feat(dashmate)!: check the gateway certificate on update

packages/dashmate/configs/getConfigFileMigrationsFactory.js

@@ -16,6 +16,19 @@ import { stockImagePattern, historicalStockImagePattern } from '../src/config/st
  * @param {DefaultConfigs} defaultConfigs
  * @returns {getConfigFileMigrations}
  */
+/**
+ * Migrations that move, copy or delete files, as opposed to reshaping data.
+ *
+ * Almost every migration only rewrites the configuration object, which can be
+ * applied in memory and discarded. These two relocate TLS material and remove
+ * the originals, so a caller that has promised to change nothing cannot run
+ * them and has to decline instead.
+ *
+ * A migration added here must be added to this set, and a test fails if one
+ * touches the filesystem without being declared.
+ */
+export const FILESYSTEM_MUTATING_MIGRATIONS = ['0.25.7', '1.0.0-dev.12'];
+
 export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs) {
   /**
    * @typedef {function} getConfigFileMigrations
@@ -62,6 +75,27 @@ export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs)
       }
     }
 
+    /**
+     * Drop the Tenderdash Commit timeout overrides Tenderdash itself removed.
+     *
+     * The config schema stopped defining them, and it accepts no property it
+     * does not define, so a config that still carries them cannot be loaded at
+     * all.
+     *
+     * Called from more than one migration on purpose. A config records the
+     * version of the build that wrote it, and a development build records its
+     * own prerelease version - which semver orders above a key named after an
+     * earlier patch release. A config stamped that way skips such a key
+     * entirely, so a deletion the schema depends on has to be repeated at a key
+     * above every stamp still in the field. Repeating it costs nothing: removing
+     * a key that is not there does nothing.
+     *
+     * @param {Object} options - one config's options
+     */
+    function dropRemovedTenderdashCommitOverride(options) {
+      delete options.platform?.drive?.tenderdash?.consensus?.unsafeOverride?.commit;
+    }
+
     function getDefaultConfigByNetwork(network) {
       if (network === NETWORK_MAINNET) {
         return defaultConfigs.get('mainnet');
@@ -1702,11 +1736,12 @@ export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs)
         return configFile;
       },
       '4.2.0': (configFile) => {
-        // The ACME directory certificates are requested from became
-        // configurable. Existing configs have no value for it, and the schema
-        // requires one, so fill in the directory they were already using.
         Object.entries(configFile.configs)
           .forEach(([, options]) => {
+            // Also done by the 4.1.1 migration, which a config written by a
+            // development build of this release is stamped above and skips.
+            dropRemovedTenderdashCommitOverride(options);
+
             const providerConfigs = options.platform?.gateway?.ssl?.providerConfigs;
 
             if (providerConfigs?.letsencrypt
@@ -1756,11 +1791,7 @@ export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs)
               rsDapiDocker.image = base.get('platform.dapi.rsDapi.docker.image');
             }
 
-            // The Commit timeout and BypassCommitTimeout overrides no longer
-            // exist in Tenderdash, which now only warns when they are set.
-            // Drop them: the config schema accepts no properties it does not
-            // define, so a config that kept them would fail validation.
-            delete options.platform?.drive?.tenderdash?.consensus?.unsafeOverride?.commit;
+            dropRemovedTenderdashCommitOverride(options);
           });
 
         return configFile;

packages/dashmate/src/commands/ssl/obtain.js

@@ -2,6 +2,8 @@ import { Listr } from 'listr2';
 import { Flags } from '@oclif/core';
 import ServiceIsNotRunningError from '../../docker/errors/ServiceIsNotRunningError.js';
 import ConfigBaseCommand from '../../oclif/command/ConfigBaseCommand.js';
+import { PORT_80_PERMANENCE } from '../../listr/tasks/ssl/letsencrypt/obtainLetsEncryptCertificateTaskFactory.js';
+import isInteractiveSession from '../../util/isInteractiveSession.js';
 import MuteOneLineError from '../../oclif/errors/MuteOneLineError.js';
 import Certificate from '../../ssl/zerossl/Certificate.js';
 import LegoCertificate from '../../ssl/letsencrypt/LegoCertificate.js';
@@ -46,20 +48,22 @@ Certificate will be renewed if it is about to expire (see 'expiration-days' flag
    */
   async runWithDependencies(
     args,
-    {
-      verbose: isVerbose,
-      'no-retry': noRetry,
-      'expiration-days': expirationDaysFlag,
-      force,
-      provider: providerFlag,
-    },
+    flags,
     config,
     obtainZeroSSLCertificateTask,
     obtainLetsEncryptCertificateTask,
     configFileRepository,
     configFile,
     dockerCompose,
   ) {
+    const {
+      verbose: isVerbose,
+      'no-retry': noRetry,
+      'expiration-days': expirationDaysFlag,
+      force,
+      provider: providerFlag,
+    } = flags;
+
     const provider = providerFlag || config.get('platform.gateway.ssl.provider');
 
     let task;
@@ -109,6 +113,15 @@ Certificate will be renewed if it is about to expire (see 'expiration-days' flag
           // been obtained by then, so failing there would report the whole
           // command as failed and send the operator back to a provider that may
           // have nothing left to issue.
+          //
+          // A signal is sufficient and nothing here needs to restart the
+          // container. PID 1 in the gateway container is Envoy's hot-restarter,
+          // not Envoy: its SIGHUP handler forks and re-execs Envoy with an
+          // incremented restart epoch against the same envoy.yaml. The new
+          // process parses that file from scratch and opens the certificate by
+          // name, so both a renewed certificate and a changed listener
+          // structure take effect while the old process drains. A container
+          // restart would achieve the same thing and cost an outage.
           title: 'Reload gateway',
           task: async (ctx, listrTask) => {
             try {
@@ -135,14 +148,33 @@ Certificate will be renewed if it is about to expire (see 'expiration-days' flag
       },
     );
 
+    const context = {
+      noRetry,
+      force,
+      expirationDays,
+      // Whether the obtain may ask a question is decided here rather than
+      // inside the shared task, so a caller that never opts in - the helper's
+      // unattended renewal - cannot enable prompting by omission.
+      interactive: isInteractiveSession({ flags }),
+    };
+
     try {
-      await tasks.run({
-        noRetry,
-        force,
-        expirationDays,
-      });
+      await tasks.run(context);
     } catch (e) {
       throw new MuteOneLineError(e);
+    } finally {
+      // Only when the gateway's certificate actually changed. This is the
+      // command the certificate check tells an operator to run, and an
+      // operator who opened port 80 for this one migration is the one who most
+      // needs to hear that it has to stay open - they never saw a failure that
+      // would have said so.
+      //
+      // Printed even when a later step fails: a certificate that was issued
+      // and then failed to install still counts against this node's limits,
+      // and the operator is about to close the port either way.
+      if (context.certificateObtained && provider === SSL_PROVIDERS.LETSENCRYPT) {
+        process.stderr.write(`\n${PORT_80_PERMANENCE}\n`);
+      }
     }
   }
 }