feature/nanocld: value of cockroachDB cert in a secret

Author: 0xle0ne

README.md

@@ -74,6 +74,10 @@ Modern teams need faster iteration loops, secure multi‑tenant isolation, and a
 - Batteries included CLI & daemon.
 - Minimal host footprint; modular optional services.
 
+See the [health-check documentation](https://docs.next-hat.com/docs/guides/nanocl/advanced-usage/health-checks)
+for rolling update readiness behavior and [TLS secret documentation](https://docs.next-hat.com/docs/guides/nanocl/advanced-usage/secret-tls)
+for certificate persistence.
+
 ## Installation
 
 Nanocl supports **Linux**, **macOS**, and **Windows**. See the [Installation guide][nanocl_install_guide].
@@ -122,6 +126,7 @@ Next: explore [Get Started][nanocl_get_started].
 
 ## Latest news
 
+- **Release**: [Nanocl 0.18.0](./doc/releases/nanocl-0.18.0.md)
 - **Blog**: [Automating deployment with GitHub Actions](https://docs.next-hat.com/blog/automating-deployment-with-github-actions-and-nanocl) on 24.11.2024
 - **Release**: [End to End TLS encryption and first step for network meshing](https://docs.next-hat.com/blog/nanocl-0.16) on 01.11.2024
 - **Release**: [Man page, Backup, Remove Orphans and more](https://docs.next-hat.com/blog/nanocl-0.15) on 11.06.2024

bin/nanocl/changelog.md

@@ -11,6 +11,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Upgrade dependencies
 
+### Added
+
+- Cargo health status in command output.
+- Start and delete cargo instances on a specific node.
+
+### Changed
+
+- Statefile rendering and argument handling support required, multiple, described and default values.
+
 ## [0.17.1] - 17-09-2025
 
 ### Fixed
@@ -267,4 +276,3 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Uninstall command
 - Upgrade command
 - Installer fetch template from our official repo or can take custom template path
-

bin/nanocld/changelog.md

@@ -10,7 +10,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - Docker daemon background thread health check to restart nanocld if docker is not reachable.
-- Check docker health check to send correct even to delete old containers when updating a cargo.
+- Health-aware cargo rollouts: wait for replacement containers to become healthy before removing previous instances, and restore the previous instances when a replacement becomes unhealthy.
+- Persist CockroachDB TLS certificate, private-key and CA PEM values instead of filesystem paths; readable legacy path records are migrated at daemon startup.
+- Node placement and resource requirements for cargoes, and commands to start or delete a cargo on a specific node.
+
+### Changed
+
+- Use init containers for VM image handling.
 
 ## [0.17.0] - 2025-09-12
 
@@ -264,4 +270,3 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Namespace network information
 - Upgrade ncproxy to 0.3
 - Upgrade nproxy to 1.23.4.0
-

bin/nanocld/specs/swagger.yaml

@@ -6387,15 +6387,15 @@ components:
       properties:
         Certificate:
           type: string
-          description: Path to the certificate
+          description: Certificate PEM contents
         CertificateKey:
           type: string
-          description: Path to the certificate key
+          description: Private-key PEM contents
         CertificateClient:
           type:
           - string
           - 'null'
-          description: Path to the certificate client
+          description: Certificate-authority PEM contents
         VerifyClient:
           type:
           - boolean
@@ -6405,7 +6405,7 @@ components:
           type:
           - string
           - 'null'
-          description: Path to the dhparam file
+          description: DH parameter contents
       additionalProperties: false
     ProxyStreamProtocol:
       type: string

bin/nanocld/src/utils/store.rs

@@ -1,4 +1,4 @@
-use std::{net::ToSocketAddrs, time::Duration};
+use std::{fs, net::ToSocketAddrs, path::Path, time::Duration};
 
 use diesel::{
   PgConnection,
@@ -11,14 +11,77 @@ use ntex::{rt, time, web};
 
 use nanocl_error::io::{IoError, IoResult};
 use nanocl_stubs::{
-  config::DaemonConfig, proxy::ProxySslConfig, secret::SecretPartial,
+  config::DaemonConfig,
+  proxy::ProxySslConfig,
+  secret::{SecretPartial, SecretUpdate},
 };
 
 use crate::{
   models::{DBConn, Pool, SecretDb},
   repositories::generic::*,
 };
 
+const DB_CERT_SECRET_NAME: &str = "cert.db.nanocl.io";
+
+/// Read a legacy certificate path once, otherwise retain its PEM value.
+///
+/// The store URL still needs paths while creating the initial database
+/// connection. The persisted TLS secret must not retain those paths.
+fn load_certificate_value(
+  value: &str,
+  field: &str,
+) -> IoResult<(String, bool)> {
+  let path = Path::new(value);
+  if !path.is_file() {
+    return Ok((value.to_owned(), false));
+  }
+  let value = fs::read_to_string(path).map_err(|err| {
+    IoError::interrupted(
+      "Database certificate",
+      &format!("Unable to read {field} from {}: {err}", path.display()),
+    )
+  })?;
+  Ok((value, true))
+}
+
+fn load_db_tls_config(
+  config: ProxySslConfig,
+) -> IoResult<(ProxySslConfig, bool)> {
+  let (certificate, certificate_changed) =
+    load_certificate_value(&config.certificate, "certificate")?;
+  let (certificate_key, certificate_key_changed) =
+    load_certificate_value(&config.certificate_key, "private key")?;
+  let (certificate_client, certificate_client_changed) =
+    match config.certificate_client {
+      Some(certificate_client) => {
+        let (value, changed) =
+          load_certificate_value(&certificate_client, "certificate authority")?;
+        (Some(value), changed)
+      }
+      None => (None, false),
+    };
+  let (dhparam, dhparam_changed) = match config.dhparam {
+    Some(dhparam) => {
+      let (value, changed) = load_certificate_value(&dhparam, "DH parameters")?;
+      (Some(value), changed)
+    }
+    None => (None, false),
+  };
+  Ok((
+    ProxySslConfig {
+      certificate,
+      certificate_key,
+      certificate_client,
+      verify_client: config.verify_client,
+      dhparam,
+    },
+    certificate_changed
+      || certificate_key_changed
+      || certificate_client_changed
+      || dhparam_changed,
+  ))
+}
+
 /// Create a pool connection to the store `cockroachdb`
 pub async fn create_pool(store_addr: &str) -> IoResult<Pool> {
   let store_addr = store_addr.to_owned();
@@ -91,10 +154,20 @@ async fn wait(store_addr: &str) -> IoResult<()> {
 }
 
 async fn save_db_cert(store_addr: &str, pool: &Pool) -> IoResult<()> {
-  if SecretDb::read_by_pk("cert.db.nanocl.io", pool)
-    .await
-    .is_ok()
-  {
+  if let Ok(existing) = SecretDb::read_by_pk(DB_CERT_SECRET_NAME, pool).await {
+    let config = serde_json::from_value::<ProxySslConfig>(existing.data)?;
+    let (config, changed) = load_db_tls_config(config)?;
+    if changed {
+      SecretDb::update_pk(
+        DB_CERT_SECRET_NAME,
+        &SecretUpdate {
+          data: serde_json::to_value(config)?,
+          metadata: None,
+        },
+        pool,
+      )
+      .await?;
+    }
     return Ok(());
   }
   let url = url::Url::parse(store_addr).map_err(|err| {
@@ -103,7 +176,9 @@ async fn save_db_cert(store_addr: &str, pool: &Pool) -> IoResult<()> {
       &format!("invalid address format {err}"),
     )
   })?;
-  // extract sslcert sslkey sslrootcert from query params
+  // Extract sslcert, sslkey and sslrootcert from query parameters. These
+  // paths are only used to establish this first connection; their PEM values
+  // are what is persisted in CockroachDB.
   let mut query_pairs = url.query_pairs();
   let sslcert = query_pairs.find(|(k, _)| k == "sslcert").map(|(_, v)| v);
   let sslkey = query_pairs.find(|(k, _)| k == "sslkey").map(|(_, v)| v);
@@ -112,16 +187,21 @@ async fn save_db_cert(store_addr: &str, pool: &Pool) -> IoResult<()> {
     .map(|(_, v)| v);
   match (sslcert, sslkey, sslrootcert) {
     (Some(sslcert), Some(sslkey), Some(sslrootcert)) => {
+      let (certificate, _) = load_certificate_value(&sslcert, "certificate")?;
+      let (certificate_key, _) =
+        load_certificate_value(&sslkey, "private key")?;
+      let (certificate_client, _) =
+        load_certificate_value(&sslrootcert, "certificate authority")?;
       SecretDb::create_from(
         &SecretPartial {
-          name: "cert.db.nanocl.io".to_owned(),
+          name: DB_CERT_SECRET_NAME.to_owned(),
           kind: "nanocl.io/tls".to_owned(),
           immutable: false,
           metadata: None,
           data: serde_json::to_value(ProxySslConfig {
-            certificate: sslcert.to_string(),
-            certificate_key: sslkey.to_string(),
-            certificate_client: Some(sslrootcert.to_string()),
+            certificate,
+            certificate_key,
+            certificate_client: Some(certificate_client),
             verify_client: None,
             dhparam: None,
           })?,

bin/ncdns/changelog.md

@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Core
 
+- Integrated dnsmasq data plane and health endpoint; DNS rule updates no longer require a separate `ndns` container or `docker exec`.
+
 ## [0.9.0] - 2025-09-12
 
 ### Fixed
@@ -116,4 +118,3 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Remove an existing rule
 - Default config ignore resolv.conf and hosts
 - Entry IpAddress can target a namespace with a syntax like: `{namespace name}.nsp`
-

bin/ncproxy/changelog.md

@@ -11,10 +11,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Default server with reuseport to avoid binding problem
 - More header in logs to support cloudflare real ip
+- Integrated Nginx data plane and health endpoint; proxy rules no longer require updates through a separate `nproxy` container.
 
 ### Changed
 
 - Drop old ssl version support
+- Improve the default global Nginx configuration and HTTP 502 page.
 
 
 ## [0.14.0] - 2025-09-12
@@ -204,4 +206,3 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Event Watching from nanocl daemon
 - Proxy Rule accept namespace as network
-

bin/ncproxy/specs/swagger.yaml

@@ -394,15 +394,15 @@ components:
       properties:
         Certificate:
           type: string
-          description: Path to the certificate
+          description: Certificate PEM contents
         CertificateKey:
           type: string
-          description: Path to the certificate key
+          description: Private-key PEM contents
         CertificateClient:
           type:
           - string
           - 'null'
-          description: Path to the certificate client
+          description: Certificate-authority PEM contents
         VerifyClient:
           type:
           - boolean
@@ -412,7 +412,7 @@ components:
           type:
           - string
           - 'null'
-          description: Path to the dhparam file
+          description: DH parameter contents
       additionalProperties: false
     ProxyStreamProtocol:
       type: string

bin/ndns/changelog.md

@@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Upgrade dependencies
 
+### Removed
+
+- The standalone DNS data plane is superseded by the dnsmasq integration in `ncdns`.
+
 ## [2.91.0-n0.9.0] - 2025-09-11
 
 ### Core

bin/nproxy/changelog.md

@@ -15,6 +15,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Default html page with 502
 
+### Removed
+
+- The standalone proxy data plane is superseded by the Nginx integration in `ncproxy`.
+
 ## [1.28.0-n0.14.0] - 2025-09-11
 
 ### Core