fix(cloud): trust the in-box Portless CA so in-box https://<box>.localhost works#120
fix(cloud): trust the in-box Portless CA so in-box https://<box>.localhost works#120madarco wants to merge 1 commit into
Conversation
…lhost works When the host Portless proxy runs in TLS mode, the symmetric <box>.localhost URL is served inside the box by a self-signed CA the box doesn't trust: - hetzner: the in-VPS mirror's own CA at /root/.portless/ca.pem - docker: the host CA bind-mounted at /home/vscode/.portless/ca.pem portless proxy start only trusts the CA in the Linux system store, not the box user's NSS db, so the in-box VNC Chromium window and Playwright (via Codex) rejected the cert with an HTTPS error. Fix by trusting the CA across every in-box client: - New baked helper agentbox-portless-trust: installs a CA into the system store (update-ca-certificates) + the box user's NSS db (certutil), idempotent and best-effort, prints the system CA path for NODE_EXTRA_CA_CERTS. - Bake libnss3-tools (certutil) into the hetzner snapshot + docker base image. - hetzner startInBoxPortless: when tls, run the helper on /root/.portless/ca.pem and export NODE_EXTRA_CA_CERTS via /etc/profile.d. - docker create: when the resolved portless URL is https, run the helper on the bind-mounted host CA + drop the same profile.d export. No-TLS host proxies (the --no-tls -p 1355 default) serve plain http and skip this entirely. Requires a snapshot re-bake / docker image rebuild to pick up libnss3-tools + the helper. Claude-Session: https://claude.ai/code/session_0152GmbNW3e7QpXNkQFd3MB2
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 18046b0. Configure here.
| const script = | ||
| 'agentbox-portless-trust /home/vscode/.portless/ca.pem >/dev/null 2>&1 || true; ' + | ||
| "echo 'export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/agentbox-portless-ca.crt' " + | ||
| '> /etc/profile.d/agentbox-portless-ca.sh 2>/dev/null || true'; |
There was a problem hiding this comment.
Profile export without CA install
Medium Severity
After TLS Portless setup, both docker and Hetzner always write /etc/profile.d/agentbox-portless-ca.sh exporting NODE_EXTRA_CA_CERTS, even when agentbox-portless-trust did not install the CA (missing/unreadable ca.pem, failed install, or skipped mount). Login shells can then point Node at a non-existent or stale cert path instead of omitting the variable.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 18046b0. Configure here.
|
Reviewed (Bugbot NEUTRAL, CI green) and integrated to |
1 participant
Problem
After the symmetric `.localhost` URL feature, opening `https://.localhost` inside a box (confirmed on Hetzner) fails with a certificate error — both from the VNC Chromium window and from Playwright driven by Codex. The host browser is fine.
Root cause: when the host Portless proxy runs in TLS mode, the symmetric URL is served inside the box by a self-signed CA the box doesn't trust:
`portless proxy start` only trusts the CA in the Linux system store, not the box user's NSS db — which Chromium / Playwright read on Linux — so in-box Chromium rejects the cert. `libnss3-tools` (`certutil`) wasn't even baked, and the cloud path never set `NODE_EXTRA_CA_CERTS`.
Fix
Trust the CA across every in-box client (user chose the robust option over agent-browser-only suppression):
No-TLS host proxies (the `--no-tls -p 1355` default) serve plain http and skip this entirely. Requires a snapshot re-bake / docker image rebuild to pick up `libnss3-tools` + the helper.
Verification
https://claude.ai/code/session_0152GmbNW3e7QpXNkQFd3MB2
Note
Medium Risk
Touches box image bake, create-time root exec, and TLS trust stores; failures are best-effort and skipped for non-TLS Portless, but users must rebuild images/snapshots for the fix to apply.
Overview
Fixes in-box certificate errors on
https://<box>.localhostwhen the host Portless proxy runs in TLS mode. Chromium and Playwright use the box user's NSS store, whichportless proxy startdoes not populate, so VNC browser and Codex Playwright failed while the host browser worked.Adds a baked
agentbox-portless-trusthelper that installs the Portless CA into the system trust store and thevscodeNSS database viacertutil, and wiresNODE_EXTRA_CA_CERTSthrough/etc/profile.d/.libnss3-toolsis added to Docker and Hetzner base images. HetznerstartInBoxPortlessruns the helper on/root/.portless/ca.pemwhentlsis set; Dockercreateruns it on the bind-mounted host CA when the resolved Portless URL ishttps://. Staging, runtime assets, and docs are updated. Plain http Portless (default--no-tls) is unchanged.Requires Hetzner snapshot re-bake (
agentbox prepare --provider hetzner) and/or Docker image rebuild to pick up the helper andlibnss3-tools.Reviewed by Cursor Bugbot for commit 18046b0. Configure here.