starred/karakeep

Fork 0

mirror of https://github.com/karakeep-app/karakeep.git synced 2026-04-25 07:56:05 +03:00

[GH-ISSUE #500] Issues related to self-signed certificates #324

New issue

Closed

opened 2026-03-02 11:48:48 +03:00 by kerem · 5 comments

kerem commented

2026-03-02 11:48:48 +03:00

Owner

Originally created by @anselor on GitHub (Oct 6, 2024).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/500

I've run into a number of issues on my home LAN related to self-signed certificates. At a minimum these should be added to the documentation but, perhaps, may be desirable to have the defaults do something similar to this.

The node.js environment appears to have its own list of root CAs that is separate from the host environment it operates in.
To have node.js share the same list of root CAs as its host environment (on debian-based linux distros, at least), this environment variable needs to be added to the container:

NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt

In my specific case where I have self-hosted a certificate authority with a self-signed root cert in my LAN, I've registered this cert to the docker host environment and it just needs to be mapped into the hoard container's environment with this:

    volumes:
      - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro

Additionally, on the mobile app, it's unable to connect even when the root CA has been added to the phone's trusted store.

Originally created by @anselor on GitHub (Oct 6, 2024). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/500 I've run into a number of issues on my home LAN related to self-signed certificates. At a minimum these should be added to the documentation but, perhaps, may be desirable to have the defaults do something similar to this. The node.js environment appears to have its own list of root CAs that is separate from the host environment it operates in. To have node.js share the same list of root CAs as its host environment (on debian-based linux distros, at least), this environment variable needs to be added to the container: ``` NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt ``` In my specific case where I have self-hosted a certificate authority with a self-signed root cert in my LAN, I've registered this cert to the docker host environment and it just needs to be mapped into the hoard container's environment with this: ``` volumes: - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro ``` Additionally, on the mobile app, it's unable to connect even when the root CA has been added to the phone's trusted store.

kerem closed this issue

2026-03-02 11:48:49 +03:00

kerem commented

2026-03-02 11:48:49 +03:00

Author

Owner

@anselor commented on GitHub (Oct 6, 2024):

It appears this PR may address the last point: https://github.com/hoarder-app/hoarder/pull/416

@anselor commented on GitHub (Oct 6, 2024): It appears this PR may address the last point: https://github.com/hoarder-app/hoarder/pull/416

kerem commented

2026-03-02 11:48:49 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Dec 28, 2024):

I've just merged #416, sorry it took that long. It'll be available in the next mobile release.

@MohamedBassem commented on GitHub (Dec 28, 2024): I've just merged #416, sorry it took that long. It'll be available in the next mobile release.

kerem commented

2026-03-02 11:48:49 +03:00

Author

Owner

@anselor commented on GitHub (Dec 28, 2024):

@MohamedBassem I don't think this is resolved. The docker compose file still needs updates to pick up the host environment's certificate store.

@anselor commented on GitHub (Dec 28, 2024): @MohamedBassem I don't think this is resolved. The docker compose file still needs updates to pick up the host environment's certificate store.

kerem commented

2026-03-02 11:48:49 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Dec 29, 2024):

@anselor Hoarder doesn't deal with certs and ssl at all. The hoarder server always responds with http and I don't think you can configure it to serve https. The recommendation is to put a reverse proxy in front of hoarder that does the ssl termination and proxies to hoarder in http.

@MohamedBassem commented on GitHub (Dec 29, 2024): @anselor Hoarder doesn't deal with certs and ssl at all. The hoarder server always responds with http and I don't think you can configure it to serve https. The recommendation is to put a reverse proxy in front of hoarder that does the ssl termination and proxies to hoarder in http.

kerem commented

2026-03-02 11:48:50 +03:00

Author

Owner

@anselor commented on GitHub (Jan 1, 2025):

@MohamedBassem
The problem isn't it serving https. The problem is it refuses to connect to an authentication server with https because it doesn't use the system root certificate store. When running hoarder on a private LAN with a self-signed certificate, hoarder is unable to authenticate users.

@anselor commented on GitHub (Jan 1, 2025): @MohamedBassem The problem isn't it serving https. The problem is it refuses to connect to an authentication server with https because it doesn't use the system root certificate store. When running hoarder on a private LAN with a self-signed certificate, hoarder is unable to authenticate users.

kerem referenced this issue

2026-03-02 11:58:22 +03:00

[PR #324] [MERGED] Add Kubernetes installation with Kustomize #1603

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/karakeep#324

No description provided.

Rows
Columns