Promote v0.1.1 to main #4

Merged
binjovi-bot merged 1 commit from trunk into main 2026-09-14 13:42:43 +00:00
Collaborator
No description provided.
fix(outline): stop the CA bundle being read as a server certificate
Some checks failed
binjovi/ci Binjovi will not build this: its base branch must be trunk. Retarget the pull request.
bd79a32d2c
Outline will not boot:

    Environment configuration is invalid, please check the following:
    - SSL_CERT cannot be used without SSL_KEY.

Nothing here sets SSL_CERT. The cluster injects
SSL_CERT_FILE=/etc/ssl/cluster-trust/ca-bundle.crt into every pod, which
to OpenSSL means "the trust store is here" -- which certificates to
BELIEVE. Outline reads its environment through a Docker-secrets proxy
(server/utils/environment.ts): reading NAME when it is `undefined` returns
the contents of the file named by NAME_FILE. So Outline loaded the cluster
CA bundle and concluded the operator had supplied a TLS SERVER certificate
to terminate with. There is no SSL_KEY to go with it, and
@CannotUseWithout("SSL_KEY") ends the process before it serves.

Two conventions, one name. The proxy falls back only when the value is
strictly `undefined`, so declaring SSL_CERT at all -- even empty -- stops
the fallback, and Outline's own toOptionalString("") turns it back into
`undefined` for validation. Node still trusts the bundle through
NODE_EXTRA_CA_CERTS, the variable Node actually reads; SSL_CERT_FILE was
never doing that job here.

Any other application in this cluster that implements the `_FILE`
convention meets the same collision, so the reason is written down in both
the manifest and the README rather than left as an empty value someone
will tidy away.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/outline!4
No description provided.