Repository navigation
odoo: trust the CA in Chromium and Google Chrome - #44
Merged
Merged
Conversation
trustCertificate writes /etc/chromium/policies/managed/odoo-ca.json and /etc/opt/chrome/policies/managed/odoo-ca.json with CACertificates (the CA as base64 DER, built from the public ca.crt). A nixpkgs Chromium already trusts security.pki through NSS, whose built-in roots NixOS replaces with p11-kit; the policy does not depend on that NSS, so Google Chrome and other builds trust the instances too. The odoo-chromium VM test runs a user-installed Chromium (as on beelink) through each path alone: system trust, the policy, and neither (refused), plus an untrusted control. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
andrewthomaslee
enabled auto-merge (squash)
November 12, 2026 22:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
flake-parts/nixosModules/odoo.nix:trustCertificate(on by default) now also writes/etc/chromium/policies/managed/odoo-ca.jsonand/etc/opt/chrome/policies/managed/odoo-ca.jsonwith theCACertificatesenterprise policy. The CA is stored as base64 DER, built from the publicca.crt. The Firefox policy file and these two now sit in oneenvironment.etcset.vm-tests/odoo-chromium.nix(new): alice haschromiumin her user packages, as matt does on beelink, and runs it headless againsthttps://demo.odoo.localhost. A request in nginx's access log proves the TLS handshake passed. The test checks:/etc/ssl/trust-sourceswapped for stock cacert): refused;documentation/docs/odoo.md:trustCertificateand the new test.flake.lock:skillsbumped to skills#18 (odoo skill: Chromium trust, theceo-odoopage).Why
matt now has Chromium on beelink. The test shows a nixpkgs Chromium already trusted the Odoo CA before this change. NixOS's NSS swaps its built-in roots (
libnssckbi) for p11-kit, which reads/etc/ssl/trust-source, andsecurity.pkiputs the CA there. The policy adds a path that doesn't depend on that NSS, so Google Chrome and other Chromium builds trust the instances too, and Chromium trust doesn't hang on a nixpkgs packaging detail.Checks
check(nix flake check): all checks passed.vm-test odoo-chromium --remote --quiet: passed (all 5 subtests).vm-test odoo-firefox --remote --quiet: passed (the Firefox policy file moved into the sharedenvironment.etcset).Merge order
skills#18 (merged) → this PR → home:
nix flake update modules, then the owner deploys beelink (clan machines update beelink). No new clan vars, and the CA is unchanged.🤖 Generated with Claude Code