awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-08 03:27:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix upstream skip validation

Browse Source
This commit is contained in:
Fang-Pen Lin
2025-11-13 11:36:51 -08:00
parent 73a3ee6b61
commit c183d91257
4 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/run-backend-bdd-tests.yml
+3
View File
@@ -51,6 +51,9 @@ jobs:
echo "ACME_DEVELOPMENT_MODE=true" >> .env echo "ACME_DEVELOPMENT_MODE=true" >> .env
echo "ACME_DEVELOPMENT_HTTP01_CHALLENGE_HOST_OVERRIDES={\"localhost\": \"host.docker.internal:8087\", \"infisical.com\": \"host.docker.internal:8087\", \"example.com\": \"host.docker.internal:8087\"}" >> .env echo "ACME_DEVELOPMENT_HTTP01_CHALLENGE_HOST_OVERRIDES={\"localhost\": \"host.docker.internal:8087\", \"infisical.com\": \"host.docker.internal:8087\", \"example.com\": \"host.docker.internal:8087\"}" >> .env
echo "BDD_NOCK_API_ENABLED=true" >> .env echo "BDD_NOCK_API_ENABLED=true" >> .env
# Skip upstream validation, otherwise the ACME client for the upstream will try to
# validate the DNS records, which will fail because the DNS records are not actually created.
echo "ACME_SKIP_UPSTREAM_VALIDATION=true" >> .env
# We are not using FIPS mode, need a different encryption key for BDD tests # We are not using FIPS mode, need a different encryption key for BDD tests
NEW_ENCRYPTION_KEY=6c1fe4e407b8911c104518103505b218 NEW_ENCRYPTION_KEY=6c1fe4e407b8911c104518103505b218
sed -i "s#ENCRYPTION_KEY=.*#ENCRYPTION_KEY=$NEW_ENCRYPTION_KEY#" .env sed -i "s#ENCRYPTION_KEY=.*#ENCRYPTION_KEY=$NEW_ENCRYPTION_KEY#" .env
backend/src/lib/config/env.ts
+1
View File
@@ -108,6 +108,7 @@ const envSchema = z
DAILY_RESOURCE_CLEAN_UP_DEVELOPMENT_MODE: zodStrBool.default("false").optional(), DAILY_RESOURCE_CLEAN_UP_DEVELOPMENT_MODE: zodStrBool.default("false").optional(),
BDD_NOCK_API_ENABLED: zodStrBool.default("false").optional(), BDD_NOCK_API_ENABLED: zodStrBool.default("false").optional(),
ACME_DEVELOPMENT_MODE: zodStrBool.default("false").optional(), ACME_DEVELOPMENT_MODE: zodStrBool.default("false").optional(),
ACME_SKIP_UPSTREAM_VALIDATION: zodStrBool.default("false").optional(),
ACME_DEVELOPMENT_HTTP01_CHALLENGE_HOST_OVERRIDES: zpStr( ACME_DEVELOPMENT_HTTP01_CHALLENGE_HOST_OVERRIDES: zpStr(
z z
.string() .string()
backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts
+1 -1
View File
@@ -243,7 +243,7 @@ export const orderCertificate = async (
challengePriority: ["dns-01"], challengePriority: ["dns-01"],
// For ACME development mode, we mock the DNS challenge API calls. So, no real DNS records are created. // For ACME development mode, we mock the DNS challenge API calls. So, no real DNS records are created.
// We need to disable the challenge verification to avoid errors. // We need to disable the challenge verification to avoid errors.
skipChallengeVerification: getConfig().isAcmeDevelopmentMode, skipChallengeVerification: getConfig().isAcmeDevelopmentMode && getConfig().ACME_SKIP_UPSTREAM_VALIDATION,
termsOfServiceAgreed: true, termsOfServiceAgreed: true,
challengeCreateFn: async (authz, challenge, keyAuthorization) => { challengeCreateFn: async (authz, challenge, keyAuthorization) => {
backend/src/services/certificate-authority/acme/dns-providers/cloudflare.ts
-2
View File
@@ -68,8 +68,6 @@ export const cloudflareDeleteTxtRecord = async (
}, },
params: { params: {
type: "TXT", type: "TXT",
// TODO: this is incorrect. The domain seems need to be fqdn, but we are passing just the record name here.
// as a result, we are not deleting the record correctly.
name: domain, name: domain,
content: value content: value
} }