From 9007bc0796a1e3d6d05f808801d3e415fbcb9c53 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rapha=C3=ABl=20COMBEAU?= <craf.pro@gmail.com>
Date: Tue, 12 Oct 2021 17:18:51 +0200
Subject: [PATCH] Revert "Revert "Fix: Missing certificate signed by unknown
 authority refs: https://github.com/mattermost/docker/issues/34""

This reverts commit f901fee09451a3b2b0e44eda127d39b202752aec.
---
 README.md                | 14 +++++++++++---
 docker-compose.nginx.yml |  4 ++++
 env.example              |  1 +
 3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 9258bbe..7ad036f 100644
--- a/README.md
+++ b/README.md
@@ -64,20 +64,28 @@ mkdir -p ./volumes/web/cert
 cp PATH-TO-CERT.PEM ./volumes/web/cert/cert.pem
 cp PATH-TO-KEY.PEM ./volumes/web/cert/key-no-password.pem
 ```
+#### 5.2 Configure SSO with GitLab
+If you are looking for SSO with GitLab and you use self signed certificate you have to add the PKI chain of your authority in app because Alpine doesn't know him. This is required to avoid **Token request failed: certificate signed by unknown authority**
 
-#### 5.2 Let's Encrypt
+For that uncomment this line :
+```
+# - ${GITLAB_PKI_CHAIN_PATH}:/etc/ssl/certs/pki_chain.pem:ro
+```
+
+#### 5.3 Let's Encrypt
 For using Let's Encrypt you can use this Bash script located in scripts/issue-certificate.sh (or follow the steps in docs/issuing-letsencrypt-certificate.md). Make sure to adjust `mm.example.com` to match your domain configured in step 2.
 ```
 bash scripts/issue-certificate.sh -d mm.example.com -o ${PWD}/certs
 ```
 Otherwise please consult the Certbot [documentation](https://certbot.eff.org/instructions) on how to issue a standalone certificate and ensure the paths to the certificate and key are correctly set in your *.env*.
 
-#### 5.3 Adjusting the `.env` file.
-Once you've completed 5.1 or 5.2 you'll need to adjust the `.env` file accordingly. With 5.1 verify the first two lines below are uncommented in the `.env` file, with 5.2 comment out the first two lines and uncomment the last two lines.
+#### 5.4 Adjusting the `.env` file.
+Once you've completed 5.1 or 5.2 or 5.3 you'll need to adjust the `.env` file accordingly. With 5.1 verify the first two lines below are uncommented in the `.env` file, with 5.2 uncomment the third line and put the correct path for your pki chain, with 5.3 comment out the first two lines and uncomment the last two lines.
 
 ```
 CERT_PATH=./volumes/web/cert/cert.pem
 KEY_PATH=./volumes/web/cert/key-no-password.pem
+#GITLAB_PKI_CHAIN_PATH=<path_to_your_gitlab_pki>/pki_chain.pem
 #CERT_PATH=./certs/etc/letsencrypt/live/${DOMAIN}/fullchain.pem
 #KEY_PATH=./certs/etc/letsencrypt/live/${DOMAIN}/privkey.pem
 ```
diff --git a/docker-compose.nginx.yml b/docker-compose.nginx.yml
index 950263c..e91bf4a 100644
--- a/docker-compose.nginx.yml
+++ b/docker-compose.nginx.yml
@@ -21,6 +21,10 @@ services:
       - ${CERT_PATH}:/cert.pem:ro
       - ${KEY_PATH}:/key.pem:ro
       - shared-webroot:/usr/share/nginx/html
+      # When you want to use SSO with GitLab, you have to add the cert pki chain of GitLab inside Alpine
+      # to avoid Token request failed: certificate signed by unknown authority 
+      # (link: https://github.com/mattermost/mattermost-server/issues/13059 and https://github.com/mattermost/docker/issues/34)
+      # - ${GITLAB_PKI_CHAIN_PATH}:/etc/ssl/certs/pki_chain.pem:ro
     environment:
       # timezone inside container
       - TZ: ${TZ}
diff --git a/env.example b/env.example
index 3dc0e01..f2a58a5 100644
--- a/env.example
+++ b/env.example
@@ -37,6 +37,7 @@ NGINX_DHPARAMS_FILE=./nginx/dhparams4096.pem
 
 CERT_PATH=./volumes/web/cert/cert.pem
 KEY_PATH=./volumes/web/cert/key-no-password.pem
+#GITLAB_PKI_CHAIN_PATH=<path_to_your_gitlab_pki>/pki_chain.pem
 #CERT_PATH=./certs/etc/letsencrypt/live/${DOMAIN}/fullchain.pem
 #KEY_PATH=./certs/etc/letsencrypt/live/${DOMAIN}/privkey.pem