Skip to content

fix(builder): set ssl-cert-file in nix-builder-box nix.conf (cache substitution) - #944

Draft
bdelanghe wants to merge 2 commits into
mainfrom
ci/notify-front-desk-oidc
Draft

fix(builder): set ssl-cert-file in nix-builder-box nix.conf (cache substitution)#944
bdelanghe wants to merge 2 commits into
mainfrom
ci/notify-front-desk-oidc

Conversation

@bdelanghe

Copy link
Copy Markdown
Contributor

From a backlog local branch, pushed and opened for triage.

bdelanghe and others added 2 commits June 28, 2026 23:24
…s-repo sync (prx-26bq)

The front-desk sweep mints via the cf-token-broker over OIDC (no secrets).
Grant id-token: write on the calling job so it propagates through the
reusable chain (notify-front-desk → trigger-sync → front-desk-sync); drop
the now-useless secrets: inherit (FRONT_DESK_APP_* deleted). Verified via
the site pilot (bounded-systems/site#95).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…bstitution)

The remote-build ssh session doesn't inherit the image SSL_CERT_FILE env, so nix
couldn't verify TLS to cache.nixos.org → built deps from source. nix.conf is read
regardless of env. (prx-zj8 cutover fix)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

1 participant