[hlovdal]

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content.

AI Disclosure

Pure human work.

Description

Add an early call to update-ca-certificates so that if the user has added custom certificates they will be used by the containers pangolin-cli binary.

How to test?

Add a certificate file to docker-compose.yml matching the domain for the pangolin server, e.g. pangolin.example.com:

services:
  pangolin-site:
    ...
    extra_hosts:
      - "pangolin.example.com:10.1.1.10"
    environment:
      - PANGOLIN_ENDPOINT=https://pangolin.example.com
    volumes:
      - ./volumes/example.com.crt:/usr/local/share/ca-certificates/example.com.crt:ro

And with a certificate like volumes/example.com.crt

-----BEGIN CERTIFICATE-----
MIIDBjCCAe6gAwIBAgIUYkn5tBHK1KB6cK1pDSUK7N/obn4wDQYJKoZIhvcNAQEL
BQAwGDEWMBQGA1UEAwwNKi5leGFtcGxlLmNvbTAeFw0yNjEwMDQxOTQ1NDBaFw0y
NzEwMDQxOTQ1NDBaMBgxFjAUBgNVBAMMDSouZXhhbXBsZS5jb20wggEiMA0GCSqG
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCxcveWOTOCtHSEN7lu7Ni0+5AVxbonNfap
rPEw+5575V/5rCc6ZWGnNLa7eRnU20Qw6ntu+FJolqe/PJg6WSXvuH6pnejiSBGM
TE0I2hoSALUIZWU8xJzHdn5Pps6gi7tN27WZsd6g+t2oHMMp5/kOQSoCBJBLzJS+
OMlORkOtTBBsReWNg9xzF7Qzhg1cmBKLKDUInG3LF7611BNxM0TeGGzlk9b4WI1Q
HuJ2d2lCb/7NHet555AzLj6u49qqHXQIujSgIbblo/rrxAu6r21Zx1QhCZUKpJkQ
3cNxddG/jF8G6zq4wuoBKONxpP7Ha5bOQct47f5gDipHmCKg1EXfAgMBAAGjSDBG
MCUGA1UdEQQeMByCDSouZXhhbXBsZS5jb22CC2V4YW1wbGUuY29tMB0GA1UdDgQW
BBQZnfj4343G69Fz1b+IDJOdYHL68zANBgkqhkiG9w0BAQsFAAOCAQEAcpinq5zV
UY8MUh/kPLDG4FDeDfe8i7EGZ4uFl+YTjVWNE6wKAoqtsT6MxsDA9lcD+7UAwLaa
SCHH9qIOPT2G64tW/VSB9roqs/l1Ci6VIa/KWpTXszGih6hVPJbUdJXzahsFCC30
GWgeWIMLiTgstYwH4ofmcUOE6H6alT5fD9lMGv/NT9Hq3rRcAr3uHeV3lSsFIOEO
4msZ3/aL9cmzf4Lz80B0j85DKK8eisZgRDO0aMwjeKke2tvRdsuK3h7ONj1fAebe
FGiFmxWuHJbTG8iPzBebEiXBACqQC07jShEWqceyAD3rR4Baumx1Ep5ZhP8KSwLA
HlH40iGbpzA2wA==
-----END CERTIFICATE-----

$ openssl x509 -in volumes/example.com.crt -noout -text | grep DNS
                    DNS:*.example.com, DNS:example.com
$

Without the call to update-ca-certificates the pangolin-cli binary will fail to connect to pangolin and instead constantly complain:

pangolin-site  | ERROR: 2026/10/13 22:42:07 Failed to connect: failed to get token: failed to request new token: Post "https://pangolin.example.com/api/v1/auth/newt/get-token": tls: failed to verify certificate: x509: certificate signed by unknown authority. Retrying in 3s...
pangolin-site  | ERROR: 2026/10/13 22:42:10 Failed to connect: failed to get token: failed to request new token: Post "https://pangolin.example.com/api/v1/auth/newt/get-token": tls: failed to verify certificate: x509: certificate signed by unknown authority. Retrying in 3s...
pangolin-site  | ERROR: 2026/10/13 22:42:13 Failed to connect: failed to get token: failed to request new token: Post "https://pangolin.example.com/api/v1/auth/newt/get-token": tls: failed to verify certificate: x509: certificate signed by unknown authority. Retrying in 3s...
pangolin-site  | ERROR: 2026/10/13 22:42:16 Failed to connect: failed to get token: failed to request new token: Post "https://pangolin.example.com/api/v1/auth/newt/get-token": tls: failed to verify certificate: x509: certificate signed by unknown authority. Retrying in 3s...
pangolin-site  | ERROR: 2026/10/13 22:42:19 Failed to connect: failed to get token: failed to request new token: Post "https://pangolin.example.com/api/v1/auth/newt/get-token": tls: failed to verify certificate: x509: certificate signed by unknown authority. Retrying in 3s...
pangolin-site  | ERROR: 2026/10/13 22:42:22 Failed to connect: failed to get token: failed to request new token: Post "https://pangolin.example.com/api/v1/auth/newt/get-token": tls: failed to verify certificate: x509: certificate signed by unknown authority. Retrying in 3s...
pangolin-site  | ERROR: 2026/10/13 22:42:25 Failed to connect: failed to get token: failed to request new token: Post "https://pangolin.example.com/api/v1/auth/newt/get-token": tls: failed to verify certificate: x509: certificate signed by unknown authority. Retrying in 3s...
pangolin-site  | ERROR: 2026/10/13 22:42:28 Failed to connect: failed to get token: failed to request new token: Post "https://pangolin.example.com/api/v1/auth/newt/get-token": tls: failed to verify certificate: x509: certificate signed by unknown authority. Retrying in 3s...
pangolin-site  | ERROR: 2026/10/13 22:42:31 Failed to connect: failed to get token: failed to request new token: Post "https://pangolin.example.com/api/v1/auth/newt/get-token": tls: failed to verify certificate: x509: certificate signed by unknown authority. Retrying in 3s...

[oschwartz10612]

LGTM thanks for the human work 😄