From 550a23dafcb34962c9bc4ab52ed0ddf6524765d4 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Wed, 11 Mar 2026 14:48:54 -0500
Subject: [PATCH] fix SSL CA trust store for HTTPS in containers

Start a named Finch pool with CAStore certificate path and configure
Req to use it by default. Fixes integration sync failures on Dokku
where the OS CA trust store is unavailable.
---
 config/config.exs           |  3 +++
 lib/towerops/application.ex | 13 +++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/config/config.exs b/config/config.exs
index 79db457b..28cd9a3b 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -82,6 +82,9 @@ config :phoenix, :filter_parameters, [
 # Use Jason for JSON parsing in Phoenix
 config :phoenix, :json_library, Jason
 
+# Configure Req HTTP client to use our Finch pool with CA certs
+config :req, default_options: [finch: Towerops.Finch]
+
 # Configure tailwind (the version is required)
 config :tailwind,
   version: "4.1.12",
diff --git a/lib/towerops/application.ex b/lib/towerops/application.ex
index be0b5dda..2fe91169 100644
--- a/lib/towerops/application.ex
+++ b/lib/towerops/application.ex
@@ -91,6 +91,19 @@ defmodule Towerops.Application do
         {Cluster.Supervisor, [topologies, [name: Towerops.ClusterSupervisor]]},
         ToweropsWeb.Telemetry,
         Towerops.Repo,
+        # HTTP client pool with CA certificate configuration
+        # Ensures HTTPS works in containers where OS CA store is unavailable
+        {Finch,
+         name: Towerops.Finch,
+         pools: %{
+           default: [
+             conn_opts: [
+               transport_opts: [
+                 cacertfile: CAStore.file_path()
+               ]
+             ]
+           ]
+         }},
         # Encryption vault for sensitive data (passwords, API tokens)
         Towerops.Vault,
         # Error notifications via email (production only, gracefully shuts down in dev/test)