Fix fresh-install schema gap and OIDC provider CA trust

owen/lms

- Session::prepareTablesIfNeeded(): Wt::Dbo's automatic createTables()
  silently fails to create 4 tables (share, starred_artist,
  starred_release, starred_track) on a genuinely fresh database, with
  no exception raised and no clear reason found in Wt::Dbo internals.
  These tables are otherwise only ever created via historical schema
  migrations, which never run for a fresh install (new DBs are stamped
  directly at LMS_DATABASE_VERSION). Reproduced consistently across
  multiple from-scratch database attempts. Added defensive
  CREATE TABLE IF NOT EXISTS statements for all 4 right after
  createTables() as a targeted workaround; harmless no-op on databases
  where they already exist correctly.

- Dockerfile-release / docker-entrypoint.sh: the OIDC token exchange
  (OAuthProcess::handleToken(), a server-to-server HTTPS call from LMS
  to the provider's token endpoint) has no way to trust a private/
  internal CA, so any OIDC provider behind non-publicly-trusted TLS
  fails with 'certificate verify failed' immediately after the user
  authenticates - the callback silently drops back to the login page
  with no user-visible error, and no account ever gets created (the
  auto-registration logic in OIDCAuth::OIDCAuth was already correct;
  it just never got a chance to run). Added ca-certificates + su-exec
  to the runtime image and a docker-entrypoint.sh that runs
  update-ca-certificates against anything mounted into
  /usr/local/share/ca-certificates before dropping privileges and
  exec'ing lms, so operators can trust a custom CA via a volume mount.

This commit is contained in:

owen

2026-08-20 01:00:37 -05:00

parent beb190c518

commit 6d0f8fcc5a

3 changed files with 82 additions and 3 deletions

									
										docker-entrypoint.sh
									
		+12
		
												View File
												
				@@ -0,0 +1,12 @@

				#!/bin/sh

				# If the operator mounted extra trusted CA certificates (e.g. an internal

				# PKI root, common when LMS's OIDC provider sits behind a private CA),

				# pick them up before starting. update-ca-certificates needs root, so this

				# runs before we drop privileges to the lms user.

				set -e

				if [ -d /usr/local/share/ca-certificates ] && [ -n "$(ls -A /usr/local/share/ca-certificates 2>/dev/null)" ]; then

					update-ca-certificates

				fi

				exec su-exec lms:lms "$@"