spencermandClaude Opus 5.5
90adcebc44
- Admin check uses -not (IsAdmin); the old call passed -eq $false as arguments. - Named instances: WQL filter Name='MSSQL$DEV' unescaped, lookup errors surface. - SANs decoded from the raw extension (DER walk) and matched as whole names. - Immutable deploy-, request- and rollback- records; already-bound instances get no snapshot; -Rollback takes the newest snapshot not yet rolled back, -Snapshot picks one. - certreq -new, -submit, -accept and the key grants go through ShouldProcess; a declined or failed prerequisite binds nothing. - Rollback and automatic restore work per instance, read back, report failures. Also found while testing: PowerShell 7 returns RSACng for a CSP key, so the provider check now reads CERT_KEY_PROV_INFO; ForEach-Object member form returned nothing under -WhatIf; stderr capture under Stop threw on 5.1; LocalSystem and NetworkService accounts go to icacls as SIDs; SQL Agent is started again after a restart; signature checked by OID. DEPLOY.md gains the run procedure: preflight, DEV, docker-1 checks, production, rollback. Co-Authored-By: Claude Opus 5.5 <[email protected]>
scripts
Backup and restore scripts arrive in phase 9: a per-stack pg_dump backup with a
systemd timer on docker-1, and a restore script with a rehearsal recorded in docs/DEPLOY.md.
Export-PescoCaBundle.ps1
Run on a domain-joined PC. Exports every unexpired PESCO CA certificate from the Windows stores to one PEM bundle and copies it to docker-1 with scp (default target ~/packetstation/test/ca/pesco-ca.pem). Use -Remote for another path and -NoCopy to only write the file. It warns on SHA-1 signed certificates; see docs/DEPLOY.md.
Request-VsqlServerCertificate.ps1
Run elevated on the SQL Server host behind vsql, in Windows PowerShell 5.1 or PowerShell 7. Requests a TLS certificate from PESCO-PSYLOCKE-CA with certreq the way SQL Server requires it (legacy Microsoft RSA SChannel Cryptographic Provider, KeySpec AT_KEYEXCHANGE, RSA 2048, SHA-256, Server Authentication, key usage 0xA0, SANs vsql.pesco.com, vsql and the host FQDN and short name). It installs it and validates it before anything is bound. The validation checks the key provider and KeySpec from the certificate's own key property, the key size, the signature, the dates, the EKU, and the SAN DNS names as whole names. It grants only the selected instances' service accounts read on the private key, then binds the thumbprint and reads it back.
-WhatIfpreviews every step and changes nothing.-Confirmasks before each change. Declining enrollment or a key grant cancels the run with nothing bound (exit code 2).-CerFilecontinues a request that was pending.-Thumbprintbinds a certificate already installed.-Instanceslimits the run (DEV,MSSQLSERVER).-RestartInstancesrestarts them and starts SQL Server Agent again if it ran.- Each deployment writes a new
deploy-<time>.jsoninC:\ProgramData\PacketStation\vsql-certwith the values it replaced. Instances already bound to the thumbprint are left alone and get no snapshot, so a rerun never hides the useful one. A pending request writesrequest-<time>.jsonwith its request id. -Rollbackrestores the newest snapshot not yet rolled back, each instance on its own, verified by reading back, and records it inrollback-<time>.json.-Snapshotpicks another. Failures are listed and the run exits with an error.
Tests: scripts/tests/Request-VsqlServerCertificate.Tests.ps1 (Pester 5) fakes the host (instances, services, registry, machine store, certreq, icacls) and uses real throwaway certificates in Cert:\CurrentUser\My. Run it on both PowerShell versions:
Install-Module Pester -RequiredVersion 5.7.1 -Scope CurrentUser -SkipPublisherCheck
Invoke-Pester -Path scripts ests -Output Detailed
The run procedure is in docs/DEPLOY.md, under the vsql known issue. Gitea issue 5 tracks the switch to VISUAL_ENCRYPT=yes.