The index now resolves a .localhost DID document and atproto-did handle over https, as didbot serves them; the http branch for loopback names is gone, and so is the one in the CLI's resolve.rs. A new tls module gives every index reqwest client, and the Jetstream WebSocket connector, the authorities DIDBOT_EXTRA_CA_CERTS names on top of the bundled roots. An unreadable file is logged and skipped, and nothing turns verification off.
dev-index.sh and dev-stack.sh now source scripts/dev-pds-url.sh. It defaults the server to https://agents.localhost, exports DIDBOT_EXTRA_CA_CERTS as didbot's local CA (~/.local/state/didbot/local-ca/ca.pem), and passes that CA to the health-check curl for a .localhost server only. docs/running-locally.md shows the new default. The CLI's own client gets the same extra roots in #110.
Fixes 3mwixdqkpbq2j (https://tangled.org/permadeath.com/vibescrobble.com/issues). This touches the same client constructors as the open bounded-fetches PR, so whichever lands second needs a small rebase.
🤖 Generated with Claude Code