From e75c91c4a1d2cc96adab7c2efa4e687a7da72a92 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <209825114+claude[bot]@users.noreply.github.com> Date: Wed, 30 Jul 2025 14:39:26 +0000 Subject: [PATCH] feat: add CA certificate update at startup via environment variable (#6280) * feat: add CA certificate update at startup via environment variable Add support for running 'update-ca-certificates' at binary startup when RUN_UPDATE_CA_CERTIFICATE_AT_START environment variable is set to "true". - Check for RUN_UPDATE_CA_CERTIFICATE_AT_START env var on startup - Execute update-ca-certificates command if env var is set to "true" - Log success/failure appropriately with tracing - Continue startup even if CA certificate update fails - Non-blocking implementation with proper error handling Fixes #6279 Co-authored-by: Ruben Fiszel * refactor: extract CA certificate update logic into separate function Extract the CA certificate update logic from windmill_main() into a dedicated update_ca_certificates_if_requested() function for better code organization and maintainability. Co-authored-by: Ruben Fiszel * improvements --------- Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> Co-authored-by: Ruben Fiszel Co-authored-by: Alexander Petric Co-authored-by: Alexander Petric --- README.md | 2 ++ backend/src/main.rs | 42 +++++++++++++++++++++++++++++++++++++----- 2 files changed, 39 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index c86977bf72..27784d4922 100644 --- a/README.md +++ b/README.md @@ -364,6 +364,8 @@ you to have it being synced automatically everyday. | DISABLE_RESPONSE_LOGS | false | Disable response logs | Server | | CREATE_WORKSPACE_REQUIRE_SUPERADMIN | true | If true, only superadmins can create new workspaces | Server | | MIN_FREE_DISK_SPACE_MB | 15000 | Minimum amount of free space on worker. Sends critical alert if worker has less free space. | Worker | +| RUN_UPDATE_CA_CERTIFICATE_AT_START | false | If true, runs CA certificate update command at startup before other initialization | All | +| RUN_UPDATE_CA_CERTIFICATE_PATH | /usr/sbin/update-ca-certificates | Path to the CA certificate update command/script to run when RUN_UPDATE_CA_CERTIFICATE_AT_START is true | All | ## Run a local dev setup diff --git a/backend/src/main.rs b/backend/src/main.rs index 0d4e9ef052..6cb13ffb83 100644 --- a/backend/src/main.rs +++ b/backend/src/main.rs @@ -135,6 +135,36 @@ pub fn setup_deno_runtime() -> anyhow::Result<()> { Ok(()) } +fn update_ca_certificates_if_requested() { + if std::env::var("RUN_UPDATE_CA_CERTIFICATE_AT_START") + .ok() + .map(|v| v.to_lowercase() == "true") + .unwrap_or(false) + { + let ca_cert_path = std::env::var("RUN_UPDATE_CA_CERTIFICATE_PATH") + .unwrap_or_else(|_| "/usr/sbin/update-ca-certificates".to_string()); + + println!("RUN_UPDATE_CA_CERTIFICATE_AT_START=true, running: {}", ca_cert_path); + + let output = std::process::Command::new(&ca_cert_path) + .output(); + + match output { + Ok(result) => { + if result.status.success() { + println!("Successfully updated CA certificates"); + } else { + let stderr = String::from_utf8_lossy(&result.stderr); + println!("Failed to update CA certificates, but continuing startup: {}", stderr.trim()); + } + } + Err(e) => { + println!("Could not run update-ca-certificates command, but continuing startup: {}", e); + } + } + } +} + #[inline(always)] fn create_and_run_current_thread_inner(future: F) -> R where @@ -263,12 +293,14 @@ async fn cache_hub_scripts(file_path: Option) -> anyhow::Result<()> { async fn windmill_main() -> anyhow::Result<()> { dotenv::dotenv().ok(); + update_ca_certificates_if_requested(); + if std::env::var("RUST_LOG").is_err() { std::env::set_var("RUST_LOG", "info") } if let Err(_e) = rustls::crypto::ring::default_provider().install_default() { - tracing::error!("Failed to install rustls crypto provider"); + println!("Failed to install rustls crypto provider"); } #[cfg(feature = "enterprise")] @@ -280,9 +312,9 @@ async fn windmill_main() -> anyhow::Result<()> { .arg("iptables -A OUTPUT -d 169.254.169.254 -j DROP && iptables -A FORWARD -d 169.254.169.254 -j DROP") .status() { - tracing::warn!("Failed to run iptables to block metadata endpoint: {e}"); + println!("Failed to run iptables to block metadata endpoint: {e}"); } else { - tracing::info!("Successfully blocked metadata endpoint using iptables"); + println!("Successfully blocked metadata endpoint using iptables"); } } @@ -377,7 +409,7 @@ async fn windmill_main() -> anyhow::Result<()> { let num_version = sqlx::query_scalar!("SELECT version()").fetch_one(&db).await; - tracing::info!( + println!( "PostgreSQL version: {} (windmill require PG >= 14)", num_version .ok() @@ -386,7 +418,7 @@ async fn windmill_main() -> anyhow::Result<()> { ); load_otel(&db).await; - tracing::info!("Database connected"); + println!("Database connected"); (Connection::Sql(db), None) };