make up on a clean clone silently mounts directories where the TLS files should be

[Gerrrt]

README.md:152-158 quick start:

make secrets-init
make secrets-edit
make validate
make up

make certs is not in that list, and certificates/ is gitignored
(.gitignore:25), so a clean clone has no CA and no leaf. compose.yaml
bind-mounts three files out of it:

• ../../certificates/ca.pem → Prometheus, for verifying Grafana's TLS
• ../../certificates/grafana.matrix.elysium.pem → Grafana's cert
• ../../certificates/grafana.matrix.elysium-key.pem → Grafana's key

Docker does not fail on a missing bind-mount source — it creates a
directory. So Prometheus gets a directory where ca_file should be, Grafana
gets directories for its cert and key, and the failure surfaces as a TLS error
inside a container rather than as "you skipped a step".

Nothing checks. make up, render-config.sh and validate.sh all proceed —
which is notable given compose.yaml:65-69 and :135-138 make RENDER_UID and
RENDER_GID required rather than defaulted, precisely because a silent
fallback there once left snmp-exporter crash-looping for two weeks.

Fix

Two parts, and the second matters more:

• Add make certs to the quick start, and to docs/runbooks/deploy-stack.md.
• Have render-config.sh refuse to render when the three files are absent, with
  a message naming make certs. That is the same guard pattern the UID/GID
  variables already use, and it is the one that survives someone not reading the
  README.

Found while verifying #12.

[Gerrrt]

Verified on the live prometheus host after #178 merged, against the real deploy path rather than a simulated tree. Recording it here because the fix is easy to re-verify wrongly: a scratch-tree test proves the guard reports, not that make up stops before Docker acts.

Happy path — the guard does not false-positive

make up with all certificates present completed normally, seven services healthy. The certificates are doing real work, not merely existing:

$ curl -s --cacert certificates/ca.pem \
    --resolve grafana.matrix.elysium:3000:127.0.0.1 \
    https://grafana.matrix.elysium:3000/api/health
{ "database": "ok", "version": "13.0.2", ... }

No -k — the chain validates against the lab CA. And Prometheus's grafana target reports up with no error, so the ca.pem mount is verifying Grafana's TLS as intended.

The guard firing

The Grafana leaf was renamed aside — a rename, not a copy, so the inode is preserved and the running container's bind mount is unaffected. Grafana stayed healthy for the duration.

make render failed naming only the single missing file, not all three:

error: compose.yaml mounts these certificates, which are missing or empty:
  certificates/grafana.matrix.elysium.pem

make up then died at Makefile:99: render, and this is the part that matters:

Check	Result
Container start times, before vs after	byte-identical — Docker was never invoked
Directory at the certificate path	none

So the failure mode this issue describes is prevented, not merely diagnosed afterwards. make up aborts at the render step, and Docker never gets the opportunity to create the directory.

Restoration

All four certificates verified byte-identical by SHA-256 with modes unchanged (600/644/640/644), no leftover files, stack healthy and TLS validating.

Test B ran make render before make up deliberately: had the guard somehow not fired, that would surface on the command that cannot invoke Docker, rather than by Docker creating a directory inside the live certificates/.

Related

• docs(certs): correct the leaf key mode and the --force dead end #179 corrected two documentation errors found here — the leaf key mode is 0640, not 0600, and the already exists troubleshooting row pointed at --force, which cannot help the directory case (it gets past the guard, then openssl fails writing to a directory with its stderr sent to /dev/null, so the run dies with no message at all).
• docs(runbooks): correct the reverse-DNS claim, having now run this #180 recovered an unrelated orphaned commit found while auditing branches afterwards.