feat: support custom CA certificates from the data volume by tahodev · Pull Request #4841 · WeblateOrg/docker

tahodev · 2026-10-22T16:08:46Z

What

Adds support for custom CA certificates without rebuilding the image: any *.crt files placed in /app/data/ssl/ca-certificates are combined with the system CA bundle at container start, and the runtime is pointed at the combined bundle.

Fixes #1525

Design

Follows the maintainer's suggested direction on the issue: a fixed location under /app/data/ssl, the same data-volume area already used for SAML certificates (saml.crt / saml.key). A dedicated ca-certificates subdirectory keeps the SAML files from being swept into the bundle.
The container runs as an unprivileged user (USER 1000), so the system trust store is not writable at runtime. Instead of installing into it, the start script generates a fresh combined bundle (system + custom CAs) at /tmp/custom-ca-certificates.crt on every start and exports REQUESTS_CA_BUNDLE, SSL_CERT_FILE, CURL_CA_BUNDLE and GIT_SSL_CAINFO pointing at it, so Python (requests), OpenSSL, libcurl and git all honor the custom certificates.
Rebuilding the bundle from scratch on each start means a certificate removed from the data volume is never left behind in a stale store.
No-op when the directory is absent or empty.

Testing

New tests/test-custom-ca-certificates (wired into tests/run) extracts the function verbatim from start and covers: missing directory (no-op), two certificates (combined bundle content, exports, file mode) and empty directory (no-op). 7/7 passing locally; shellcheck and shfmt clean.
No Docker daemon in my environment, so the image build and the CI script tests are left to the repo's workflows.

Notes

Docs for the docker environment live in the weblate repo (docs/admin/install/docker.rst); happy to follow up with a docs PR there if this lands.
Developed with AI assistance (various models); I verified the changes with the test suite above.

nijel · 2026-10-22T16:53:34Z

@codex review

chatgpt-codex-connector · 2026-10-22T16:54:09Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T08:38:52.464816Z	`a0e038a`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e705938d89

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Any *.crt files placed in /app/data/ssl/ca-certificates are combined with the system CA bundle into a runtime-writable bundle at container start, and Python (requests), OpenSSL, libcurl and git are pointed at it via REQUESTS_CA_BUNDLE, SSL_CERT_FILE, CURL_CA_BUNDLE and GIT_SSL_CAINFO. Generating a fresh bundle (instead of installing into the system trust store) works with the image's unprivileged runtime user, where /usr/local/share/ca-certificates and /etc/ssl/certs are not writable, and it is rebuilt from scratch on every start so removed certificates never linger. No-op when the directory is absent or empty. Fixes WeblateOrg#1525

tahodev · 2026-10-22T17:06:49Z

Thanks for the review. Reworked in 365062f:

Runtime UID (P1): the start script no longer installs into the system trust store. It generates a combined bundle (system + custom CAs) in a runtime-writable location (/tmp/custom-ca-certificates.crt) and exports REQUESTS_CA_BUNDLE, SSL_CERT_FILE, CURL_CA_BUNDLE and GIT_SSL_CAINFO, so the feature works with the image's unprivileged USER 1000.
Stale CAs (P1): the bundle is rebuilt from scratch on every start, so a certificate removed from the data volume cannot linger after a restart.
Test environment (P2): the test subprocess now strips inherited REQUESTS_CA_BUNDLE/SSL_CERT_FILE/CURL_CA_BUNDLE/GIT_SSL_CAINFO before asserting.

Also reworded the comment that tripped the pre-commit spell check.

nijel · 2026-10-23T06:41:11Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 365062f925

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cat-ing the system bundle and user .crt files together glued PEM blocks whenever an input lacked a trailing newline (END CERTIFICATE---BEGIN CERTIFICATE---), producing a bundle that OpenSSL/Python reject. Write each input followed by an explicit newline instead. Extend the test with a no-trailing-newline case and verify the old and new behavior against openssl with real self-signed certificates (old: "error reading the file"; new: bundle parses).

for more information, see https://pre-commit.ci

tahodev · 2026-10-23T07:05:54Z

Fixed in 3f00080. Good catch — I reproduced it with real self-signed certificates before changing anything: a .crt without a trailing newline glues -----END CERTIFICATE----- onto the next -----BEGIN CERTIFICATE-----, and openssl crl2pkcs7 -nocrl -certfile then fails with "error reading the file" on the combined bundle.

The bundle is now built with an explicit newline after each input (system bundle and every .crt), so PEM blocks can never glue. tests/test-custom-ca-certificates gains a no-trailing-newline case (all 10 checks pass locally), and the openssl repro above passes on the new bundle.

nijel · 2026-10-23T07:20:24Z

I think this looks good to merge now, but let's do one more AI review round. Can you please create a documentation PR against https://github.com/WeblateOrg/weblate/?

@codex review

tahodev · 2026-10-23T08:06:41Z

Documentation PR is up: WeblateOrg/weblate#22322. It adds a "Trusting custom CA certificates" section to the Docker install docs (placed right after "Using own SSL certificates"), covering the ssl/ca-certificates/ volume directory, the combined-bundle behavior on every start, and the .crt-only note.

nijel · 2026-10-23T08:31:52Z

@codex review

chatgpt-codex-connector · 2026-10-23T08:33:57Z

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Unknown error

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a0e038a3f2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-23T08:38:50Z

+    export REQUESTS_CA_BUNDLE="$CUSTOM_CA_BUNDLE"
+    export SSL_CERT_FILE="$CUSTOM_CA_BUNDLE"
+    export CURL_CA_BUNDLE="$CUSTOM_CA_BUNDLE"
+    export GIT_SSL_CAINFO="$CUSTOM_CA_BUNDLE"


Export the bundle through PGSSLROOTCERT

When POSTGRES_SSL_MODE is verify-ca or verify-full, the database-version check is enabled, and PostgreSQL is signed only by a CA mounted here, this export list does not configure libpq. The libpq environment-variable documentation states that PGSSLROOTCERT behaves like the sslrootcert parameter, whose documented default is ~/.postgresql/root.crt; SSL_CERT_FILE is not its CA setting. The psql invocation in check_postgres_version therefore rejects the server before startup despite the mounted CA, so export this bundle as PGSSLROOTCERT as well.

Useful? React with 👍 / 👎.

libpq does not honor SSL_CERT_FILE; psql looks up the CA through sslrootcert (default ~/.postgresql/root.crt). With POSTGRES_SSL_MODE set to verify-ca or verify-full and PostgreSQL signed only by a mounted custom CA, check_postgres_version would reject the server before startup. Point PGSSLROOTCERT at the combined bundle too.

tahodev · 2026-10-23T14:07:37Z

Fixed in 10518dc: PGSSLROOTCERT now points at the combined bundle alongside the other exports, so the check_postgres_version psql probe validates servers signed by a mounted custom CA when POSTGRES_SSL_MODE=verify-ca/verify-full. The export assertions in tests/test-custom-ca-certificates cover the new variable (all cases pass).

nijel · 2026-10-24T07:36:24Z

Scheduled for merge, thanks for your contribution!

…#22322) get_clean_env() scrubs the environment for repository operations, which dropped the custom CA configuration before it could reach Git. Pass the standard CA certificate variables through so that HTTPS Git remotes secured by a private CA work out of the box, and simplify the Docker custom CA documentation accordingly. Documents the container start script support for combining user-provided CA certificates in ssl/ca-certificates/ with the system CA bundle (WeblateOrg/docker#4841). Co-authored-by: Michal Čihař <michal@weblate.org>

nijel self-assigned this Oct 22, 2026

chatgpt-codex-connector Bot reviewed Oct 22, 2026

View reviewed changes

Comment thread start Outdated

Comment thread start

Comment thread tests/test-custom-ca-certificates Outdated

tahodev force-pushed the feat/custom-ca-certificates branch from e705938 to 365062f Compare October 22, 2026 17:05

tahodev changed the title ~~feat: install custom CA certificates from the data volume~~ feat: support custom CA certificates from the data volume Oct 22, 2026

chatgpt-codex-connector Bot reviewed Oct 23, 2026

View reviewed changes

Comment thread start Outdated

tahodev and others added 2 commits October 23, 2026 16:05

[pre-commit.ci] auto fixes from pre-commit.com hooks

a0e038a

for more information, see https://pre-commit.ci

tahodev mentioned this pull request Oct 23, 2026

Trust custom CA certificates for outgoing connections in Docker WeblateOrg/weblate#22322

Merged

chatgpt-codex-connector Bot reviewed Oct 23, 2026

View reviewed changes

tahodev force-pushed the feat/custom-ca-certificates branch from 79cb8a4 to 10518dc Compare October 23, 2026 14:06

nijel enabled auto-merge (squash) October 24, 2026 07:36

nijel merged commit ce1e455 into WeblateOrg:main Oct 24, 2026
52 checks passed

Conversation

tahodev commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Design

Testing

Notes

Uh oh!

nijel commented Oct 22, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tahodev commented Oct 22, 2026

Uh oh!

nijel commented Oct 23, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

tahodev commented Oct 23, 2026

Uh oh!

nijel commented Oct 23, 2026

Uh oh!

tahodev commented Oct 23, 2026

Uh oh!

nijel commented Oct 23, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

tahodev commented Oct 23, 2026

Uh oh!

nijel commented Oct 24, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tahodev commented Oct 22, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 22, 2026 •

edited

Loading