf <local> <remote> -- vault-keyed SSH push to the NAS (proven) _offc/nx_aw_hostctl.elf deploy -- atomic sites.elf swap + respawn = cert RELOAD (proven) MONITOR (live, location-independent): for each configured domain, drive a TLS handshake to the web host presenting that SNI and validate the SERVED leaf at now AND at now+21d. valid-at-now + invalid-at-now+21d = inside the warn window (CM_WARN); invalid-at-now = CM_EXPIRED; unreachable = CM_NOCERT (no false trigger). This is best-in-class external SSL-expiry monitoring -- it watches what clients actually receive, from anywhere, so it does not depend on the conductor sharing a filesystem with the NAS. RENEW (fail-safe BY CONSTRUCTION -- rule 12/13/14): issue to /tmp -> RE-PARSE the fresh cert locally (never push a bad cert) -> push the per-domain fullchain+key to the live le_<label>_* paths -> stage the durable current-good binary as sites.elf.new -> deploy (respawn=reload) -> VERIFY the served leaf advanced past the warn window. Any step fails -> ABORT + structured log, leaving a working state: we renew EARLY (21d slack) and the new cert is LE-validated, so the worst partial outcome still serves a valid cert. SCHEDULE: the conductor (nx_team_pulse tp_tail_d) calls this EVERY beat; a daily-check guard runs the real sweep at most once/CHECK_INTERVAL, and a per-domain cooldown caps issuance at one/domain/COOLDOWN -- so the per-beat call is cheap + idempotent + LE-budget-safe (rule 10/21). license_tier: ORIGINAL

dependencies 8 imports · 0 importers

nx_cert_autorenew_lib.nx nx_connect.nx nx_syscalls.nx nx_x509_trust_store.nx nx_trust_store_load_from_certdata. nx_tls13_client_validate_certifica nx_tls13_client_session_run.nx nx_csprng.nx nx_cert_autorenew.nx

imports: nx_cert_autorenew_lib.nxnx_connect.nxnx_syscalls.nxnx_x509_trust_store.nxnx_trust_store_load_from_certdata.nxnx_tls13_client_validate_certificate.nxnx_tls13_client_session_run.nxnx_csprng.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main car_p sys_write sys_now_realtime_sec sys_mmap sys_clock_gettime_real nx_trust_store_load_from_c sys_mmap ↻ sys_read_file sys_openat_rd sys_lseek sys_mmap ↻ sys_read sys_close nx_nss_certdata_parse sys_mmap ↻ _pat_class_cert _pat_value_octal _pat_end _find_newline _starts_with _parse_octal_line sys_mmap ↻ _is_space _decode_octal_escape _is_octal trust_store_alloc sys_mmap ↻ nx_x509_trust_store_load sys_mmap ↻ x509_parse sys_mmap ↻ asn1_cursor_init asn1_expect_tag sys_mmap ↻ asn1_read_tlv_header asn1_read_tag asn1_read_length asn1_read_length ↻ x509_read_tlv

structs

none

consts

39const CAR_MAGIC_86400: i64 = 86400
40const CAR_MAGIC_4000: i64 = 4000
41const CAR_MAGIC_8192: i64 = 8192
42const CAR_MAGIC_4194304: i64 = 4194304
45const CAR_TRUST_STORE: *u8 = "/mnt/c/Users/elder/nishi-core/nxc2/data/mozilla_certdata.txt\x00" as *u8
46const CAR_NAS_IP: i64 = (192 << 24) | (168 << 16) | (8 << 8) | 240 // the web TLS host (nx_torrent_live_probe)
47const CAR_TLS_PORT: i64 = 8443
48const CAR_VERIFY_FUTURE_DAYS: i64 = 30 // > 21d warn window, << chain validity (~years): proves notAfter advanced
49const CAR_CHECK_INTERVAL: i64 = 86400 // run the real sweep at most once/day (daily cadence over per-beat calls)
50const CAR_COOLDOWN: i64 = 86400 // at most one LE issuance / domain / day (LE-budget guard)
51const CAR_DOMAINS_CONF: *u8 = "knowledge/hosting/cert_domains.conf\x00" as *u8
52const CAR_CHECK_STAMP: *u8 = "knowledge/status/cert_autorenew_lastcheck\x00" as *u8
53const CAR_RENEW_LOG: *u8 = "knowledge/status/cert_renew.log\x00" as *u8
54const CAR_STAMP_DIR: *u8 = "knowledge/status/cert_renew_\x00" as *u8
57const CAR_SITES_BINARY: *u8 = "_offc/sites_live.elf\x00" as *u8
58const CAR_SITES_NEW: *u8 = "/volume1/homes/elderwesto/nishihost/sites.elf.new\x00" as *u8
63const CAR_ARM_FILE: *u8 = "knowledge/hosting/cert_autorenew.enabled\x00" as *u8

functions

66func car_p(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
called by 3: car_sweep_onecar_sweepmain calls 1: sys_write
67func car_pn(v: i64) -> i64
called by 1: main calls 2: sys_mmapsys_write
73func car_log(s: *u8) -> i64
called by 2: car_renew_domaincar_sweep_one calls 3: sys_writesys_openat_appendsys_close
82func car_run(path: *u8, argv: *i64) -> i64
called by 1: car_renew_domain calls 5: sys_forksys_mmapsys_execvesys_exitsys_wait4
96func car_epoch_read(path: *u8) -> i64
called by 2: car_cooldown_okmain calls 4: sys_openat_rdsys_mmapsys_readsys_close
103func car_epoch_write(path: *u8, epoch: i64) -> i64
called by 2: car_renew_domainmain calls 4: sys_openat_wrsys_mmapsys_writesys_close
109func car_stamp_path(label: *u8, out: *u8) -> i64
called by 2: car_cooldown_okcar_renew_domain calls 1: car_put
114func car_cooldown_ok(label: *u8, now: i64) -> i64
called by 1: car_sweep_one calls 3: sys_mmapcar_stamp_pathcar_epoch_read
123func car_handshake_ok(domain: *u8, dlen: i64, store: *TrustStore, now_epoch: i64) -> i64
called by 2: car_live_verdictcar_renew_domain calls 7: sys_socketsys_set_socket_timeoutsys_mmapnx_connect_boundedsys_closenx_csprng_fill+1
149func car_live_verdict(domain: *u8, dlen: i64, store: *TrustStore, now: i64) -> i64
called by 1: car_sweep_one calls 1: car_handshake_ok
160func car_binary_ok() -> i64
called by 1: car_renew_domain calls 2: sys_openat_rdsys_close
165func car_armed() -> i64
called by 1: car_sweep_one calls 2: sys_openat_rdsys_close
171func car_renew_domain(domain: *u8, store: *TrustStore) -> i64
called by 2: car_sweep_onemain calls 17: car_slencar_logsys_mmapcar_runcar_issue_dercm_status+11
255func car_sweep_one(domain: *u8, store: *TrustStore, now: i64) -> i64
called by 2: car_sweep_linecar_sweep calls 11: car_slencar_live_verdictcar_pcm_namecar_should_renewcar_armed+5
272func car_sweep_line(buf: *u8, start: i64, end: i64, store: *TrustStore, now: i64) -> i64
called by 1: car_sweep calls 2: sys_mmapcar_sweep_one
287func car_read_file(path: *u8, buf: *u8, cap: i64) -> i64
called by 1: car_sweep calls 3: sys_openat_rdsys_readsys_close
296func car_sweep(store: *TrustStore, now: i64) -> i64
called by 1: main calls 5: sys_mmapcar_read_filecar_pcar_sweep_onecar_sweep_line
316func main(argc: i64, argv: *i64) -> i64
calls 9: car_psys_now_realtime_secnx_trust_store_load_from_certdatasys_exitcar_renew_domaincar_pn+3