From d63dfb8ed73ac4c0c7e52c6d92a0d67bdeaf9eb9 Mon Sep 17 00:00:00 2001 From: Oleksandr Piskun Date: Wed, 21 Oct 2026 09:35:26 +0000 Subject: [PATCH 1/2] fix: leave /certs/cert.pem untouched so it can be mounted read-only Signed-off-by: Oleksandr Piskun --- README.md | 1 + start.sh | 9 ++++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index f1f204e..4afd38e 100644 --- a/README.md +++ b/README.md @@ -272,6 +272,7 @@ HaRP is configured via several environment variables. Here are the key variables - `HP_EXAPPS_ADDRESS="0.0.0.0:8780"` - `HP_EXAPPS_HTTPS_ADDRESS="0.0.0.0:8781"` - **Note:** Must be reachable by your reverse proxy. + - **Note:** The HTTPS frontend is enabled only when `/certs/cert.pem` exists (certificate and private key in one PEM file). HaRP only reads it and never changes its permissions, so it can be mounted read-only or come from a Kubernetes Secret; it must be readable by the user the container runs as (root by default). - **`HP_TRUSTED_PROXY_IPS`** - **Description:** A comma-separated list of trusted reverse proxy IP addresses or CIDR ranges. When HaRP is behind another reverse proxy (like NGINX), set this to the IP of that proxy to allow HaRP to correctly identify the true client IP from `X-Forwarded-For` or `X-Real-IP` headers. diff --git a/start.sh b/start.sh index ece4368..16594f1 100644 --- a/start.sh +++ b/start.sh @@ -354,6 +354,14 @@ fi if [ -f "${CFG_DIR}/haproxy.cfg" ]; then log "INFO: ${CFG_DIR}/haproxy.cfg already present. Skipping config generation..." else + # HAProxy only reads the certificate, so it may be a read-only mount (e.g. a Kubernetes Secret), and its mode + # is left alone as it holds the private key. Checked before the config is written: a failed start must not + # leave a config behind that a container restart would reuse. + if [ -f "/certs/cert.pem" ] && [ ! -r "/certs/cert.pem" ]; then + echo "ERROR: /certs/cert.pem is not readable by uid $(id -u) (HaRP does not change its permissions); make it readable, or remove it to disable the HTTPS frontend." + exit 1 + fi + log "INFO: Creating ${CFG_DIR}/haproxy.cfg from haproxy.cfg.template..." # Use envsubst to render the main configuration. @@ -363,7 +371,6 @@ else if [ -f "/certs/cert.pem" ]; then log "INFO: Found /certs/cert.pem, HTTPS frontends remain enabled." sed -i "/_HTTPS_FRONTEND_/ s|_HTTPS_FRONTEND_ ||g" "${CFG_DIR}/haproxy.cfg" - chmod 644 /certs/cert.pem else log "INFO: No /certs/cert.pem found, disabling HTTPS frontends..." sed -i "/_HTTPS_FRONTEND_/ s|^|#|g" "${CFG_DIR}/haproxy.cfg" From 12e318c20658576ccaad87cfb9dc54977a0e8a6c Mon Sep 17 00:00:00 2001 From: Oleksandr Piskun Date: Wed, 21 Oct 2026 09:41:11 +0000 Subject: [PATCH 2/2] fix: shorten the cert.pem comment and messages Signed-off-by: Oleksandr Piskun --- README.md | 2 +- start.sh | 6 ++---- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 4afd38e..8a4db57 100644 --- a/README.md +++ b/README.md @@ -272,7 +272,7 @@ HaRP is configured via several environment variables. Here are the key variables - `HP_EXAPPS_ADDRESS="0.0.0.0:8780"` - `HP_EXAPPS_HTTPS_ADDRESS="0.0.0.0:8781"` - **Note:** Must be reachable by your reverse proxy. - - **Note:** The HTTPS frontend is enabled only when `/certs/cert.pem` exists (certificate and private key in one PEM file). HaRP only reads it and never changes its permissions, so it can be mounted read-only or come from a Kubernetes Secret; it must be readable by the user the container runs as (root by default). + - **Note:** The HTTPS frontend is enabled only when `/certs/cert.pem` (certificate and private key in one PEM file) exists. - **`HP_TRUSTED_PROXY_IPS`** - **Description:** A comma-separated list of trusted reverse proxy IP addresses or CIDR ranges. When HaRP is behind another reverse proxy (like NGINX), set this to the IP of that proxy to allow HaRP to correctly identify the true client IP from `X-Forwarded-For` or `X-Real-IP` headers. diff --git a/start.sh b/start.sh index 16594f1..bab9d96 100644 --- a/start.sh +++ b/start.sh @@ -354,11 +354,9 @@ fi if [ -f "${CFG_DIR}/haproxy.cfg" ]; then log "INFO: ${CFG_DIR}/haproxy.cfg already present. Skipping config generation..." else - # HAProxy only reads the certificate, so it may be a read-only mount (e.g. a Kubernetes Secret), and its mode - # is left alone as it holds the private key. Checked before the config is written: a failed start must not - # leave a config behind that a container restart would reuse. + # Checked before the config is written, so a failed start leaves none for a restart to reuse. if [ -f "/certs/cert.pem" ] && [ ! -r "/certs/cert.pem" ]; then - echo "ERROR: /certs/cert.pem is not readable by uid $(id -u) (HaRP does not change its permissions); make it readable, or remove it to disable the HTTPS frontend." + echo "ERROR: /certs/cert.pem is not readable by uid $(id -u); make it readable, or remove it to disable the HTTPS frontend." exit 1 fi