From fe0f52ce17516f36573c92cb50d19a8813a0a347 Mon Sep 17 00:00:00 2001 From: Coderbot Date: Sat, 23 May 2026 14:35:39 -0700 Subject: [PATCH] fix: services/status probe fails with self-signed certs when CA is missing in container The /api/v1/services/status endpoint (dashboard card ON/OFF) uses an HTTPS agent to probe each service. When /app/pki/root.crt is missing inside the container, it fell back to new https.Agent() which rejects self-signed certificates. This caused all .sami domain probes to fail with UNABLE_TO_GET_ISSUER_CERT_LOCALLY, making dashboard cards randomly flip between ON and OFF depending on whether the Pylon relay responded before the 10s deadline. Fix: use rejectUnauthorized: false as fallback when CA cert is absent. --- dashcaddy-api/routes/services.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dashcaddy-api/routes/services.js b/dashcaddy-api/routes/services.js index 726214d..ec5676f 100644 --- a/dashcaddy-api/routes/services.js +++ b/dashcaddy-api/routes/services.js @@ -54,7 +54,8 @@ module.exports = function({ const caCert = fs.readFileSync(CA_CERT_PATH); probeHttpsAgent = new https.Agent({ ca: [...tls.rootCertificates, caCert] }); } catch (_) { - probeHttpsAgent = new https.Agent(); + // CA cert not available — trust self-signed certs so probes still work + probeHttpsAgent = new https.Agent({ rejectUnauthorized: false }); } function isServiceUp(statusCode) {