- Shipped
- September 23, 2026 at 11:05 AM UTC
- Author
- Kamo
- Commit
- 76e6522
NODE_TLS_REJECT_UNAUTHORIZED: "0" in k8s/configmap.yaml made every server-side outbound TLS call in this process — to any host, for any purpose, for as long as the pod runs — skip certificate validation. That is a much wider exception than anything currently needs it. History, from `git log -S`/`-p` on this file: it was added in c240b5af alongside MEDIASERVICE_URL pointed at **************** — an in-cluster Service DNS name presenting the cluster's own certificate, which no public CA bundle trusts. bdfb2f5d then "corrected" MEDIASERVICE_URL back to **************** (that hop is plain HTTP today) but left the TLS bypass in place. I traced every other outbound target this service has: - API_SERVICE_URL (used by apiProxy.ts's forwardToApi, the majority of proxy routes) and MEDIASERVICE_URL are both plain http:// in this ConfigMap already. - CONVERSION_SERVICE_URL has no override here and defaults to plain http:// in code. - The two remaining https:// targets — apiBaseForHost's `https://api.<registrable>` fallback (org/[...domain]/route.ts, org/current/route.ts) and computeAuthBaseFromAlias's `https://login.<registrable>` — both have unset overrides **************** AUTH_BASE_URL are not in this ConfigMap), so in production both always resolve to the requesting organization's OWN public custom domain, served through the same ingress that terminates browser traffic and backed by a public CA. - Every route that still builds `https://media.<host>:8443` as a fallback (used only when MEDIASERVICE_URL is unset) checks the env var first, so that branch is dead in this deployment. - No direct MinIO/S3 client exists in this repo; presigned URLs are only string-rewritten, not fetched with a custom TLS config. Nothing left needs certificate validation disabled. The two routes that proxy uploads directly to MediaService over raw node:http/https (attachments, screenshots — see the prior commit) already carry their own scoped `rejectUnauthorized: false` for the one case where that hop is HTTPS, which is the right place for an exception like this if one is ever needed again — not a process-wide flag.