Error: SELF_SIGNED_CERT_IN_CHAIN

[Hr46ph]

Hello!

I am deploying on Kubernetes with an external postgres cluster deployed via Percona postgres-operator. Other applications are already using this cluster. I have prepared a database with user and proper permissions.

I can't get the wikijs helm chart the deploy, it continues to fail with

Loading configuration from /wiki/config.yml... OK
2024-09-04T14:15:12.145Z [MASTER] info: =======================================
2024-09-04T14:15:12.147Z [MASTER] info: = Wiki.js 2.5.303 =====================
2024-09-04T14:15:12.147Z [MASTER] info: =======================================
2024-09-04T14:15:12.147Z [MASTER] info: Initializing...
2024-09-04T14:15:12.531Z [MASTER] info: Using database driver pg for postgres [ OK ]
2024-09-04T14:15:12.537Z [MASTER] info: Connecting to database...
2024-09-04T14:15:12.549Z [MASTER] error: Database Connection Error: SELF_SIGNED_CERT_IN_CHAIN undefined:undefined
2024-09-04T14:15:12.549Z [MASTER] warn: Will retry in 3 seconds... [Attempt 1 of 10]

I have tried adding the CA from Postgres in different ways. I grabbed that from their secret, decoded it and followed the instructions to add a configmap with volumemounts and volumes section in the values.yaml.

I alo tried this, which doesn't work:
#5173

When it still failed with the same message, I found a post on wikijs issues someone running in Docker who used this to make wikijs accept self signed certs:

db:
  type: postgres
  ssl: true
  sslOptions:
    auto: false
    rejectUnauthorized: false

So I added that, which I didn't expect to work becuase I don't think db is supported (but who knows it was quick to try) and then I tried adding it to the postgresql section:

postgresql:
  existingSecret: wikijs-secret
  enabled: false
  ssl: true
  sslOptions:
    auto: false
    rejectUnauthorized: false
  ca: "/cas.pem"

However, with this I still get these errors. Since the documentation of the Helm chart do not mention these I guess this isn't implemented?

is there another way to override rejectUnauthorized? Perhaps via an extra init container or environment values?

For helm chart config for example, with Gitea the database options allow different settings to control how an SSL connection is made (link)

Valid values for PostgreSQL:
disable: Disable TLS.
require: Enable TLS without any verifications.
verify-ca: Enable TLS with verification of the database server certificate against its root certificate.
verify-full: Enable TLS and verify the database server name matches the given certificate in either the Common Name or Subject Alternative Name fields.

Would you be willing to add this to the helm chart?

Thanks!

[SanjyASZ]

Hi @Hr46ph
We have the same issue,
What you tried to add in the postgresql section should not be add in the values.yml but should appear in the wiki config file.
Plus if we check env variables, we can see that both NODE_EXTRA_CA_CERTS and DB_SSL_CA are set but does not appear in the config.yml file.
But I don't know what we are doing wrong ...

[fnafox]

Not all features are currently declared in the chart values, but you can override it by mounting your own config.yml to the deployment in the pod template spec.

      volumes:
        - name: wiki-conf
          configMap:
            name: wiki-conf
      containers:
        - name: wiki
          volumeMounts:
            - name: wiki-conf
              mountPath: /wiki/config.yml
              subPath: config.yml

[Hr46ph]

Thank you!

Just one more Q if you don't mind. Currently the container does not start and ends up in a crashloop. How would I retrieve the current config to adjust and turn it into a configMap?

I mean, I can mount my wiki data volume but /wiki/ is empty so I can't grab whatever config there is.

[fnafox]

This should be the default config.yml used in container deployments: https://github.com/requarks/wiki/blob/main/dev/build/config.yml

[Hr46ph]

I finally have a working wiki.

I really hope this feedback will help improve the helm chart and its documentation as much of troubles I went through are unnecessary.

Thanks for the help!