Support for self-signed CA certificates (#1431)

deploy/docker-entrypoint.sh

@@ -31,6 +31,38 @@ set -eu
 PUID="${PUID:-1000}"
 PGID="${PGID:-1000}"
 
+# If requested, update and use the system trust store inside the container.
+# Users can set USE_SYSTEM_TRUST_STORE to any non-empty value to enable.
+if [ -n "${USE_SYSTEM_TRUST_STORE:-}" ]; then
+    echo "[entrypoint] USE_SYSTEM_TRUST_STORE is set"
+    if [ "$(id -u)" -ne 0 ]; then
+        echo "[entrypoint] error: USE_SYSTEM_TRUST_STORE is set but not running as root; cannot update trust store"
+        exit 1
+    fi
+    # Check if we have any certificates to process. Error if directory is empty
+    if ls -1 /usr/local/share/ca-certificates/*.crt >/dev/null 2>&1; then
+        echo "[entrypoint] .crt files found in /usr/local/share/ca-certificates"
+    else
+        echo "[entrypoint] no .crt files in /usr/local/share/ca-certificates"
+        exit 1
+    fi
+    if command -v update-ca-certificates >/dev/null 2>&1; then
+        echo "[entrypoint] update-ca-certificates found; updating system trust store"
+        if update-ca-certificates --fresh ; then
+            echo "[entrypoint] update-ca-certificates succeeded; exporting SSL_CERT_DIR=/etc/ssl/certs"
+            export SSL_CERT_DIR="/etc/ssl/certs"
+        else
+            echo "[entrypoint] error: update-ca-certificates failed"
+            exit 1
+        fi
+    else
+        echo "[entrypoint] error: update-ca-certificates not found; cannot update trust store"
+        exit 1
+    fi
+else
+    echo "[entrypoint] USE_SYSTEM_TRUST_STORE not set; skipping system trust store update"
+fi
+
 # If we're not root, we can't chown anything. Exec the original command
 # and trust that the user has set up host-side ownership themselves.
 if [ "$(id -u)" -ne 0 ]; then