From cc196ab2f3362ac32eede88c54ddf44bbbc2a346 Mon Sep 17 00:00:00 2001
From: mprahl <mprahl@redhat.com>
Date: Jan 16 2019 15:34:18 +0000
Subject: Add the ability to install a CA at run-time based on the CA_URL env variable


---

diff --git a/Dockerfile b/Dockerfile
index babaf0c..a5973d1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,6 +23,9 @@ RUN if [ "$cacert_url" != "undefined" ]; then \
         && curl -O --insecure $cacert_url \
         && update-ca-trust extract; \
     fi
+# This will allow a non-root user to install a custom root CA at run-time
+RUN chmod 777 /etc/pki/tls/certs/ca-bundle.crt
+COPY docker/install-ca.sh /opt
 USER 1001
 EXPOSE 8080
-ENTRYPOINT gunicorn-3 --workers 8 --bind 0.0.0.0:8080 --access-logfile=- --enable-stdio-inheritance greenwave.wsgi:app
+ENTRYPOINT /opt/install-ca.sh && gunicorn-3 --workers 8 --bind 0.0.0.0:8080 --access-logfile=- --enable-stdio-inheritance greenwave.wsgi:app
diff --git a/docker/install-ca.sh b/docker/install-ca.sh
new file mode 100755
index 0000000..fd600cc
--- /dev/null
+++ b/docker/install-ca.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+set -e
+
+if [ -n "${CA_URL}" ] && [ ! -f "/tmp/.imported" ]; then
+    # Since update-ca-trust doesn't work as a non-root user, let's just append to the bundle directly
+    curl --silent --show-error "${CA_URL}" >> /etc/pki/tls/certs/ca-bundle.crt
+    # Create a file so we know not to import it again if the container is restarted
+    touch /tmp/.imported
+fi