owen
6d0f8fcc5a
- Session::prepareTablesIfNeeded(): Wt::Dbo's automatic createTables() silently fails to create 4 tables (share, starred_artist, starred_release, starred_track) on a genuinely fresh database, with no exception raised and no clear reason found in Wt::Dbo internals. These tables are otherwise only ever created via historical schema migrations, which never run for a fresh install (new DBs are stamped directly at LMS_DATABASE_VERSION). Reproduced consistently across multiple from-scratch database attempts. Added defensive CREATE TABLE IF NOT EXISTS statements for all 4 right after createTables() as a targeted workaround; harmless no-op on databases where they already exist correctly. - Dockerfile-release / docker-entrypoint.sh: the OIDC token exchange (OAuthProcess::handleToken(), a server-to-server HTTPS call from LMS to the provider's token endpoint) has no way to trust a private/ internal CA, so any OIDC provider behind non-publicly-trusted TLS fails with 'certificate verify failed' immediately after the user authenticates - the callback silently drops back to the login page with no user-visible error, and no account ever gets created (the auto-registration logic in OIDCAuth::OIDCAuth was already correct; it just never got a chance to run). Added ca-certificates + su-exec to the runtime image and a docker-entrypoint.sh that runs update-ca-certificates against anything mounted into /usr/local/share/ca-certificates before dropping privileges and exec'ing lms, so operators can trust a custom CA via a volume mount.
13 lines
457 B
Bash
13 lines
457 B
Bash
#!/bin/sh
|
|
# If the operator mounted extra trusted CA certificates (e.g. an internal
|
|
# PKI root, common when LMS's OIDC provider sits behind a private CA),
|
|
# pick them up before starting. update-ca-certificates needs root, so this
|
|
# runs before we drop privileges to the lms user.
|
|
set -e
|
|
|
|
if [ -d /usr/local/share/ca-certificates ] && [ -n "$(ls -A /usr/local/share/ca-certificates 2>/dev/null)" ]; then
|
|
update-ca-certificates
|
|
fi
|
|
|
|
exec su-exec lms:lms "$@"
|