pinning + new version of backups

2026-07-30 14:03:16 -05:00
parent 477b9a5353
commit 2669ab1388
32 changed files with 1527 additions and 133 deletions
@@ -27,6 +27,9 @@ services:
      OVERLORD_TLS_CERT: ${OVERLORD_TLS_CERT:-/app/certs/server.crt}
      OVERLORD_TLS_KEY: ${OVERLORD_TLS_KEY:-/app/certs/server.key}
      OVERLORD_TLS_CA: ${OVERLORD_TLS_CA:-}
+      # Required for generated-agent pinning when TLS is terminated by a proxy.
+      # May contain current,next pins during certificate key rotation.
+      OVERLORD_TLS_SPKI_PINS: ${OVERLORD_TLS_SPKI_PINS:-}
      # Set true only behind a trusted reverse proxy that terminates TLS (for example Render).
      # Default false keeps current behavior: Overlord terminates TLS in-process.
      OVERLORD_TLS_OFFLOAD: ${OVERLORD_TLS_OFFLOAD:-false}