26.04 is borken

[mahescho]

I've tied to do a new setup with 26.04 without any success.

As far as I can see some of the major problems are the missing bouldernet for bpkimetal and the missing ipki in labca/certs. Looks like generate.sh is not executed. When I fix this boulder does not start up in the end and ACME calls of Nginx fail.

[hakwerk]

Not sure which docker-compose.yml file you used, but the one in the build subdirectory has bpkimetal on bouldernet at the v26.04 tag.
Did you set the environment variable LABCA_FQDN? Probably the control container is showing a message that it isn't set.

I just tested v26.04 on a clean machine and all works as expected

[c0urier]

I see the same error on Debian 13, new installed vm for testing:

Docker and containerd version:

ii  containerd.io                     2.2.4-1~debian.13~trixie             amd64        An open and reliable container runtime
ii  docker-buildx-plugin              0.34.1-1~debian.13~trixie            amd64        Docker Buildx plugin extends build capabilities with BuildKit.
ii  docker-ce                         5:29.5.3-1~debian.13~trixie          amd64        Docker: the open-source application container engine
ii  docker-ce-cli                     5:29.5.3-1~debian.13~trixie          amd64        Docker CLI: the open-source application container engine
ii  docker-ce-rootless-extras         5:29.5.3-1~debian.13~trixie          amd64        Rootless support for Docker.
ii  docker-compose-plugin             5.1.4-1~debian.13~trixie             amd64        Docker Compose (V2) plugin for the Docker CLI.

Error:

bconsul-1         | ==> Failed to load cert/key pair: open /opt/boulder/labca/certs/ipki/consul.boulder/cert.pem: no such file or directory
bconsul-1 exited with code 1 (restarting)
bredis-1          | 1:C 08 Jun 2026 19:56:30.242 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
bredis-1          | 1:C 08 Jun 2026 19:56:30.242 # Redis version=7.0.15, bits=64, commit=00000000, modified=0, pid=1, just started
bredis-1          | 1:C 08 Jun 2026 19:56:30.242 # Configuration loaded
bredis-1          | 1:M 08 Jun 2026 19:56:30.243 # Failed to load certificate: /opt/boulder/labca/certs/ipki/redis/cert.pem: error:80000002:system library::No such file or directory
bredis-1          | 1:M 08 Jun 2026 19:56:30.243 # Failed to configure TLS. Check logs for more info.
bredis-1 exited with code 1 (restarting)
boulder-1         | Mon Jun  8 19:56:31 UTC 2026 - still trying to connect to bpkimetal:8080
bconsul-1         | ==> Failed to load cert/key pair: open /opt/boulder/labca/certs/ipki/consul.boulder/cert.pem: no such file or directory
bconsul-1 exited with code 1 (restarting)
bconsul-1         | ==> Failed to load cert/key pair: open /opt/boulder/labca/certs/ipki/consul.boulder/cert.pem: no such file or directory
bconsul-1 exited with code 1 (restarting)
bconsul-1         | ==> Failed to load cert/key pair: open /opt/boulder/labca/certs/ipki/consul.boulder/cert.pem: no such file or directory
bconsul-1 exited with code 1 (restarting)
boulder-1         | Mon Jun  8 19:56:52 UTC 2026 - still trying to connect to bpkimetal:8080
bconsul-1         | ==> Failed to load cert/key pair: open /opt/boulder/labca/certs/ipki/consul.boulder/cert.pem: no such file or directory

LABCA_FQDN has been set, also in the .env.

CONTAINER ID   IMAGE                                  COMMAND                  CREATED         STATUS                          PORTS                                                                                      NAMES
af43f8508ccc   nginx:latest                           "/docker-entrypoint.…"   9 minutes ago   Up 9 minutes                    0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp               labca-nginx-1
c7a570964009   ghcr.io/hakwerk/labca-boulder:latest   "labca/entrypoint.sh"    9 minutes ago   Up 9 minutes                    0.0.0.0:4001->4001/tcp, [::]:4001->4001/tcp, 0.0.0.0:4003->4003/tcp, [::]:4003->4003/tcp   labca-boulder-1
a17c83a96548   ghcr.io/hakwerk/labca-gui:latest       "bin/labca-gui"          9 minutes ago   Up 9 minutes                    3000/tcp                                                                                   labca-gui-1
794b8aa6e6cd   hashicorp/consul:1.22.6                "docker-entrypoint.s…"   9 minutes ago   Restarting (1) 24 seconds ago                                                                                              labca-bconsul-1
cb071a863489   ghcr.io/hakwerk/labca-control:latest   "./control.sh"           9 minutes ago   Up 9 minutes                    3030/tcp                                                                                   labca-control-1
b38a549722ec   redis:7.0.15                           "docker-entrypoint.s…"   9 minutes ago   Restarting (1) 49 seconds ago                                                                                              labca-bredis-1
556e7cc62206   mariadb:10.11.13                       "docker-entrypoint.s…"   9 minutes ago   Up 9 minutes                    3306/tcp                                                                                   labca-bmysql-1
026fe46b8257   ghcr.io/pkimetal/pkimetal:v1.41.0      "/app/pkimetal"          9 minutes ago   Up 9 minutes                                                                                                               labca-bpkimetal-1

The labca-bconsul-1 and labca-bredis-1 container keeps restarting with the error mentioned above.

[mahescho]

Not sure which docker-compose.yml file you used, but the one in the build subdirectory has bpkimetal on bouldernet at the v26.04 tag. Did you set the environment variable LABCA_FQDN? Probably the control container is showing a message that it isn't set.

I just tested v26.04 on a clean machine and all works as expected

Well ... look at: https://github.com/hakwerk/labca/blob/master/build/docker-compose.yml

  bpkimetal:
    image: ghcr.io/pkimetal/pkimetal:v1.41.0
    volumes:
      - pkimetal-socket:/var/run/pkimetal
      - boulder_data:/config:ro
    network_mode: none
    restart: always

Boulder logs show that Boulder is unable to connect to BPKImeal. Missing boulder network ... works with my previous setup of v26.03.1 :

  bpkimetal:
    image: ghcr.io/pkimetal/pkimetal:v1.20.0
    networks:
      - bouldernet
    restart: always

[c0urier]

Not sure which docker-compose.yml file you used, but the one in the build subdirectory has bpkimetal on bouldernet at the v26.04 tag. Did you set the environment variable LABCA_FQDN? Probably the control container is showing a message that it isn't set.
I just tested v26.04 on a clean machine and all works as expected

Well ... look at: https://github.com/hakwerk/labca/blob/master/build/docker-compose.yml

  bpkimetal:
    image: ghcr.io/pkimetal/pkimetal:v1.41.0
    volumes:
      - pkimetal-socket:/var/run/pkimetal
      - boulder_data:/config:ro
    network_mode: none
    restart: always

Boulder logs show that Boulder is unable to connect to BPKImeal. Missing boulder network ... works with my previous setup of v26.03.1 :

  bpkimetal:
    image: ghcr.io/pkimetal/pkimetal:v1.20.0
    networks:
      - bouldernet
    restart: always

As this was my first install I didn't look at the old compose files. Tried adding

    networks:
      - bouldernet

to the compose and all seem to start up as expected no errors.

Thanks that solved it for me at least.

[mahescho]

Haven't had closer look but, looks to me like communication between boulder and pkimetal has switched from tcp socket to unix socket communication but the boulder config does not reflect this.

to the compose and all seem to start up as expected no errors.

Thanks that solved it for me at least.

Does any thing work with this for you? Own NginX certs and ACME?

[c0urier]

Haven't had closer look but, looks to me like communication between boulder and pkimetal has switched from tcp socket to unix socket communication but the boulder config does not reflect this.

to the compose and all seem to start up as expected no errors.
Thanks that solved it for me at least.

Does any thing work with this for you? Own NginX certs and ACME?

Haven't done any "real" testing, wont happen tonight either - But I can see I can go through the initial setup now atleast.

Update: You are absolutely right, nothing really works except the initial setup. I had to try the previous version you referred to, and it actually just works without any hassle.

[hakwerk]

Haven't had closer look but, looks to me like communication between boulder and pkimetal has switched from tcp socket to unix socket communication but the boulder config does not reflect this.

Ah, you are using images tagged with 26.04 but a compose file from the HEAD of the master branch which is a couple of commits ahead of the 26.04 release. This indeed contains changes such as switching to tcp sockets.

Please checkout the v26.04 tag of your git clone and use that version of the docker-compose.yml file.

[mahescho]

All the same with my next try: Followed the instructions for a docker setup with a fresh git clone and can't generate the root certificate. Same als here:

#179