[oleksandr-nc]

When /certs/cert.pem is mounted read-only, for example as a :ro bind mount or from a Kubernetes Secret, HaRP exits right after "Found /certs/cert.pem, HTTPS frontends remain enabled." with chmod: /certs/cert.pem: Read-only file system, because start.sh runs chmod 644 on the file while set -e is active. With a Docker restart policy the container happens to start on the second attempt, since the generated config is reused and the chmod is skipped; with a tmpfs on /run/harp (as in AIO) or in Kubernetes it restarts forever. The chmod is not needed: HAProxy runs as root in this image and reads the file in any mode. On a writable mount it also changes the mode of the host's file to 644.

Changes

• start.sh no longer changes the permissions of /certs/cert.pem.
• When the file exists but cannot be read (for example when the container runs as another user), HaRP stops before it writes the config, with "ERROR: /certs/cert.pem is not readable by uid N ...", instead of failing later with HAProxy's cannot open the file after the other processes have started.
• The README says when the HTTPS frontend is enabled and what the file must contain.

Setups with a writable mount behave as before, except that the file's mode is no longer changed. Files that earlier versions set to 644 keep that mode.

[coderabbitai]

📝 Walkthrough

The README documents that HTTPS frontends require a readable certificate and private key in /certs/cert.pem. Before generating HAProxy configuration, start.sh now exits with an error if that file exists but is unreadable. The script no longer changes the certificate’s permissions.

Priority: ⬇️ Low

Merge Risk: 🔵 Low · up to d63df

Move the certificate check before the configuration shortcut to provide the intended actionable startup error.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely states the main change: leaving /certs/cert.pem unchanged so read-only mounts work.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The pull request description directly matches the changes. It explains removal of chmod, support for read-only certificate mounts, unreadable-file handling, and README updates.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3465b0a1-0a59-4308-84d4-0ba30fa4a4c8

📥 Commits

Reviewing files that changed from the base of the PR and between 868349f and d63dfb8.

📒 Files selected for processing: 2

• README.md
• start.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.