Three-zone PKI (Web TLS / Client Communication / Secure Boot) + install-time customization preservation - #1015

Open

darksidemilk wants to merge 61 commits into

working-1.6from

pki-three-zone-phase1

Commits on Aug 7, 2026

Preserve vhost/TFTP customizations on update, add --branch, fix sticky channel

darksidemilk
and
claude
committed
d3a1dc8
Fix EXTERNAL_CA_AND_LETSENCRYPT.md: iPXE trust is not FOG's CA alone

darksidemilk
and
claude
committed
49091c9
Clarify FOG's SSL CA and Secure Boot signing key are now separate

darksidemilk
and
claude
committed
a2b1f19
Add design doc: --hostname/--extra-server-name flags + setupacme.sh

darksidemilk
and
claude
committed
602ac99
Add implementation plan for --hostname/--extra-server-name/setupacme.sh

darksidemilk
and
claude
committed
3984766
Add --hostname flag for non-interactive vhost/cert hostname override
darksidemilk
committed
b382402
Fix: --hostname validation errors now exit nonzero instead of usage()'s exit 0
darksidemilk
committed
ab02a75
Add repeatable --extra-server-name flag for additive vhost/cert names

darksidemilk
and
claude
committed
accb793
Fix: --extra-server-name in updatefog.sh also exits nonzero instead of usage()'s exit 0

darksidemilk
and
claude
committed
825157d
Mirror FOG_EXTRA_SERVER_NAMES into globalSettings for GUI visibility
darksidemilk
committed
6b6bdfe
Add bin/setupacme.sh for ACME leaf renewal against --external-ca
darksidemilk
committed
3a0d336
Fix: remove exitFail=1 (was masking install failures as success), add non-systemd reload fallback
darksidemilk
committed
bd120cd
Fix: source config.sh + doOSSpecificIncludes so systemctl/initdpath are actually populated
darksidemilk
committed
ca02e0b
Document bin/setupacme.sh in EXTERNAL_CA_AND_LETSENCRYPT.md
darksidemilk
committed
deae3d4
Fix final review findings: ACME leaf overwrite protection, setupacme.sh exec bit, external-CA detection, updatefog.sh vhost flag, ACME domain defaulting, cert chain, install failure detection

darksidemilk
and
claude
committed
ce88f75
Don't preserve ACME leaf across --recreate-keys/--recreate-ca

darksidemilk
and
claude
committed
c8a29e5
Merge branch 'working-1.6' into 1013-ipxe-crosscert-doc-fix
darksidemilk
authored
15ae546
Record verified Let's Encrypt + iPXE netboot result, correct FOG_WEB_HOST claim

darksidemilk
and
claude
committed
5d84f5e
Add design docs: customization preservation and three-zone PKI separation

darksidemilk
and
claude
committed
e9c5a0b
Move iPXE background backup/restore into installfog.sh, keyed to FOG_IPXE_BG_FILE

darksidemilk
and
claude
committed
95457da
Preserve an admin-supplied Secure Boot pair outside $webdirdest

darksidemilk
and
claude
committed
a01f180
Write the vhost as a FOG-managed block instead of replacing the whole file

darksidemilk
and
claude
committed
17e5299
Add an optional custom.ipxe hook ahead of FOG's default PXE boot logic

darksidemilk
and
claude
committed
d8b0f47
Cover the Setup Mode / db enrollment path in the Secure Boot PKI design

darksidemilk
and
claude
committed
36e3262
Add versioned kernel/init backups, bin/restorekernel.sh, retire update.sh's copies

darksidemilk
and
claude
committed
53ba117
Document what survives an install/update in docs/SUPPORTED_CUSTOMIZATIONS.md

darksidemilk
and
claude
committed
a9b071b

Commits on Aug 8, 2026

Fix: managed vhost splice lost prior content because the caller moves the file

darksidemilk
and
claude
committed
6175274
Fix: customizationsDir resolved at source time, before fogprogramdir existed

darksidemilk
and
claude
committed
745912c
Mark bin/restorekernel.sh executable

darksidemilk
and
claude
committed
69f8cea
Fix: restore was reverting FOG's own files in service/ipxe on every update

darksidemilk
and
claude
committed
60f9edf
Scope kernel backups to kernel/init files, and fix restorekernel.sh's ipxedir

darksidemilk
and
claude
committed
a799551
Back up by subtracting what FOG ships, not by enumerating kernel names

darksidemilk
and
claude
committed
fb28219
Detect and report a custom kernel installed under one of FOG's own names

darksidemilk
and
claude
committed
f3e55fb
Detect a modified kernel by checksum, since xattrs survive in-place overwrite

darksidemilk
and
claude
committed
69ecdb7
Keep the outgoing kernel in place as bzImage.<version>, and fix a false positive

darksidemilk
and
claude
committed
d0fb7b4
Create the .<version> kernel sibling at restore time, not backup time

darksidemilk
and
claude
committed
ef3a1a3
Make kernel and init selections dropdowns of what is actually on disk

darksidemilk
and
claude
committed
fabf07d
Keep web assets out of the kernel dropdown

darksidemilk
and
claude
committed
cee7f1b
Label the blank kernel/init option as "use the default"

darksidemilk
and
claude
committed
f50184d
Add the split PKI: Root CA plus Web and Client Communication intermediates

darksidemilk
and
claude
committed
620a0bb
Remove bin/setupacme.sh -- ACME is not FOG's job

darksidemilk
and
claude
committed
67fa3ec
Add canonical-path indirection so certificates can live outside FOG's tree

darksidemilk
and
claude
committed
50e4fad
Point certDecrypt() at the client communication key when a split PKI exists

darksidemilk
and
claude
committed
11d8c88
Parameterise validateExternalCA() by zone so each zone imports independently

darksidemilk
and
claude
committed
a56827b
Add the PKI selection and per-zone bring-your-own-CA flags

darksidemilk
and
claude
committed
40d12f9
Split netbootproto from httpproto so private-CA installs keep HTTPS web

darksidemilk
and
claude
committed
c19c9d8
Document the certificate zones in docs/PKI_ZONES.md

darksidemilk
and
claude
committed
b1dd1e2
Correct the certDecrypt coupling: it is to the FILE, not to "the web cert"

darksidemilk
and
claude
committed
e1a735b
Make the split PKI the default for fresh installs

darksidemilk
and
claude
committed
12642e1
Issue Secure Boot code-signing leaves from a FOG Secure Boot CA intermediate

darksidemilk
and
claude
committed
3a53982
Resolve pkiMode and sslpath before Secure Boot, which runs first

darksidemilk
and
claude
committed
64b2701
Document Secure Boot zone status and add continuation context

darksidemilk
and
claude
committed
dabeab0
Correct the efitools availability claim

darksidemilk
and
claude
committed
3db71b7
Sharpen the efitools note with the upstream tracker evidence

darksidemilk
and
claude
committed
a712d28
Verify the db/Setup-Mode path with efitools built from source

darksidemilk
and
claude
committed
07c8f54
Add --secureboot-ca-cert so the Secure Boot zone is importable like the others

darksidemilk
and
claude
committed
7b5753f
Do not regenerate the Root CA when its key has been taken offline

darksidemilk
and
claude
committed
86e5f47
Record Secure Boot verified on real UEFI hardware, both enrolment routes

darksidemilk
and
claude
committed
af7e156
Record fog-client confirmed on a split server, and the root-trust follow-up

darksidemilk
and
claude
committed
1688ecd
Confirm HTTPS works once the root CA is trusted

darksidemilk
and
claude
committed
b43e68d
Note two reported dropdown issues in the continuation context

darksidemilk
and
claude
committed
55df7e9