ss-tools

Author SHA1 Message Date

Author	SHA1	Message	Date
busya	1e61f098bd	fix(docker): add missing certs.sh COPY to backend/all-in-one Dockerfile Backend entrypoint sources certs.sh for CA certificate installation, but the file was never copied into the Docker image — causing container crash loop on startup (regression in `8fd23f7e`). Changes: - docker/backend.Dockerfile, docker/all-in-one.Dockerfile: COPY certs.sh - docker/backend.entrypoint.sh: remove dead install_llm_ca_certs, install_certificates (replaced by docker/certs.sh); update @INVARIANT - backend/src/core/ssl.py: fix describe_context() to report actual system cert count (SSLContext.capath attr does not exist in Python 3) - __tests__: rewrite stale tests asserting LLM_SSL_VERIFY=false → verify=False; behaviour is permanently removed — always CERT_REQUIRED - backend/tests/integration/test_backend_container.py [new]: 5 tests verifying certs.sh presence, sourceability, and full-stack smoke (testcontainers PG → entrypoint → migrations → health) - conftest.py: restore health-wait loop and fixtures in superset_container - ADR-0009, README.md, scripts, .env: align docs with centralized SSL	2026-07-07 00:58:41 +03:00
busya	8fd23f7ea1	refactor(ssl): centralize SSL trust management, remove LLM_SSL_VERIFY Centralized SSL via one contract: CERTS_PATH=/opt/certs mounted into all containers. Backend: - NEW: backend/src/core/ssl.py — system_ssl_context(), httpx_verify(), cert_dir_inventory() - LLMClient._get_ssl_verify() → delegates to core.ssl - _llm_async_http._get_verify() → delegates to core.ssl - Removed LLM_SSL_VERIFY env reading from all runtime code Docker: - NEW: docker/certs.sh — shared cert installer (PEM/DER/cer to .crt conversion, update-ca-certificates, hash symlinks, NSS import) - NEW: docker/agent.entrypoint.sh — agent entrypoint with cert installation - backend.entrypoint.sh → uses certs.sh instead of install_llm_ca_certs - Dockerfile.agent → adds ca-certificates, openssl, entrypoint Compose: - Removed LLM_CA_CERT_URLS and LLM_SSL_VERIFY from all compose files - Added CERTS_PATH volume mount to agent (dev + enterprise) - Added certs volume mount to backend/agent in dev compose Env examples: - Removed LLM_SSL_VERIFY, LLM_CA_CERT_URLS from .env.example, .env.enterprise-clean.example, .env.current.example, .env.master.example, backend/.env.example - Enhanced CERTS_PATH comments with accepted formats Diagnostics: - diag_container.py: removed LLM_* checks, added CERTS_PATH inventory, uses core.ssl for context creation Tests: - Updated test_llm_analysis_service, test_llm_async_http, test_client_headers to verify centralized ssl context (no env disable) - 4/4 SSL tests pass	2026-07-06 21:00:28 +03:00

busya

1e61f098bd

fix(docker): add missing certs.sh COPY to backend/all-in-one Dockerfile

Backend entrypoint sources certs.sh for CA certificate installation,
but the file was never copied into the Docker image — causing
container crash loop on startup (regression in 8fd23f7e).

Changes:
- docker/backend.Dockerfile, docker/all-in-one.Dockerfile: COPY certs.sh
- docker/backend.entrypoint.sh: remove dead install_llm_ca_certs,
  install_certificates (replaced by docker/certs.sh); update @INVARIANT
- backend/src/core/ssl.py: fix describe_context() to report actual
  system cert count (SSLContext.capath attr does not exist in Python 3)
- __tests__: rewrite stale tests asserting LLM_SSL_VERIFY=false →
  verify=False; behaviour is permanently removed — always CERT_REQUIRED
- backend/tests/integration/test_backend_container.py [new]: 5 tests
  verifying certs.sh presence, sourceability, and full-stack smoke
  (testcontainers PG → entrypoint → migrations → health)
- conftest.py: restore health-wait loop and fixtures in superset_container
- ADR-0009, README.md, scripts, .env: align docs with centralized SSL

2026-07-07 00:58:41 +03:00

busya

8fd23f7ea1

refactor(ssl): centralize SSL trust management, remove LLM_SSL_VERIFY

Centralized SSL via one contract: CERTS_PATH=/opt/certs mounted into all containers.

Backend:
  - NEW: backend/src/core/ssl.py — system_ssl_context(), httpx_verify(),
    cert_dir_inventory()
  - LLMClient._get_ssl_verify() → delegates to core.ssl
  - _llm_async_http._get_verify() → delegates to core.ssl
  - Removed LLM_SSL_VERIFY env reading from all runtime code

Docker:
  - NEW: docker/certs.sh — shared cert installer (PEM/DER/cer to .crt conversion,
    update-ca-certificates, hash symlinks, NSS import)
  - NEW: docker/agent.entrypoint.sh — agent entrypoint with cert installation
  - backend.entrypoint.sh → uses certs.sh instead of install_llm_ca_certs
  - Dockerfile.agent → adds ca-certificates, openssl, entrypoint

Compose:
  - Removed LLM_CA_CERT_URLS and LLM_SSL_VERIFY from all compose files
  - Added CERTS_PATH volume mount to agent (dev + enterprise)
  - Added certs volume mount to backend/agent in dev compose

Env examples:
  - Removed LLM_SSL_VERIFY, LLM_CA_CERT_URLS from .env.example,
    .env.enterprise-clean.example, .env.current.example, .env.master.example,
    backend/.env.example
  - Enhanced CERTS_PATH comments with accepted formats

Diagnostics:
  - diag_container.py: removed LLM_* checks, added CERTS_PATH inventory,
    uses core.ssl for context creation

Tests:
  - Updated test_llm_analysis_service, test_llm_async_http,
    test_client_headers to verify centralized ssl context (no env disable)
  - 4/4 SSL tests pass

2026-07-06 21:00:28 +03:00

2 Commits