feat(dashmate)!: check the gateway certificate on update - #4440

Merged

shumkov merged 65 commits into

Aug 24, 2026

Commits on Jun 4, 2026

chore: update gRPC queries cache [skip ci]
github-actions[bot]
committed
a00c5ac

Commits on Jul 27, 2026

Merge remote-tracking branch 'origin/v4.1-dev'
shumkov
committed
37ea011

Commits on Aug 20, 2026

Merge remote-tracking branch 'origin/v4.2-dev' into ssl
shumkov
committed
cc03079

Commits on Aug 21, 2026

feat(dashmate): detect whether a session can answer a prompt

shumkov
and
claude
committed
29276af
feat(dashmate): judge the certificate installed for the gateway

shumkov
and
claude
committed
4a525bd
feat(dashmate): stop asking for an email, retry port 80, never prompt unattended

shumkov
and
claude
committed
9b2b710
feat(dashmate): check the gateway certificate on update

shumkov
and
claude
committed
e2ee5a4
fix(dashmate): report certificate problems doctor could not see

shumkov
and
claude
committed
51d0d18
test(dashmate): prove contactless issuance against a real ACME server

shumkov
and
claude
committed
e92c4fd
fix(dashmate): honour the JSON contract and stop the preflight claiming a pull

shumkov
and
claude
committed
73bbc40
refactor(dashmate): one rule for reading a boolean environment variable

shumkov
and
claude
committed
d6ec6af
fix(dashmate): stop warning about ZeroSSL after switching away from it

shumkov
and
claude
committed
01fcd60
style(dashmate): drop lint noise this change introduced

shumkov
and
claude
committed
2d06357
fix(dashmate): five defects found by cross-model review

shumkov
and
claude
committed
1a07767
fix(dashmate): honest operator messaging and a private doctor archive

shumkov
and
claude
committed
77d81d6
test(dashmate): pin the interactivity guards distinctly from the prompt refusal

shumkov
and
claude
committed
ce0095c
fix(dashmate): make the preflight decline rather than migrate unlocked

shumkov
and
claude
committed
b4861d3
fix(dashmate): reserve the migration error for a version that is actually behind

shumkov
and
claude
committed
09f9709
fix(dashmate): mask the operator's name even when the environment omits it

shumkov
and
claude
committed
6dfc75a
fix(dashmate): let the preflight judge a config it would have to migrate

shumkov
and
claude
committed
3c6bad7
fix(dashmate): tell a port conflict apart from a firewall, and say port 80 is permanent

shumkov
and
claude
committed
4ab84e4
fix(dashmate): stop offering a switch to the provider the node already uses

shumkov
and
claude
committed
ce2b710
fix(dashmate): stop doctor advising a restart that would take a node dark

shumkov
and
claude
committed
7ec0724
fix(dashmate): stop redaction blanking dashmate out of its own messages

shumkov
and
claude
committed
51508ec
fix(dashmate): judge and migrate the configuration from one snapshot

shumkov
and
claude
committed
3dbadce
fix(dashmate): state the port 80 argument once, and test what is rendered

shumkov
and
claude
committed
9a080b4
fix(dashmate): separate what the authority said from what it was never asked

shumkov
and
claude
committed
657529d
fix(dashmate): compare the two certificates on the expired branch too

shumkov
and
claude
committed
2c37c63
fix(dashmate): rewrite the home path only where it ends

shumkov
and
claude
committed
86eb80c
fix(dashmate): stop retrying an issuance that already succeeded

shumkov
and
claude
committed
ac759a0
fix(dashmate): advise a restart only when the disk copy can actually be served

shumkov
and
claude
committed
50fb902
fix(dashmate): require proof the disk pair is sound before advising a restart

shumkov
and
claude
committed
c920176
test(dashmate): pin that the verdict and the wire sample describe one file

shumkov
and
claude
committed
8d1edec
fix(dashmate): say what failed the check, and stop tests inheriting ambient state

shumkov
and
claude
committed
1371288
fix(dashmate): drop the removed Commit override for prerelease configs
shumkov
committed
0623347
fix(dashmate): stop prescribing a fix that cannot work for a hijacked port

shumkov
and
claude
committed
7d83d1d
fix(dashmate): require the key's certificate to be the bundle's first block

shumkov
and
claude
committed
2b33981
fix(dashmate): match the node address against the SAN only

shumkov
and
claude
committed
3aceeeb
fix(dashmate): reject a certificate whose validity has not started

shumkov
and
claude
committed
7e01230
fix(dashmate): stop telling operators to restart after obtaining a certificate

shumkov
and
claude
committed
5d5b444
style(dashmate): flatten the identity branch and unshadow its detail

shumkov
and
claude
committed
f4cb3dc
fix(dashmate): stop claiming a failed attempt changed nothing

shumkov
and
claude
committed
8d29701
style(dashmate): name the migration specs' local version binding in camelCase

shumkov
and
claude
committed
5140e70
fix(dashmate): offer the ZeroSSL switch when the certificate is nearly out

shumkov
and
claude
committed
adf6fb0
fix(dashmate): reject a bundle whose certificate blocks are truncated

shumkov
and
claude
committed
e9f517c
fix(dashmate): stop the switch offer asserting things the verdict does not say

shumkov
and
claude
committed
f85256c
docs(dashmate): drop dev-time narration from the certificate test comments

shumkov
and
claude
committed
2a9df46
fix(dashmate): treat a PEM delimiter as a line, not as a substring

shumkov
and
claude
committed
7e80c1f
fix(dashmate): say only what the verdict established in the switch offer

shumkov
and
claude
committed
e3a270b
docs(dashmate): state what the certificate comments protect, not how it went

shumkov
and
claude
committed
e941198
fix(dashmate): accept delimiter lines padded with trailing whitespace

shumkov
and
claude
committed
7805de2
fix(dashmate): stop advising a restart that reloads the stale certificate

shumkov
and
claude
committed
17cb102

Commits on Aug 22, 2026

refactor(dashmate): tell an operator what to do, and check the certificate one way

shumkov
and
claude
committed
078e070
refactor(dashmate): cut the certificate messages down to what to do

shumkov
and
claude
committed
7272f5c
refactor(dashmate): stop reporting a missing contact address as a problem

shumkov
and
claude
committed
a564f0e
feat(dashmate): warn that a certificate will become required to start a node

shumkov
and
claude
committed
52efd33

Commits on Aug 23, 2026

fix(dashmate): print the repair command that actually repairs

shumkov
and
claude
committed
3aa7cdd
fix(dashmate): judge a certificate the same way wherever it is judged

shumkov
and
claude
committed
50b1dd0

Commits on Aug 24, 2026

refactor(dashmate): tell an operator what is wrong, not which check noticed

shumkov
and
claude
committed
4346d05
fix(dashmate): prescribe one repair command per certificate

shumkov
and
claude
committed
5cec821
fix(dashmate): do not pass a node whose address was never checked

shumkov
and
claude
committed
45d2442
fix(dashmate): set the address before prescribing a certificate

shumkov
and
claude
committed
9596d9d
fix(dashmate): ask for the address before reading the certificate

shumkov
and
claude
committed
b3ed62c
fix(dashmate): prescribe repairs that can actually run

shumkov
and
claude
committed
1736a37
fix(dashmate): do not blame the authority when the dates are what failed

shumkov
and
claude
committed
9e829ae