2026-10-29T00:27:00  <matrix-o-o> <Firstyear (Firstyear)> acidsys: What was wrong with it? I want to know in case it was a bug or not?
2026-10-29T00:29:45  <acidsys> just weird way of telling the client about server side tls error. the kanidmd has these weird ExecStartPost to copy the certificate and key to the place it is configured to read from. so when we update certificate, this only gets copied if kanidmd is restarted. better would be to configure the service to read them from our deployed path directly (/etc/ssl/services/...). in the past, it was
2026-10-29T00:29:48  <acidsys> not so often an issue because with automatic kernel updates the machine would occasionally reboot anyways. but now with 15.6 eol it has a high uptime :)
2026-10-29T03:40:46  <matrix-o-o> <Firstyear (Firstyear)> acidsys: You can send kanidm a sighup or run the kanidm reload command and it'll reload the cert.
2026-10-29T03:40:54  <matrix-o-o> <Firstyear (Firstyear)> It's only that systemd reload is unreliable, but we support it
2026-10-29T03:41:38  <matrix-o-o> <Firstyear (Firstyear)> * unreliable and that we don't support that path.
2026-10-29T03:41:43  <matrix-o-o> <Firstyear (Firstyear)> But we do support reloading.
2026-10-29T08:14:26  <krop> KDE sysadmins just reported opensuse.org has DNSSEC issues:  https://paste.opensuse.org/pastes/055914efffac which is confirmed by https://dnssec-debugger.verisignlabs.com/opensuse.org
2026-10-29T10:36:49  <acidsys> Firstyear: we already do that, the problem is you put ExecStartPre into the service unit to copy the certificates to another place. this is not executed upon reload. you should have the service configured to read from the place where we deploy the certificates to directly
2026-10-29T10:45:21  <acidsys> krop: ugh yeah two nameservers are out of sync
2026-10-29T10:45:55  <acidsys> monitoring this was yet another TODO :(
2026-10-29T11:00:47  <acidsys> is repaired now, will update ticket shortly
2026-10-29T11:00:56  <krop> Thanks!
2026-10-29T11:21:42  <Obi-Wan> Hello! Not sure if any of our awesome opensuse heroes can have a look at https://progress.opensuse.org/issues/209001? It's about adding a single TXT record for uyuni-project.org, so we can publish to Maven Central :-)
2026-10-29T13:23:40  <matrix-o-o> <dualkei> krop: https://dnsviz.net/ is a helpful DNSSEC debugging tool FWIW.
2026-10-29T13:24:14  <matrix-o-o> <dualkei> +also