# Tasks

## 1. Serve the certificate for the connecting address

- [x] 1.1 Add a helper that lists the container's local addresses (IPv4 and IPv6, loopback excluded) using `hostname -I`, falling back to `ip -o addr`; verify the logic with a stubbed `hostname`/`getent` (IPv4 only, IPv6 only, address containing a `%zone`, and no addresses at all)
- [x] 1.2 Add a helper that mangles a name the way `http_make_path()` in CUPS does (keep `[A-Za-z0-9.-]`, replace the rest with `_`) and derive the lookup names: every DNS SAN, each address literal with `%zone` spelled `+zone`, and each address's reverse-resolved name (`getent hosts`)
- [x] 1.3 Rewrite `install_default_cert_copy()` to install `<name>.crt`/`<name>.key` for all those names, preserving the `0644`/`0640` `root:lp` permissions; verify with a stubbed environment that the copies include `host.containers.internal.crt`, `podp.local.crt` and `<ipv6-literal>.crt`
- [x] 1.4 After rebuilding and redeploying on the podman host, verify from another host that `curl https://podp.local:631/` succeeds and `openssl s_client -connect <LAN address>:631 -servername podp.local` shows our certificate (SANs contain the advertised name), not `CN=host.containers.internal`

## 2. Correct the reasoning and documentation

- [x] 2.1 Correct the certificate comments in `entrypoint.sh`: CUPS 2.4 ignores `ServerCertificate`/`ServerKey`, selects the certificate by the connection's local address and mangles the name with `http_make_path()`
- [x] 2.2 Update the README certificate section to describe how CUPS selects the certificate and why the per-name copies exist
- [x] 2.3 Add a scenario to the `printserver/cups` spec covering the certificate served for the address a client connected to

## Workflow follow-up

- Archive this change (`/opsx-archive`) so the delta merges into `openspec/specs/printserver/cups/spec.md`.
- Commit the implementation together with the archived change using `jj`.