Repository navigation
fix(rivethub-electron): renewed device cert without relaunch; drop RivetOS-runtime text - #1200
Merged
Merged
Conversation
…nch; drop the update download after install The mTLS pipe cached the device identity for the life of the process, and each listener kept its own copy. Device leaves are now 30-day step-ca certs that rh cert renew rewrites in place, so a long-running tray app kept presenting the old leaf and lost every https node at expiry until it was restarted. The pipe now re-stats the identity files (following symlinks) on each connection and reloads them when they change, keeping the last good identity if a renewal is caught mid-write. On Linux the downloaded AppImage stayed in its rivethub-update-* temp dir after a successful install; on hosts with a RAM-backed /tmp that held ~120 MB until reboot. Remove it once the copy lands. README: device identity is a step-ca leaf renewed by rh cert renew, and no application menu is installed on Linux.
- Devices: drop the RIVETOS_DEN_DEVICES instructions; the RivetHub runtime does not read them and nothing a user can set turns enrollment on. - Agents settings: the shared directory env var is RIVETHUB_SHARED_DIR. - Memory stats: there is no doctor command for failed jobs on the RivetHub runtime; point at the node's worker logs. - Memory/wiki copy says RivetHub memory; den wording becomes node.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two desktop fixes, plus user-facing text that still pointed at RivetOS-runtime knobs.
rivethub-electron
rh cert renewrewrites the 30-day step-ca leaf in place, usually behind thedevice.crt/device.keysymlinks, while the tray app keeps running, so the old cert stayed in use until relaunch. The identity is now keyed by a stat stamp (ino, size, mtime; symlinks followed) and re-checked on each new loopback connection. A renewal caught mid-write keeps the last good identity.rivethub-update-*temp dir was only cleaned up on failure. That left about 120 MB in a RAM-backed/tmpuntil reboot.rivet-ca.sh issue-clientenrollment text with the step-ca device cert flow (rh cert renew). Also corrects the claim that Linux keeps an app menu; it's macOS-only.rivethub-web text
RIVETOS_DEN_DEVICES=1. Norhsetting enables device enrollment today.RIVETOS_SHARED_DIR→RIVETHUB_SHARED_DIR.rh doctordoesn't report the job queue.Verified
rivethub-electron:tscis clean and vitest passes (newidentityStamptest for a temp-file-plus-rename behind a symlink).rivethub-web:tscis clean and the touched suites pass.