Chromium/Brave `.fips` Access in `ai`

Current proven behavior

.fips works in Firefox (system resolver path).
.fips works in agent-browser only when hostname is pinned in /etc/hosts.
Raw FIPS network path is healthy in ai:
- dig resolves npub .fips
- ping -6 to server FIPS IPv6 works
- curl -6 to npub .fips returns HTTP 200

Why Chromium-family is failing by default

Chromium/Brave path still returns name-resolution errors for .fips in this environment, even when system resolver succeeds. In practice here, forcing host mapping is the reliable path.

Reliable workaround (now)

1) Resolve npub hostname to IPv6 and pin in hosts

HOST='npub1crpldvy49ef8z34wlacwujnfudy4nd7k96aqdx5wgn6ckztz7z8q9t59ud.fips'
IP=$(dig +short AAAA "$HOST" | head -1)
echo "$IP $HOST" | sudo tee -a /etc/hosts

2) Validate resolution and HTTP

getent ahosts "$HOST"
curl -6 -I "http://$HOST/"

3) Launch in Chromium tooling

AGENT_BROWSER_HEADED=1 agent-browser open "http://$HOST/"

Maintenance note

If the target FIPS IPv6 changes, update /etc/hosts entry by re-running the resolve-and-pin step.

Optional cleanup

To remove the pinned line later:

sudo sed -i '/npub1crpldvy49ef8z34wlacwujnfudy4nd7k96aqdx5wgn6ckztz7z8q9t59ud\.fips/d' /etc/hosts

Deferred work (later)

For sys-fips ProxyVM mode, IPv6 forwarding/NAT and nftables flow still need a clean persistent design before re-enabling that path as default.

1.5 KiB Raw Permalink Blame History

Chromium/Brave .fips Access in ai