kyle/imladris
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

remove the WNTRMUTE CA (MCP teardown)

Browse Source 
Kyle 2026-09-22: the shared CA was only for Metacircular services (system
trust store + the MCR podman registry cert). No host should still depend on
it; anything that does should fail loudly rather than keep trusting it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kyle
2026-09-22 19:57:14 -07:00
co-authored by Claude Opus 5.5
parent 90a572eabb
commit 7a89ca25c4
2 changed files with 0 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configuration.nix
-8
View File
@@ -151,14 +151,6 @@
};
programs.ssh.askPassword = "ksshaskpass";
# Trust the WNTRMUTE issuing CA for all Metacircular services.
security.pki.certificateFiles = [ ./certs/wntrmute-ca.pem ];
# Trust the WNTRMUTE CA for podman/skopeo registry connections (MCR).
# Podman uses /etc/containers/certs.d/<registry:port>/ca.crt, not the
# system CA bundle.
environment.etc."containers/certs.d/mcr.svc.mcp.metacircular.net:8443/ca.crt".source = ./certs/wntrmute-ca.pem;
nix.settings.experimental-features = [ "nix-command" "flakes" ];
nix.settings.trusted-users = ["kyle"];