psa-systems/vervain-agent
Watch
9
0
Fork
You've already forked vervain-agent
 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

fix(dev): complete .vagent rename and point dev seed at /api/v1/agent (VA-66) #72

Merged
Claude-Run merged 1 commit from fix/VA-66-dev-tooling-vagent-rename-cert-pin into main 2026-06-26 16:10:46 +02:00
Conversation 0 Commits 1 Files changed 4 +18 -4
Claude-Run commented 2026-06-26 15:55:04 +02:00
Member
Copy link

Complete the VS-42 rename leftover and align the dev agent connect target with the real wire path.

Rename the tracked seed and template from the legacy MeshCentral names to the .vagent names the justfile already references: run/vervain-agent.msh -> run/vervain-agent.vagent and run/vervain-agent.msh.template -> run/vervain-agent.vagent.template. Before this, just ensure-settings / ensure-settings-host hit the missing-template branch and exited 1 because the on-disk files still used the old names.

Update the dev template path from the legacy /agent.ashx to the current control path /api/v1/agent, and update the matching render echoes in both justfile recipes. The seed keeps targeting the dev API host (VERVAIN_SERVER_HOST=dev-vervain-server-app-dev) and the host-mode loopback (127.0.0.1), neither of which is a frontend host.

Document cert-pin behavior under TLS offload in the README: the pin is on the application-layer ServerID (SHA-384 of the server agent-root cert SPKI), verified by the server's RSA signature in the secondary handshake, not on the TLS transport cert. The TLS verifier (CapturingNoopVerifier) accepts any transport cert, so Traefik TLS termination for api.vervain.a8n.systems is transparent: the agent accepts the proxy cert at the transport layer and proves the backend ServerID end to end, so the pin passes regardless of where TLS terminates.

#VA-66

Complete the VS-42 rename leftover and align the dev agent connect target with the real wire path. Rename the tracked seed and template from the legacy MeshCentral names to the .vagent names the justfile already references: run/vervain-agent.msh -> run/vervain-agent.vagent and run/vervain-agent.msh.template -> run/vervain-agent.vagent.template. Before this, `just ensure-settings` / `ensure-settings-host` hit the missing-template branch and exited 1 because the on-disk files still used the old names. Update the dev template path from the legacy /agent.ashx to the current control path /api/v1/agent, and update the matching render echoes in both justfile recipes. The seed keeps targeting the dev API host (VERVAIN_SERVER_HOST=dev-vervain-server-app-dev) and the host-mode loopback (127.0.0.1), neither of which is a frontend host. Document cert-pin behavior under TLS offload in the README: the pin is on the application-layer ServerID (SHA-384 of the server agent-root cert SPKI), verified by the server's RSA signature in the secondary handshake, not on the TLS transport cert. The TLS verifier (CapturingNoopVerifier) accepts any transport cert, so Traefik TLS termination for api.vervain.a8n.systems is transparent: the agent accepts the proxy cert at the transport layer and proves the backend ServerID end to end, so the pin passes regardless of where TLS terminates. #VA-66
fix(dev): complete .vagent rename and point dev seed at /api/v1/agent (VA-66)
All checks were successful
Check / fmt + clippy + tests (pull_request) Successful in 15m39s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
58662b0653 
Complete the VS-42 rename leftover and align the dev agent connect target with the real wire path.

Rename the tracked seed and template from the legacy MeshCentral names to the .vagent names the justfile already references: run/vervain-agent.msh -> run/vervain-agent.vagent and run/vervain-agent.msh.template -> run/vervain-agent.vagent.template. Before this, `just ensure-settings` / `ensure-settings-host` hit the missing-template branch and exited 1 because the on-disk files still used the old names.

Update the dev template path from the legacy /agent.ashx to the current control path /api/v1/agent, and update the matching render echoes in both justfile recipes. The seed keeps targeting the dev API host (VERVAIN_SERVER_HOST=dev-vervain-server-app-dev) and the host-mode loopback (127.0.0.1), neither of which is a frontend host.

Document cert-pin behavior under TLS offload in the README: the pin is on the application-layer ServerID (SHA-384 of the server agent-root cert SPKI), verified by the server's RSA signature in the secondary handshake, not on the TLS transport cert. The TLS verifier (CapturingNoopVerifier) accepts any transport cert, so Traefik TLS termination for api.vervain.a8n.systems is transparent: the agent accepts the proxy cert at the transport layer and proves the backend ServerID end to end, so the pin passes regardless of where TLS terminates.

#VA-66
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/vervain-agent!72
No description provided.