From b420f77410420f590f9716ae9e5aaa8ada085184 Mon Sep 17 00:00:00 2001 From: Spencer McGuire Date: Sun, 18 Oct 2026 21:12:15 -0600 Subject: [PATCH] DEPLOY: vsql serves a weak self-signed certificate; what IT needs for VISUAL_ENCRYPT=yes Co-Authored-By: Claude Fable 5.1 --- docs/DEPLOY.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md index e383823..aa51908 100644 --- a/docs/DEPLOY.md +++ b/docs/DEPLOY.md @@ -176,6 +176,10 @@ The test stack on docker-1 lives under /home/spencerm/packetstation/test (stack. Docker's default address pool on docker-1 holds fifteen /16 bridge networks (172.17.0.0 to 172.31.0.0). Each compose stack takes one or two (Packet Station takes two: backend and egress), the Gitea runner takes one per job, and the CI e2e stack needs two more. With the test stack up the pool ran out and every e2e job failed within seconds with "all predefined address pools have been fully subnetted". Idle networks of stopped stacks were removed to make room. The lasting fix is a larger pool in /etc/docker/daemon.json, for example `{"default-address-pools":[{"base":"10.200.0.0/16","size":24}]}`, which needs sudo and a Docker restart (a short outage for every stack on the host), or trimming unused compose projects. When the production stack joins, count the networks first: `docker network ls --filter driver=bridge | wc -l`. +## Known issue: vsql serves a weak self-signed certificate (found 2026-10-18) + +`vsql.pesco.com\DEV` serves TLS (`VISUAL_ENCRYPT=trust` connects), but with `VISUAL_ENCRYPT=yes` OpenSSL in the image refuses it with "EE certificate key too weak": the server certificate's RSA key is under 2048 bits, which is what SQL Server's auto-generated self-signed certificate looks like. IT needs to issue vsql a 2048-bit, SHA-256 certificate from PESCO-PSYLOCKE-CA with `vsql.pesco.com` in the subject alternative names, install it on the DEV and production instances in SQL Server Configuration Manager and restart them. The image then needs the PESCO CA in its OpenSSL trust store for the ODBC driver (the entrypoint can concatenate the system bundle and /etc/ssl/pesco/ca.pem into /tmp and export `SSL_CERT_FILE`), and the stacks switch to `VISUAL_ENCRYPT=yes`. Tracked as Gitea issue 5. + ## Doctor `packetstation doctor` proves a host and a stack are ready. Run it with `compose run`, not `compose exec`: the entrypoint exports MFILES_PASSWORD from its secret file, and `exec` skips the entrypoint, so the M-Files password check fails under `exec` even though the running worker has it.