From 3609e2c4c6bf48e73d77674264ebefc738fc0ea1 Mon Sep 17 00:00:00 2001 From: Tobias Eggert Date: Sun, 11 Oct 2026 21:20:57 +0200 Subject: [PATCH] notify-push: trust the CAs from NEXTCLOUD_TRUSTED_CACERTS_DIR The push server reaches Nextcloud at its public URL. Behind a reverse proxy that terminates TLS with a private CA, it rejects the certificate (UnknownIssuer) and the self-test fails at "push server can connect to the Nextcloud server", so no client can authenticate. Mount the user-provided CA directory into the notify-push container as the Nextcloud and Talk containers already do. The container is read-only, so start.sh builds a bundle from the system store and the mounted certificates in /tmp (now a tmpfs) and points the TLS stack at it via SSL_CERT_FILE, the same way the Talk container does. Assisted-by: ClaudeCode:claude-fable-5-1 Signed-off-by: Tobias Eggert --- Containers/notify-push/start.sh | 18 ++++++++++++++++++ php/containers.json | 8 ++++++++ readme.md | 2 +- 3 files changed, 27 insertions(+), 1 deletion(-) diff --git a/Containers/notify-push/start.sh b/Containers/notify-push/start.sh index aa0aae4eb23..afe6b6567de 100644 --- a/Containers/notify-push/start.sh +++ b/Containers/notify-push/start.sh @@ -51,6 +51,24 @@ if grep -q "1" /sys/module/ipv6/parameters/disable \ fi export BIND +# Trust additional CA certificates, if the user provided NEXTCLOUD_TRUSTED_CACERTS_DIR +# The container is read-only, so we build a custom bundle in /tmp (tmpfs) and +# point the push server's TLS stack to it via SSL_CERT_FILE. +if mountpoint -q /usr/local/share/ca-certificates; then + echo "Trusting additional CA certificates..." + set -x + cp /etc/ssl/certs/ca-certificates.crt /tmp/ca-certificates.crt + for cert in /usr/local/share/ca-certificates/*; do + if [ -f "$cert" ]; then + cat "$cert" >> /tmp/ca-certificates.crt + fi + done + export SSL_CERT_FILE=/tmp/ca-certificates.crt + if [ "$AIO_LOG_LEVEL" != 'debug' ]; then + set +x + fi +fi + echo "notify-push was started" diff --git a/php/containers.json b/php/containers.json index d0da8ea8393..3b3def48055 100644 --- a/php/containers.json +++ b/php/containers.json @@ -315,6 +315,11 @@ "source": "nextcloud_aio_nextcloud", "destination": "/var/www/html", "writeable": false + }, + { + "source": "%NEXTCLOUD_TRUSTED_CACERTS_DIR%", + "destination": "/usr/local/share/ca-certificates", + "writeable": false } ], "environment": [ @@ -324,6 +329,9 @@ ], "restart": "unless-stopped", "read_only": true, + "tmpfs": [ + "/tmp" + ], "cap_drop": [ "NET_RAW" ] diff --git a/readme.md b/readme.md index affd68b23dc..642a8cd6618 100644 --- a/readme.md +++ b/readme.md @@ -726,7 +726,7 @@ In certain situations you might want to keep Nextcloud apps that are disabled in For some applications it might be necessary to establish a secure connection to another host/server which is using a certificate issued by a Certification Authority that is not trusted out of the box. An example could be configuring LDAPS against a domain controller (Active Directory or Samba-based) of an organization. -You can make the Nextcloud container trust any Certification Authority by providing the environmental variable `NEXTCLOUD_TRUSTED_CACERTS_DIR` to the docker run command of the mastercontainer (but before the last line `ghcr.io/nextcloud-releases/all-in-one:latest`! If it was started already, you will need to stop the mastercontainer, remove it (no data will be lost) and recreate it using the docker run command that you initially used). The value of the variables should be set to the absolute paths of the directory on the host, which contains one or more Certification Authorities certificates. You should use X.509 certificates, Base64 encoded. (Other formats may work but have not been tested!) All the certificates in the directory will be trusted. +You can make the Nextcloud, Talk and Notify Push containers trust any Certification Authority by providing the environmental variable `NEXTCLOUD_TRUSTED_CACERTS_DIR` to the docker run command of the mastercontainer (but before the last line `ghcr.io/nextcloud-releases/all-in-one:latest`! If it was started already, you will need to stop the mastercontainer, remove it (no data will be lost) and recreate it using the docker run command that you initially used). The value of the variables should be set to the absolute paths of the directory on the host, which contains one or more Certification Authorities certificates. You should use X.509 certificates, Base64 encoded. (Other formats may work but have not been tested!) All the certificates in the directory will be trusted. When using `docker run`, the environmental variable can be set with `--env NEXTCLOUD_TRUSTED_CACERTS_DIR=/path/to/my/cacerts`.