HTTPS and DNS

A local root, a wildcard leaf, real DNS pointing at loopback, and why grove serves 127.0.0.4 rather than 127.0.0.1.

The certificate authority

grove install generates a root in your state directory and installs it into the system trust stores, which is the step that may ask for your password. The daemon issues a wildcard leaf for *.grov.site from that root, so every context’s hostname is covered by one certificate and a new worktree needs nothing issued.

Runtimes that ignore the OS store get told separately. grove exec sets NODE_EXTRA_CA_CERTS to the root, and REQUESTS_CA_BUNDLE and DENO_CERT to a bundle carrying it, since those two replace a trust store rather than adding to it and so need the whole thing. Where the system’s own bundle was updated by the install, that’s the one used; otherwise grove’s. grove doctor reports which, and GROVE_SYSTEM_BUNDLE names one by hand.

The DNS

*.grov.site is real wildcard DNS pointing at 127.0.0.4, so there are no hosts-file entries to manage and a hostname exists the moment a context does. Secure cookies and OAuth redirects behave like production, because the origin is a real name over real TLS. Two branches are two origins, so they never share a session, where localhost:3000 and localhost:3001 do.

Some resolvers strip answers that point into loopback as a rebinding defence. Pi-hole, NextDNS, dnsmasq with stop-dns-rebind, and several routers do this. Doctor’s DNS check names it, and the fix is to allowlist the domain.

The domain isn’t a config key. It’s a constant, and it’s one decision with the address grove serves: a hostname resolving somewhere grove doesn’t serve reaches nothing, which is what doctor’s DNS check reports when they disagree.

Why 127.0.0.4

Grove serves 127.0.0.4, not 127.0.0.1. That’s the whole reason it runs beside lando: nothing contends for 127.0.0.1:443, so neither has to be stopped for the other, and there’s no port to hand back.

127.0.0.1:80    docker-proxy   <- lando
127.0.0.1:443   docker-proxy   <- lando
127.0.0.4:80    grove
127.0.0.4:443   grove

The other side of the proxy is ordinary loopback: your dev servers listen on 127.0.0.1 and grove connects to them there.

Port 80

The daemon answers plain HTTP on port 80 too, redirecting every request to its https counterpart, so a hostname typed without a scheme still lands somewhere. Doctor’s HTTP redirect check covers it.