Skip to content

fix: leave /certs/cert.pem untouched so it can be mounted read-only #140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oleksandr-nc merged 2 commits into from
Oct 21, 2026
Merged

fix: leave /certs/cert.pem untouched so it can be mounted read-only #140

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d63dfb8
fix: leave /certs/cert.pem untouched so it can be mounted read-only
oleksandr-nc Oct 21, 2026
12e318c
fix: shorten the cert.pem comment and messages
oleksandr-nc Oct 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -272,6 +272,7 @@ HaRP is configured via several environment variables. Here are the key variables
- `HP_EXAPPS_ADDRESS="0.0.0.0:8780"`
- `HP_EXAPPS_HTTPS_ADDRESS="0.0.0.0:8781"`
- **Note:** Must be reachable by your reverse proxy.
- **Note:** The HTTPS frontend is enabled only when `/certs/cert.pem` (certificate and private key in one PEM file) exists.

- **`HP_TRUSTED_PROXY_IPS`**
- **Description:** A comma-separated list of trusted reverse proxy IP addresses or CIDR ranges. When HaRP is behind another reverse proxy (like NGINX), set this to the IP of that proxy to allow HaRP to correctly identify the true client IP from `X-Forwarded-For` or `X-Real-IP` headers.
Expand Down
7 changes: 6 additions & 1 deletion start.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -354,6 +354,12 @@ fi
if [ -f "${CFG_DIR}/haproxy.cfg" ]; then
log "INFO: ${CFG_DIR}/haproxy.cfg already present. Skipping config generation..."
else
# Checked before the config is written, so a failed start leaves none for a restart to reuse.
if [ -f "/certs/cert.pem" ] && [ ! -r "/certs/cert.pem" ]; then
echo "ERROR: /certs/cert.pem is not readable by uid $(id -u); make it readable, or remove it to disable the HTTPS frontend."
exit 1
fi
Comment thread
coderabbitai[bot] marked this conversation as resolved.

log "INFO: Creating ${CFG_DIR}/haproxy.cfg from haproxy.cfg.template..."

# Use envsubst to render the main configuration.
Expand All @@ -363,7 +369,6 @@ else
if [ -f "/certs/cert.pem" ]; then
log "INFO: Found /certs/cert.pem, HTTPS frontends remain enabled."
sed -i "/_HTTPS_FRONTEND_/ s|_HTTPS_FRONTEND_ ||g" "${CFG_DIR}/haproxy.cfg"
chmod 644 /certs/cert.pem
else
log "INFO: No /certs/cert.pem found, disabling HTTPS frontends..."
sed -i "/_HTTPS_FRONTEND_/ s|^|#|g" "${CFG_DIR}/haproxy.cfg"
Expand Down
Loading