ask-local 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 6b2c1d943d3bbfb315651a8bd50deb3519f325822e894f1c4040d30b7523cb46
+  data.tar.gz: 9ad93192b70b62cae5292b5a1784bd9086e4103dba7d4f2a07aa83b7327bf795
+SHA512:
+  metadata.gz: 74920fa209896d3a66f67245c6757f45f9c23793147dabfdf7e1f088f0c6af9fcb41442f44dcd1657816617aa88eaa318a5c57fde6035dc767704812bef7f0ff
+  data.tar.gz: c65585ddefac14be0b4898f3e5af9b96f370826bb11b43bc2f2ace9ce3dd350b1f8ba6b0a6b6bd45f2f43eecf1a34f4831bb1fff439087b01ce6ef1da379d169

data/CHANGELOG.md

@@ -0,0 +1,119 @@
+# Changelog
+
+## [0.2.0] — Unreleased
+
+### Changed
+
+- `cli.rb` (757 lines) split into command objects behind a shared
+  Context: `cli/boot.rb` (run/boot/supervision), `cli/routes.rb`
+  (get/alias/list/prune/stop/restart/log/status/open),
+  `cli/system.rb` (proxy/service/hosts/trust/clean/doctor/kamal).
+- Default `rake test` runs the fast unit suite (~6s); `rake test:e2e`
+  runs daemon/TLS/live-boot tests; `rake test:all` runs everything.
+
+### Added
+
+- Daemon-owned supervision (puma-dev model): managed apps idle-stop
+  after 15 minutes (`ASK_LOCAL_IDLE_TIMEOUT`), stop when tmp/restart.txt
+  changes, and boot transparently on the next request.
+- `ask-local stop` (exit 0 stopped / 2 no route / 3 backend already
+  gone), `restart`, `log [-f] [n]`, `status` (effective naming context),
+  `open [name]` (browser). `list` shows backend liveness per route.
+- Root-owned `service install` (launchd/systemd) binding 80/443 at boot
+  with the invoking user's state dir; sudo re-exec when needed.
+- All root write paths chown state back to the invoking user; `doctor`
+  reports an unwritable state dir plainly.
+- Bounded proxy concurrency (`ASK_LOCAL_MAX_CONNECTIONS`, 503 past the
+  cap), mtime-TTL route cache, IPv4+IPv6 loopback listeners, dual-stack
+  `ours?` health check.
+- `get` inherits variant/TLD context from the current directory
+  (`get backend` in a fix-ui worktree -> fix-ui.backend.localhost);
+  `--service/--variant/--tld` overrides.
+- `alias` accepts full hostnames on any TLD and honors ASK_LOCAL_TLD.
+- `kamal` snippet resolves the app from the directory; `--app/--domain`
+  flags and ASK_LOCAL_KAMAL_DOMAIN.
+- `clean` untrusts the CA from the OS trust store.
+- `--proc <name>` picks a specific Procfile process.
+- Ships the `ask-local` agent skill (ask/skills/ask-local/SKILL.md).
+- `test:e2e` / `test:all` rake tasks; CI matrix (3.2/3.3/3.4/4.0),
+  macOS e2e leg, fixture-sweep job.
+- Ownership module: root write paths chown state back to the invoking
+  user; `doctor` reports an unwritable state dir with the fix.
+- Proxy hardening: bounded concurrency (503 past the cap), mtime-TTL
+  route cache, IPv4+IPv6 loopback listeners, dual-stack health check,
+  oversize-hostname refusal.
+- `status` (effective naming context), `open [name]`, `log -f`;
+  `stop` exit codes 0/2/3; `list` shows backend liveness.
+- Sinatra-modular + foreman-`$PORT` fixtures; no-double-injection guard.
+- SKILL.md "when NOT to use" section (CI, prod, Docker networks).
+- Framework coverage: hanami2 slice layout, jekyll livereload second
+  port (`--livereload-port` pinned next to the main port when
+  `livereload: true`), roda-plugins managed boot; no-double-injection
+  guard for explicit `$PORT`.
+- Chunked request uploads pinned by test (streamed intact,
+  close-delimited).
+- README non-goals section (HTTP/2, tunnels, production) with rationale.
+- DNS-rebinding boundary: foreign Hosts get a bare 404; only our own
+  TLDs see the route-listing 404. Proxy takes `--tld` (persisted) so the
+  boundary follows custom domains.
+- Log rotation (5MB, one generation) on proxy + backend logs; `doctor`
+  disk-usage check.
+- `--json` on list/status/doctor with stable keys; `status` sources made
+  explicit (no more `(from -)`).
+- Route cache keyed on file mtime (no TTL race for boot-then-curl);
+  foreground supervision polls at 2Hz with the detached-children
+  rationale documented.
+
+### Fixed
+
+- Daemon spawn and service install resolved the ask-local binary one
+  directory too high — `proxy start` failed outright; failures now
+  include the proxy log tail.
+- Keep-alive connections now rewrite headers (X-Forwarded-Proto) on
+  every request, not just the first — request 2+ previously reached the
+  backend unrewritten, breaking ssl detection and OmniAuth callbacks.
+- Ctrl+C / TERM stops the backend process (no orphans); the CLI exits
+  when the backend dies, cleaning up routes.
+- SNI certificate minting is arity-agnostic across ruby-openssl versions
+  (callback args differ; a raise surfaced as an unrecognized-name alert).
+- Proxy honors HTTP/1.1 framing per request: Content-Length bodies are
+  forwarded exactly; chunked bodies and responses close-delimit.
+- Bidirectional streaming terminates promptly on `Connection: close`
+  (each pump direction closes its peer on EOF).
+- `alias --remove` now appends the default TLD.
+- `base64` declared as a runtime dependency (left the default gems in
+  Ruby 3.4).
+- Missing `require "optparse"` lost in the CLI split.
+- Install generator `source_root` pointed at a doubled path; generator
+  file checks now resolve against `destination_root`.
+- Port-flag injection no longer double-sets an explicit `$PORT`.
+
+## [0.1.0]
+
+### Added
+
+- Initial release: explicit-run reverse proxy giving every Ruby app a
+  stable `https://<app>.localhost` URL.
+- Zero-flag name inference (Rails module, gemspec, package.json, git
+  root, directory) with `ask-local.json` overrides.
+- `{variant}.{service}.{app}.{tld}` hostname composition; linked-worktree
+  branch prefixes; custom `--tld` including owned domains.
+- Managed Rack boot on unix sockets (rackup/TCP fallback); run mode with
+  `PORT`/`ASK_LOCAL_URL` injection; `Procfile.dev` and static-site
+  framework detection.
+- Local CA + per-host SNI certs (in-memory LRU), `trust`, `hosts sync`,
+  `doctor`, `prune`, `alias`, `get`, `kamal` snippet.
+- Explicit `--port/--host` injection for port-ignoring CLIs (Jekyll,
+  Middleman, Bridgetown), skipped when the user already set a port.
+
+### Changed
+
+- Rails module inference kebab-cases CamelCase and digit runs:
+  `Rails8Min` → `rails-8-min` (was `rails8min`).
+- Monorepo `ask-local.json` with an `apps:` map is discovered by walking
+  up from the package directory.
+- `service: web` produces the bare `app.tld` (all other services prefix).
+- Puma 8 command shape (positional `config.ru`; `--rackup` was removed
+  upstream) and spawned backends run unbundled so system/bundle puma is
+  reachable regardless of the invoking bundle.
+- Boot failures include the backend log tail in the error message.

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kaka Ruto
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,200 @@
+# ask-local
+
+[![Gem Version](https://badge.fury.io/rb/ask-local.svg)](https://badge.fury.io/rb/ask-local)
+
+Stable named `.localhost` URLs for Ruby development. Gives every Ruby app
+a stable `https://<app>.localhost` URL instead of a memorized port.
+Zero runtime dependencies — Ruby stdlib only (`openssl`, `socket`).
+
+```bash
+gem install ask-local
+cd ~/code/myapp && ask-local
+# -> https://myapp.localhost
+```
+
+## How it works
+
+1. `ask-local` infers your app name (Rails module, gemspec,
+   `package.json`, git root, or directory) and boots it — managed Rack
+   apps on a unix socket (zero TCP ports), anything else via `PORT`.
+2. Registers `hostname -> backend -> pid` in `~/.ask-local/routes.json`.
+3. The reverse proxy (HTTPS on 443, per-host certs from a local CA)
+   routes by `Host` header to your app.
+
+`.localhost` resolves to loopback natively in Chrome, Firefox, and Edge —
+no DNS server, no `/etc/resolver`. Safari may need `ask-local hosts sync`.
+
+## Hostname shape
+
+```
+{variant}.{service}.{app}.{tld}
+```
+
+| Axis | Example | Source |
+|---|---|---|
+| app | `myapp` | inferred, `--name`, `ask-local.json`, `ASK_LOCAL_NAME` |
+| service | `api.myapp` | `--service`, `ASK_LOCAL_SERVICE` (`web` stays bare) |
+| variant | `fix-ui.myapp` | `--variant`, `ASK_LOCAL_VARIANT`, linked worktree branch |
+| tld | `myapp.preview.example.com` | `--tld` (default `localhost`) |
+
+Linked git worktrees get a branch prefix automatically
+(`fix-ui.myapp.localhost`); the main checkout keeps the bare name.
+Pass `--branch` (or `ASK_LOCAL_BRANCH=1`) to prefix by current branch
+outside worktrees. `main`/`master`/detached HEAD never prefix.
+
+```bash
+ask-local                                          # -> https://myapp.localhost
+ask-local --service api                            # -> https://api.myapp.localhost
+ask-local --variant demo                           # -> https://demo.myapp.localhost
+ask-local --tld preview.example.com                # your own domain (OAuth parity)
+```
+
+## Commands
+
+```bash
+ask-local                        # infer name, boot app
+ask-local run -- <cmd>           # run explicit command through proxy
+ask-local <name> <cmd>           # explicit app name
+ask-local get <name>             # print URL for cross-service wiring
+ask-local alias <name> <port>    # static route (e.g. Docker)
+ask-local list [--json]          # show active routes (+ backend liveness)
+ask-local status [--json]        # show effective naming context here
+ask-local doctor [--json]        # machine-readable health checks
+ask-local open [name]            # open the app URL in a browser
+ask-local doctor                 # read-only health check (state, proxy, routes, DNS, CA)
+ask-local trust                  # add local CA to system trust store
+ask-local clean                  # remove state and hosts entries
+ask-local prune                  # remove stale routes
+ask-local stop                   # stop this app's backend + routes
+ask-local restart                # touch tmp/restart.txt (managed apps reboot)
+ask-local log [-f] [n]           # tail (or follow) this app's backend log
+ask-local proxy start|stop       # control the proxy
+ask-local service install|status|uninstall   # root-owned OS startup service
+ask-local hosts sync|clean       # manage /etc/hosts entries
+ask-local kamal <variant>        # preview-deploy snippet for Kamal
+```
+
+Child processes receive `ASK_LOCAL_URL` (the stable URL — use it for
+OAuth callbacks, mailer hosts, webhook URLs), `PORT`, and `HOST`.
+
+## Frameworks
+
+Rails and bare Rack (`config.ru`) boot managed on a unix socket (Puma
+when available; `rackup` on TCP otherwise). `Procfile.dev`/`bin/dev`,
+Jekyll, Bridgetown, and Middleman run in run mode with `PORT` injected
+(port-ignoring CLIs get explicit `--port/--host` flags). Anything else:
+`ask-local run -- <cmd>`.
+
+```bash
+ask-local --proc web             # boot a specific Procfile process
+ask-local --proc worker          # (first line is the default)
+```
+
+Procfile lines that are compound (`&&`, `||`, `|`, `;`) are refused with
+guidance rather than silently mis-injected.
+
+For Rails integration (hosts, Action Cable origins, Procfile rewrite,
+generators), see `ask-local-rails`.
+
+## WebSockets
+
+Action Cable and any Rack hijack-based WebSocket server work through the
+proxy: HTTP/1.1 `Upgrade` requests are byte-forwarded to the backend
+after header rewriting, and the tunnel stays raw for the life of the
+connection (verified end-to-end: RFC 6455 handshake + frame echo).
+
+## Machine-readable output
+
+`list`, `status`, and `doctor` accept `--json` with stable keys for
+agents and scripts (`DevUrl` in ask-ruby-harness consumes the same data
+in-process). Hostnames that fall outside the configured TLDs get a bare
+404 naming nothing — route names never leak to foreign hosts
+(DNS-rebinding boundary).
+
+## Log rotation
+
+`proxy.log` and per-app backend logs rotate at 5MB
+(`ASK_LOCAL_LOG_MAX_BYTES`), keeping one generation. `doctor` warns
+when the state dir passes 100MB.
+
+## Supervision
+
+Managed apps are supervised by the proxy daemon, not the CLI:
+
+- idle backends stop after 15 minutes (`ASK_LOCAL_IDLE_TIMEOUT`
+  seconds; `0` disables) and boot transparently on the next request
+- touching `tmp/restart.txt` stops the backend; next request reboots it
+- crashed backends are detected and rebooted on the next request
+- daemon shutdown stops every supervised backend (no orphans)
+
+Run-mode (TCP) routes and static aliases are never supervised.
+
+## Ask ecosystem integration
+
+| Gem | How ask-local helps |
+|---|---|
+| `ask-rails` | `ask_local:install` equivalent wiring: `config.hosts` patterns, `allowed_request_origins` for Cable, mailer/OmniAuth hosts from `ASK_LOCAL_URL` |
+| `ask-rails-harness` | Its 9 Rails tools (routes, models, DB, logs) run against the app the proxy serves; `DevUrl` gives the agent the stable URL instead of a guessed port |
+| `ask-app-server` | The JSON-RPC/stdio session host sits behind `https://api.<app>.localhost`; editor/IDE clients use `ask-local get` output |
+| `ask-mcp` | MCP servers get named URLs per service (`mcp.<app>.localhost`), no port coordination across servers |
+| `ask-skills` | Ships the `ask-local` skill (auto-discovered): boot via `ask-local`, wire via `get`, callbacks from `ASK_LOCAL_URL` |
+| `ask-ruby-harness` | `DevUrl` tool: structured `list`/`get` for agents, audit-logged like every other tool |
+
+What we do differently from Kamal for local dev: Kamal + kamal-proxy
+own production (Let's Encrypt, zero-downtime deploys, multi-host).
+ask-local never serves prod — but the variant slug is shared, so
+`fix-ui.myapp.localhost` locally and `myapp-fix-ui.preview.example.com`
+in staging (via `ask-local kamal fix-ui`) are the same branch everywhere.
+
+## Prior art
+
+Same problem, three generations — ask-local borrows from all of them:
+
+- **Pow** (2011–2017, macOS-only Rack): the ergonomics — zero-config
+  names, `tmp/restart.txt`, `.powrc` env loading. Left behind: Nack
+  workers, firewall forwarding, HTTP-only, unmaintained.
+- **puma-dev** (Go, macOS/Linux): the engine semantics — Puma on unix
+  sockets, lazy boot, idle kill, restart.txt watching, in-memory dynamic
+  TLS, per-route status. Kept as behavior, reimplemented in Ruby.
+- **portless** (Node 24, any stack): the agent interface — explicit run
+  ownership, `PORTLESS_URL`-style env contract, `get/doctor/prune`,
+  worktree prefixes, custom-TLD OAuth parity, SKILL.md pattern.
+
+Build vs borrow decision: ask-local is pure Ruby (stdlib + base64),
+not a wrapper around puma-dev's Go core. Rationale: zero-toolchain
+distribution (`gem install`, no Go/Node), the ask-core zero-dependency
+philosophy, and full control over the agent surface (route store,
+supervision, skills). puma-dev's semantics were ported, not its binary.
+
+## Non-goals (deliberate)
+
+- **HTTP/2.** Ruby dev servers serve a handful of requests, not Vite's
+  hundreds of unbundled files — the multiplexing win doesn't apply, and
+  ALPN/HPACK/stream state would triple the proxy's auditable surface.
+  Revisit only on benchmarked HMR latency. (Consequence: no HTTP/2
+  extended-CONNECT bridging; browsers never negotiate h2 here, so plain
+  Upgrade tunneling covers Action Cable fully.)
+- **LAN/mDNS and Tailscale/ngrok tunnels.** mDNS behaves differently on
+  every network; tunnels need third-party CLIs, auth state, and accounts.
+  The 95% "show this branch to someone" case is covered by the `kamal`
+  preview-deploy snippet on real infrastructure instead of a laptop
+  tunnel. Kamal owns remote access; ask-local owns local naming.
+- **Production serving.** The proxy binds loopback only, the CA is
+  self-signed, and there is no request buffering, rate limiting, or
+  access control. Anything real goes through Kamal + kamal-proxy.
+
+## Development
+
+```bash
+bundle install
+bundle exec rake test
+```
+
+The `ask-local-apps` fixture fleet (sibling checkout) exercises
+detection, inference, and boot across Rails variants, Roda, Sinatra,
+bare Rack, Jekyll, compound Procfiles, and a monorepo. CI runs the
+fixture sweep automatically.
+
+## License
+
+MIT

data/bin/ask-local

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require_relative "../lib/ask-local"
+
+exit Ask::Local::CLI.run(ARGV)

data/lib/ask/local/certs.rb

@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "openssl"
+
+module Ask
+  module Local
+    # Local CA + per-hostname certificates, all in-process via OpenSSL.
+    #
+    # *.localhost sits at a public-suffix boundary so a wildcard cert is
+    # not honored; every hostname gets an exact-SAN cert minted on demand
+    # through the SNI callback and held in an in-memory LRU
+    # (puma-dev ssl.go does the same; portless caches on disk instead).
+    module Certs
+      CA_COMMON_NAME = "Ask Local CA"
+      CA_VALIDITY_DAYS = 3650
+      HOST_VALIDITY_DAYS = 825
+      CACHE_SIZE = 1024
+
+      module_function
+
+      def state_dir
+        ENV["ASK_LOCAL_STATE_DIR"] || File.join(home, ".ask-local")
+      end
+
+      def home
+        ENV["HOME"] || Dir.home
+      rescue ArgumentError
+        Dir.pwd
+      end
+
+      def ca_paths(dir = state_dir)
+        { cert: File.join(dir, "ca.pem"), key: File.join(dir, "ca-key.pem") }
+      end
+
+      def ensure_ca(dir = state_dir)
+        FileUtils.mkdir_p(dir, mode: 0o755)
+        Ownership.fix(dir)
+        paths = ca_paths(dir)
+        return paths if valid_pair?(paths[:cert], paths[:key])
+
+        key = OpenSSL::PKey::EC.generate("prime256v1")
+        cert = OpenSSL::X509::Certificate.new
+        cert.version = 2
+        cert.serial = OpenSSL::BN.rand(128, 0)
+        cert.subject = cert.issuer = OpenSSL::X509::Name.parse("/CN=#{CA_COMMON_NAME}")
+        cert.not_before = Time.now - 3600
+        cert.not_after = Time.now + (CA_VALIDITY_DAYS * 86_400)
+        cert.public_key = key
+        ef = OpenSSL::X509::ExtensionFactory.new
+        ef.subject_certificate = cert
+        ef.issuer_certificate = cert
+        cert.add_extension(ef.create_extension("basicConstraints", "CA:TRUE", true))
+        cert.add_extension(ef.create_extension("keyUsage", "keyCertSign,cRLSign", true))
+        cert.sign(key, "SHA256")
+
+        File.write(paths[:key], key.to_pem, mode: "w", perm: 0o600)
+        File.write(paths[:cert], cert.to_pem, mode: "w", perm: 0o644)
+        Ownership.fix(paths[:key], paths[:cert])
+        paths
+      rescue OpenSSL::OpenSSLError => e
+        raise CertError, "Could not generate local CA: #{e.message}"
+      end
+
+      def load_ca(dir = state_dir)
+        paths = ensure_ca(dir)
+        [OpenSSL::X509::Certificate.new(File.read(paths[:cert])),
+         OpenSSL::PKey.read(File.read(paths[:key]))]
+      end
+
+      # Mint a leaf cert for one hostname, signed by the CA.
+      def mint_host(hostname, ca_cert, ca_key)
+        key = OpenSSL::PKey::EC.generate("prime256v1")
+        cert = OpenSSL::X509::Certificate.new
+        cert.version = 2
+        cert.serial = OpenSSL::BN.rand(128, 0)
+        cert.subject = OpenSSL::X509::Name.parse("/CN=#{hostname[0, 64]}")
+        cert.issuer = ca_cert.subject
+        cert.not_before = Time.now - 3600
+        cert.not_after = Time.now + (HOST_VALIDITY_DAYS * 86_400)
+        cert.public_key = key
+        ef = OpenSSL::X509::ExtensionFactory.new
+        ef.subject_certificate = cert
+        ef.issuer_certificate = ca_cert
+        cert.add_extension(ef.create_extension("basicConstraints", "CA:FALSE", true))
+        cert.add_extension(ef.create_extension("keyUsage", "digitalSignature,keyEncipherment", true))
+        cert.add_extension(ef.create_extension("extendedKeyUsage", "serverAuth"))
+        cert.add_extension(ef.create_extension("subjectAltName", "DNS:#{hostname}"))
+        cert.sign(ca_key, "SHA256")
+        [cert, key]
+      end
+
+      # Build an SSLContext whose SNI callback serves the right cert per host.
+      def server_context(dir = state_dir)
+        ca_cert, ca_key = load_ca(dir)
+        cache = CertCache.new(CACHE_SIZE)
+        ctx = OpenSSL::SSL::SSLContext.new
+        ctx.cert = ca_cert
+        ctx.key = ca_key
+        # ruby-openssl versions differ in how the callback receives its
+        # arguments: [[socket, name]] (one array arg), (socket, name), or
+        # (name). Flatten defensively — a raise inside the callback
+        # surfaces as an unrecognized-name handshake alert.
+        ctx.servername_cb = lambda do |*args|
+          host = Array(args).flatten.last.to_s.downcase
+          entry = cache.fetch(host) do
+            cert, key = mint_host(host, ca_cert, ca_key)
+            [cert, key]
+          end
+          entry ? OpenSSL::SSL::SSLContext.new.tap { |c| c.cert, c.key = entry } : nil
+        end
+        ctx
+      end
+
+      def trusted?(dir = state_dir)
+        paths = ca_paths(dir)
+        return false unless File.file?(paths[:cert])
+
+        marker = File.join(dir, "ca.trusted")
+        return false unless File.file?(marker)
+
+        Digest::SHA256.hexdigest(File.read(paths[:cert])).then do |fp|
+          File.read(marker).strip == fp
+        end
+      rescue SystemCallError
+        false
+      end
+
+      def mark_trusted(dir = state_dir)
+        require "digest"
+        paths = ca_paths(dir)
+        fp = Digest::SHA256.hexdigest(File.read(paths[:cert]))
+        File.write(File.join(dir, "ca.trusted"), "#{fp}\n")
+      end
+
+      def valid_pair?(cert_path, key_path)
+        return false unless File.file?(cert_path) && File.file?(key_path)
+
+        cert = OpenSSL::X509::Certificate.new(File.read(cert_path))
+        cert.not_after > Time.now + (7 * 86_400) &&
+          cert.subject.to_s.include?(CA_COMMON_NAME)
+      rescue OpenSSL::OpenSSLError, SystemCallError, ArgumentError
+        false
+      end
+
+      # In-memory LRU for minted host certs.
+      class CertCache
+        def initialize(max)
+          @max = max
+          @store = {}
+          @order = []
+          @mutex = Mutex.new
+        end
+
+        def fetch(host)
+          @mutex.synchronize do
+            if @store.key?(host)
+              @order.delete(host)
+              @order << host
+              return @store[host]
+            end
+            value = yield
+            @store[host] = value
+            @order << host
+            if @order.length > @max
+              oldest = @order.shift
+              @store.delete(oldest)
+            end
+            value
+          end
+        end
+
+        def size
+          @mutex.synchronize { @store.size }
+        end
+      end
+    end
+  end
+end