Trusting custom CA

[markalex2209]

Please consider adding guidance to the docs about trusting custom CA.
This is useful for for those of us who uses private CA at home, and lack of trusts affects ability to configure OIDC properly.

I described how I achieved this in comments to booklore-app/booklore#780, though I'm not sure if it's the best approach in general.

[luehm]

Chiming in here with a current solution implemented by the Docker base image: booklore-app/booklore#780 (comment)

Also sharing related information on how to install a custom CA on Kindle devices (which shares its CA store with KOreader): https://www.amazonforum.com/s/question/0D56Q0000DfTIBESQ4/where-to-place-private-ca-certificate

[c-prompt]

Am I understanding this correctly? booklore is unable to support https: except by using a reverse proxy (which I have no intent on using as I use a self-signed certificate for all my other apps which all remain local)?

Using @luehm's booklore-app/booklore#780 (comment) did seem to load the cert according to the log, but I tried going to https://my.ip.add.ress:6060 with the following in my dockge which doesn't work (potentially because I need to define a separate HTTPS port somewhere?):

.yaml:

services:
  booklore:
    image: booklore/booklore:latest
    # Alternative: Use GitHub Container Registry
    # image: ghcr.io/booklore-app/booklore:latest
    container_name: booklore
    environment:
      - USER_ID=${APP_USER_ID}
      - GROUP_ID=${APP_GROUP_ID}
      - TZ=${TZ}
      - DATABASE_URL=${DATABASE_URL}
      - DATABASE_USERNAME=${DB_USER}
      - DATABASE_PASSWORD=${DB_PASSWORD}
      - BOOKLORE_PORT=${BOOKLORE_PORT}
      - USE_SYSTEM_CA_CERTS=true
    depends_on:
      mariadb:
        condition: service_healthy
    ports:
      - ${BOOKLORE_PORT}:${BOOKLORE_PORT}
    volumes:
      - /mnt/pool/Applications/booklore/data:/app/data # Application data (settings, metadata, cache, etc.). Persist this folder to retain your library state across container restarts.
      - /mnt/pool/Media/Books/Library:/books # Primary book library folder. Mount your collection here so BookLore can access and organize your books.
      - /mnt/pool/Applications/booklore/data:/bookdrop # BookDrop folder. Files placed here are automatically detected and prepared for import.
      - /mnt/pool/Media/certificates/server.crt:/certificates/root-ca.crt
    healthcheck:
      test: wget -q -O - http://localhost:${BOOKLORE_PORT}/api/v1/healthcheck
      interval: 60s
      retries: 5
      start_period: 60s
      timeout: 10s
    restart: unless-stopped
  mariadb:
    image: lscr.io/linuxserver/mariadb:11.4.5
    container_name: mariadb
    environment:
      - PUID=${DB_USER_ID}
      - PGID=${DB_GROUP_ID}
      - TZ=${TZ}
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      - MYSQL_USER=${DB_USER}
      - MYSQL_PASSWORD=${DB_PASSWORD}
    volumes:
      - ./mariadbconfig:/config
    ports:
      - 3306:3306
    restart: unless-stopped
    healthcheck:
      test:
        - CMD
        - mariadb-admin
        - ping
        - -h
        - localhost
      interval: 5s
      timeout: 5s
      retries: 10
  phpmyadmin:
    image: phpmyadmin:latest
    container_name: phpMyAdmin_booklore
    restart: unless-stopped
    environment:
      - PMA_PORT=3306
      - PMA_HOST=mariadb # Name of the MariaDB container
      - PMA_PMADB=true
    ports:
      - 2500:80

.env:

# 🎯 BookLore Application Settings
APP_USER_ID=568
APP_GROUP_ID=568
TZ=America/New_York
BOOKLORE_PORT=6060

# 🗄️ Database Connection (BookLore)
DATABASE_URL=jdbc:mariadb://mariadb:3306/booklore
DB_USER=booklore
DB_PASSWORD=guess

# 🔧 MariaDB Container Settings
DB_USER_ID=568
DB_GROUP_ID=568
MYSQL_ROOT_PASSWORD=another_guess
MYSQL_DATABASE=booklore

[markalex2209]

@c-prompt, this is a wrong avenue for your question. Issue here is about documenting the way how booklare can be made to trust custom CAs, when booklore connects somewhere, not when you connect to booklore.

Also, this is a docs repo.

[c-prompt]

@c-prompt, this is a wrong avenue for your question. Issue here is about documenting the way how booklare can be made to trust custom CAs, when booklore connects somewhere, not when you connect to booklore.

Also, this is a docs repo.

Mea culpa. Shame on me for not noticing, and thanks.