elektrine/elektrine
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(http): load TLS CA roots from OTP public_key
Some checks failed
Deploy Docker Images / Build, push, and deploy (push) Has been cancelled
Details

Browse source 
Moving hackney (and its certifi dep) out of the prod release left
GunPool calling missing :certifi.cacerts/0, which crash-looped the app
and caused edge 502s. Use :public_key.cacerts_get/0 like the rest of
the TLS client stack.
This commit is contained in:
maxfield 2026-08-09 01:38:40 -04:00
parent f14db3a229
commit f2d964eb6b
3 changed files with 7 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
apps/elektrine/lib/elektrine/http/gun_pool.ex
View file

@ -322,7 +322,8 @@ defmodule Elektrine.HTTP.GunPool do
tls_opts = [ tls_opts = [
verify: :verify_peer, verify: :verify_peer,
cacerts: :certifi.cacerts(), # OTP system trust store (no certifi/hackney required in the release).
cacerts: :public_key.cacerts_get(),
depth: 20, depth: 20,
reuse_sessions: false, reuse_sessions: false,
server_name_indication: sni, server_name_indication: sni,

2
deploy/caddy/netbird_allowlist.caddy
View file

@ -4,7 +4,7 @@
# Safe default (TEST-NET-1) fails closed until the first real sync. # Safe default (TEST-NET-1) fails closed until the first real sync.
(admin_netbird_gate) { (admin_netbird_gate) {
@admin_off_vpn { @admin_off_vpn {
host {$CADDY_ADMIN_HOST} host {$CADDY_ADMIN_HOST:admin.example.com}
not remote_ip 192.0.2.0/32 not remote_ip 192.0.2.0/32
} }
respond @admin_off_vpn "Not Found" 404 respond @admin_off_vpn "Not Found" 404

6
deploy/docker/compose.full.yml
View file

@ -84,7 +84,8 @@ services:
DATABASE_URL: ecto://elektrine:${DB_PASSWORD:?set DB_PASSWORD}@postgres/elektrine_prod DATABASE_URL: ecto://elektrine:${DB_PASSWORD:?set DB_PASSWORD}@postgres/elektrine_prod
POOL_SIZE: ${APP_POOL_SIZE:-10} POOL_SIZE: ${APP_POOL_SIZE:-10}
PHX_HOST: ${PHX_HOST:-example.com} PHX_HOST: ${PHX_HOST:-example.com}
CADDY_ADMIN_HOST: ${CADDY_ADMIN_HOST:-} # Prefer env (production sets admin.<your-domain>). Inert default for self-hosters.
CADDY_ADMIN_HOST: ${CADDY_ADMIN_HOST:-admin.example.com}
PHX_SERVER: "true" PHX_SERVER: "true"
PORT: ${PORT:-8080} PORT: ${PORT:-8080}
PHX_HTTP_IP: ${DOCKER_PHX_HTTP_IP:-0.0.0.0} PHX_HTTP_IP: ${DOCKER_PHX_HTTP_IP:-0.0.0.0}
@ -425,7 +426,8 @@ services:
environment: environment:
ACME_EMAIL: ${ACME_EMAIL:-admin@example.com} ACME_EMAIL: ${ACME_EMAIL:-admin@example.com}
CADDY_ASK_URL: ${CADDY_ASK_URL:-http://app_proxy:8080/_edge/tls/v1/allow} CADDY_ASK_URL: ${CADDY_ASK_URL:-http://app_proxy:8080/_edge/tls/v1/allow}
CADDY_ADMIN_HOST: ${CADDY_ADMIN_HOST:-} # Prefer env (production sets admin.<your-domain>). Inert default for self-hosters.
CADDY_ADMIN_HOST: ${CADDY_ADMIN_HOST:-admin.example.com}
CADDY_PROXY_PROTOCOL_ALLOWED_CIDRS: ${CADDY_PROXY_PROTOCOL_ALLOWED_CIDRS:-192.0.2.0/32} CADDY_PROXY_PROTOCOL_ALLOWED_CIDRS: ${CADDY_PROXY_PROTOCOL_ALLOWED_CIDRS:-192.0.2.0/32}
# NETBIRD_ALLOWED_CIDRS kept for Phoenix / docs; Caddy reads literal CIDRs # NETBIRD_ALLOWED_CIDRS kept for Phoenix / docs; Caddy reads literal CIDRs
# from the netbird_allowlist.caddy snippet (synced + caddy reload). # from the netbird_allowlist.caddy snippet (synced + caddy reload).