From bc594a36ef2d80c62771ae14d34d73603d82d9a8 Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 15 Aug 2026 21:58:40 +0200 Subject: [PATCH] fix(hive-forge): give the SSO-source unit the same TLS trust as forgejo Registering the OIDC login source makes an outbound HTTPS call - the CLI fetches /.well-known/openid-configuration to validate the provider before writing the row. That URL is a swarm service name served under the swarm CA, which the default system store has never heard of. SSL_CERT_FILE was set on forgejo.service and not on forgejo-sso-source.service, so the web service trusted the chain and the registration one-shot did not. Same binary, same host, different unit. The result was a 100% reproducible failure that no restart could fix: nothing about restarting a unit gives it an environment variable it never had. Every recorded run since the feature landed has failed with x509: certificate signed by unknown authority. The trust belongs to every process that makes the call, not to the service that happens to be the obvious consumer. --- nix/host-modules/hive-forge/default.nix | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix index 33d096f2..9fce8702 100644 --- a/nix/host-modules/hive-forge/default.nix +++ b/nix/host-modules/hive-forge/default.nix @@ -849,7 +849,24 @@ in }; # `FORGEJO_CUSTOM` (not `GITEA_CUSTOM` — forgejo renamed it) # is how the CLI finds the app.ini upstream's module wrote. - environment.FORGEJO_CUSTOM = "/var/lib/forgejo/custom"; + # + # `SSL_CERT_FILE` for the same reason `forgejo.service` has it, + # and it was missing here: registering the login source makes an + # **outbound HTTPS call** — the CLI fetches + # `/.well-known/openid-configuration` to validate the + # provider before writing the row. That URL is a swarm service + # name served under the swarm CA, which the default system store + # has never heard of, so without this the unit fails every single + # time with `x509: certificate signed by unknown authority` and no + # restart can help it. + # + # The trust belongs to every process that makes the call, not to + # the service that happens to be the obvious consumer. Same + # binary, same host, different unit — and only one of them had it. + environment = { + FORGEJO_CUSTOM = "/var/lib/forgejo/custom"; + } + // lib.optionalAttrs useSelfSigned { SSL_CERT_FILE = forgeCaBundle; }; path = [ cfg.package pkgs.coreutils