MOBILIZON_CA_CERT_PATH does not work as expected
Problem
In Mobilizon 4.1 the environment variable MOBILIZON_CA_CERT_PATH
got introduced, which would come in handy for local development and automated testing. However, it does not work as expected. My guess is that Tesla/hackney do not always use that CA cert file.
Reproduce
I used the docker container for v4.1. The logs show that indeed the custom self-signed CA gets loaded:
[notice] Updating with 148 CA(s) from {:override, {:file, "/usr/share/ca-certificates/mozilla/ca-certificates.crt"}} store
148 is the expected number (147 are in the current one from Mozilla), when I remove a cert from the file, the number fits.
But later on sending ActivityPub post request it fails:
[info] Sending https://mz.lan/unfollow/7b1c89ac-6a5b-4031-8983-aa44518c6d04/activity out via AP
[info] Federating https://mz.lan/unfollow/7b1c89ac-6a5b-4031-8983-aa44518c6d04/activity to https://wp.lan/wp-json/activitypub/1.0/actors/-1/inbox
[notice] TLS :client: In state :wait_cert_cr at ssl_handshake.erl:2134 generated CLIENT ALERT: Fatal - Unknown CA
Most likely here: https://framagit.org/framasoft/mobilizon/-/blob/main/lib/federation/activity_pub/publisher.ex#L98
Solution
The solution is to always pass the ssl options in the case the environment variable is set to (that is the path of the self signed cert as an Option) to the Tesla.Adapter
middleware, which will pass the option to hackney, the actual http client.
Note that sometimes the option already is passed, for example for fetching remote media.