From f2d964eb6b2aaabd7f5b30141a27a51a16af9e30 Mon Sep 17 00:00:00 2001 From: maxfield Date: Sun, 9 Aug 2026 01:38:40 -0400 Subject: [PATCH] fix(http): load TLS CA roots from OTP public_key Moving hackney (and its certifi dep) out of the prod release left GunPool calling missing :certifi.cacerts/0, which crash-looped the app and caused edge 502s. Use :public_key.cacerts_get/0 like the rest of the TLS client stack. --- apps/elektrine/lib/elektrine/http/gun_pool.ex | 3 ++- deploy/caddy/netbird_allowlist.caddy | 2 +- deploy/docker/compose.full.yml | 6 ++++-- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/apps/elektrine/lib/elektrine/http/gun_pool.ex b/apps/elektrine/lib/elektrine/http/gun_pool.ex index 4f3a14b..3a6b836 100644 --- a/apps/elektrine/lib/elektrine/http/gun_pool.ex +++ b/apps/elektrine/lib/elektrine/http/gun_pool.ex @@ -322,7 +322,8 @@ defmodule Elektrine.HTTP.GunPool do tls_opts = [ verify: :verify_peer, - cacerts: :certifi.cacerts(), + # OTP system trust store (no certifi/hackney required in the release). + cacerts: :public_key.cacerts_get(), depth: 20, reuse_sessions: false, server_name_indication: sni, diff --git a/deploy/caddy/netbird_allowlist.caddy b/deploy/caddy/netbird_allowlist.caddy index bf8a6ec..915a40a 100644 --- a/deploy/caddy/netbird_allowlist.caddy +++ b/deploy/caddy/netbird_allowlist.caddy @@ -4,7 +4,7 @@ # Safe default (TEST-NET-1) fails closed until the first real sync. (admin_netbird_gate) { @admin_off_vpn { - host {$CADDY_ADMIN_HOST} + host {$CADDY_ADMIN_HOST:admin.example.com} not remote_ip 192.0.2.0/32 } respond @admin_off_vpn "Not Found" 404 diff --git a/deploy/docker/compose.full.yml b/deploy/docker/compose.full.yml index dd9e42d..29803bf 100644 --- a/deploy/docker/compose.full.yml +++ b/deploy/docker/compose.full.yml @@ -84,7 +84,8 @@ services: DATABASE_URL: ecto://elektrine:${DB_PASSWORD:?set DB_PASSWORD}@postgres/elektrine_prod POOL_SIZE: ${APP_POOL_SIZE:-10} PHX_HOST: ${PHX_HOST:-example.com} - CADDY_ADMIN_HOST: ${CADDY_ADMIN_HOST:-} + # Prefer env (production sets admin.). Inert default for self-hosters. + CADDY_ADMIN_HOST: ${CADDY_ADMIN_HOST:-admin.example.com} PHX_SERVER: "true" PORT: ${PORT:-8080} PHX_HTTP_IP: ${DOCKER_PHX_HTTP_IP:-0.0.0.0} @@ -425,7 +426,8 @@ services: environment: ACME_EMAIL: ${ACME_EMAIL:-admin@example.com} CADDY_ASK_URL: ${CADDY_ASK_URL:-http://app_proxy:8080/_edge/tls/v1/allow} - CADDY_ADMIN_HOST: ${CADDY_ADMIN_HOST:-} + # Prefer env (production sets admin.). Inert default for self-hosters. + CADDY_ADMIN_HOST: ${CADDY_ADMIN_HOST:-admin.example.com} CADDY_PROXY_PROTOCOL_ALLOWED_CIDRS: ${CADDY_PROXY_PROTOCOL_ALLOWED_CIDRS:-192.0.2.0/32} # NETBIRD_ALLOWED_CIDRS kept for Phoenix / docs; Caddy reads literal CIDRs # from the netbird_allowlist.caddy snippet (synced + caddy reload).