fix: allow TLS with remote docker when using public CA #5123
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This provides a small fix that allows you to define docker hosts that you can connect with in three different ways: 1. Mutual TLS, docker host uses non-standard CA 2. Mutual TLS, docker host uses standard CA 3. No Authentication, docker host uses non-standard CA 4. No authentication, docker host uses standard CA In the previous implementation only condition 1 and 4 were allowed. This makes condition 2 and 3 possible. The logic is a little messy, but it works. DCO-1.1 Signed-off-by: Patrick Wagstrom <[email protected]>
I missed some of the `let` definitions for the ca, cert, and key when establishing the docker TLS connection. DCO-1.1 Signed-off-by: Patrick Wagstrom <[email protected]>
|
@louislam - looks like I got all of the checks to pass. Tagging you as per guidance in |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
https://github.com/louislam/uptime-kuma/blob/master/CONTRIBUTING.md#can-i-create-a-pull-request-for-uptime-kuma
Tick the checkbox if you understand [x]:
Description
While uptime-kuma allows monitoring or remote docker hosts, and it allows using TLS to secure those connections with mutual TLS, the code is only set up to allow mutual TLS if you're using you're using your own CA. If, instead, you're using a public CA that is part of the standard web of trust with mutual TLS certificates, it wouldn't allow for a TLS connection to the remote docker host. This fixes that.
This is a fix for an issue I was going to file, but was easier just to write the code to fix it.
More completely, there are four different combinations of CAs and mutual TLS that you need to consider:
Currently, uptime-kuma only supported condition 1 and 4. This adds support for condition 2 and 3 too.
Type of change
Please delete any options that are not relevant.
Checklist
Screenshots (if any)
N/A - server side change