michnovka 7cd2ac1bbd feat(talk): trust custom CA certificates via NEXTCLOUD_TRUSTED_CACERTS_DIR ...

When NEXTCLOUD_TRUSTED_CACERTS_DIR is set on the mastercontainer,
the custom CA certificates are now also mounted into the Talk container.

Since the Talk container runs with a read-only root filesystem,
update-ca-certificates cannot be used. Instead, the startup script
copies the system CA bundle to /tmp (tmpfs), appends any custom
certificates from /usr/local/share/ca-certificates/, and sets
SSL_CERT_FILE to point Go's TLS stack at the extended bundle.

This allows the signaling server to verify TLS connections to
Nextcloud instances that use private/internal CA certificates,
without requiring skipverify=true.

Signed-off-by: Tomas <16553087+michnovka@users.noreply.github.com>

2026-03-03 00:11:27 +01:00

25 KiB

Raw Blame History

View Raw