Serve a name the moment it is pointed, with nobody touching the box

[ralyodio]

"no manual interventions when someone sets up a moshpit domain"

setup-origin.sh made serving a name one command. This makes it none.

The problem

One command per name, run by hand, over ssh. Forget it and the name resolves to a box that answers with the wrong certificate — or gets refused outright, because a name with no published pin is a name clients will not accept. Every name added so far (chovy.hacker, seo.rank, alt.2600) needed somebody to remember.

What this does

moshpit-reconcile.sh asks the registry which names point at this host and configures the ones that are not configured yet. Pointing a name in the dashboard becomes the only step there is; the site is up about a minute later.

==> reconciling against https://app.moshcode.sh as dev.profullstack.com
==> auto.hacker — no nginx block
  target — ok (200)
  pin — ok (201)
  auto.hacker is published and verifiable
  auto.hacker — now served
  chovy.hacker — already served
  seo.rank — already served
  alt.2600 — already served

Plus a systemd timer (60s, jittered, Persistent=true).

Decisions worth flagging

Endings are listed in config, not discovered. GET /api/moshpit/tlds returns 200 of the ~5,700 claimed — the default page size — so discovery would serve a subset while looking complete. That is the same silent-truncation shape as the systemd-resolved domain cap that has bitten this project twice. A box serving three endings can say so in one line.

A mismatched pin counts as work to do, not just a missing one. Regenerating a certificate without republishing leaves the name refused by every client while the box looks healthy — the check compares what nginx actually serves against what the registry publishes.

Idempotent and quiet. Without the "already served" check every pass would reload nginx, forever.

A briefly unreachable registry skips that ending for the pass rather than being read as "nothing is pointed here" — otherwise a network blip is indistinguishable from every name having been removed, and the difference matters if that ever drives removal.

The API key is in /etc/moshpit/reconcile.conf (0600), not the unit file. Unit files are world-readable and systemctl cat prints them.

Verified end to end, against the live registry

Not a mock. Claimed auto.hacker, pointed it at the host, and let the reconciler run:

$ dig +short auto.hacker
dev.profullstack.com.  67.205.189.229

$ curl -k --pinnedpubkey "sha256//<published pin>" https://auto.hacker/
200                     ← pin enforced, so the served key is the published one

The pass after that changed nothing. The timer has been running on the box since, firing every ~64s and reporting all four names already served.

sh -n clean.

Not covered by this

This is the origin side. A visitor still needs moshpit-proxy running locally for curl alt.2600 to work without -k, because the origin certificate is necessarily self-signed — no CA will issue for an ending outside the DNS root. That is a separate install on the visitor's machine, which install.sh already handles.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.