feat: custom ca certificate script #2837
Conversation
WalkthroughTwo identical shell scripts are introduced for container initialization that handle custom CA certificate setup. Each script enables strict mode, reads the CUSTOM_CA_CERT_PATH environment variable, logs certificate status, conditionally updates system certificates, and executes a provided command. Changes
Sequence DiagramsequenceDiagram
participant Container as Container Startup
participant Script as init-custom-ca-certificates.sh
participant System as System CA Store
participant Command as Provided Command
Container->>Script: Execute with environment & args
Script->>Script: Enable strict mode (set -e)
Script->>Script: Read CUSTOM_CA_CERT_PATH → CERT_PATH
Script->>Script: Log: "Initializing custom CA certificates..."
alt CERT_PATH is set and file exists
Script->>System: Call update-ca-certificates
System-->>Script: Certificate updated
Script->>Script: Log: Certificate path
else Certificate not found or path empty
Script->>Script: Log: "No custom CA certificate found"
end
Script->>Command: exec "$@"
Command-->>Container: Execute user command
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
enterprise/config/init-custom-ca-certificates.sh (1)
7-9: Verify expected behavior whenupdate-ca-certificatesfails.(See same concern raised in
config/init-custom-ca-certificates.sh– applies equally here.)If
update-ca-certificatesfails (line 9), theset -eon line 1 will exit the script, preventing the service from starting (line 14 never executes). Confirm whether this is the intended behavior.
🧹 Nitpick comments (1)
enterprise/config/init-custom-ca-certificates.sh (1)
1-14: Consolidate duplicate scripts to reduce maintenance burden.This script is identical to
config/init-custom-ca-certificates.sh. Maintaining two copies violates the DRY principle and creates a burden for future changes.Consider one of these approaches:
Use a symlink (if both paths need to reference the same file):
ln -s ../config/init-custom-ca-certificates.sh enterprise/config/init-custom-ca-certificates.shMove to shared location and update Docker Compose configurations to reference a single canonical copy.
Use Docker COPY with context to include only one script copy in images.
If the enterprise and community versions must genuinely differ in the future, document this intentionally and add comments explaining why they diverge.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
config/init-custom-ca-certificates.sh(1 hunks)enterprise/config/init-custom-ca-certificates.sh(1 hunks)
🔇 Additional comments (3)
config/init-custom-ca-certificates.sh (3)
1-3: Proper initialization and error handling setup.Strict mode and environment variable handling are appropriate for this initialization script.
7-9: Verify expected behavior whenupdate-ca-certificatesfails.The conditional logic is sound, but if
update-ca-certificatesfails (line 9), theset -eon line 1 will exit the script, preventing the service from starting (line 14 never executes). Confirm whether this is the intended behavior—should certificate update failure halt the container startup, or should the service proceed despite the failure?
14-14: Proper shell replacement withexec.Using
exec "$@"correctly replaces the shell process with the provided command, enabling proper signal handling and process inheritance.
Added a custom ca certificate script in config/init-custom-ca-certificates.sh and enterprise/config/init-custom-ca-certificates.sh to explain the user how the mailer can work while having a local ca-certificate.
git book extract that is currently in review by @Mohamed-Hacene :
Add automatically your local CA-certificate
An issue you may encounter when setting up your mailer is that your local CA certificates might not be included inside your Docker container. This could cause problems when sending emails.
To address this, we provide a script located at config/init-custom-ca-certificates.sh and enterprise/config/init-custom-ca-certificates.sh.
You need to use this script with your Docker Compose setup by adding the following lines to the huey service:
This environment variable :
This volumes (replace /your/ca-certificate/path/example_CA.crt by the pass and the name of your ca-certificate) :
This entrypoint :
entrypoint:
/docker-entrypoint-init.d/init-custom-ca-certificates.sh &&
poetry run python manage.py run_huey -w 2 --scheduler-interval 60
Summary by CodeRabbit