hansjone/netx
1
0
Fork 0
mirror of https://github.com/hansjone/netx.git synced 2026-10-09 03:10:46 +08:00
Code Issues Projects Releases 1 Packages Wiki Activity Actions 2

Default UME TLS verify off for lab self-signed certs.

Browse source 
Restore ume_verify_tls=false so onsite UME login works without a .env override; production should set NETX_UME_VERIFY_TLS=true or pin a CA.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
oliver 2026-08-06 15:15:48 +08:00
parent 0ebf137776
commit 6eeaa457b8
5 changed files with 6 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

2
netx_api/config.py
View file

@ -26,7 +26,7 @@ class Settings(BaseSettings):
ume_base_url: str = ""
ume_username: str = ""
ume_password: str = ""
ume_verify_tls: bool = True
ume_verify_tls: bool = False
ume_timeout_s: float = 20.0
ume_page_size: int = 1000
ume_max_pages: int = 2000

2
netx_api/security_bootstrap.py
View file

@ -37,7 +37,7 @@ def assert_secure_defaults_or_exit() -> None:
pwd = str(settings.bootstrap_admin_password or "").strip()
if pwd in {"", "admin123"}:
problems.append("NETX_BOOTSTRAP_ADMIN_PASSWORD is still the lab default (admin123)")
if not bool(getattr(settings, "ume_verify_tls", True)):
if not bool(getattr(settings, "ume_verify_tls", False)):
problems.append("NETX_UME_VERIFY_TLS=false while binding on a non-loopback interface")
if problems:
for p in problems:

12
netx_api/ume_client.py
View file

@ -305,17 +305,7 @@ class UMEClient:
self._lock_releaser()
except Exception:
pass
detail = str(exc)[:240]
if self.verify_tls and (
"CERTIFICATE_VERIFY_FAILED" in detail
or "certificate verify failed" in detail.lower()
or "SSLCertVerificationError" in type(exc).__name__
):
detail = (
f"{detail} (hint: set NETX_UME_VERIFY_TLS=false for lab "
"self-signed UME, or pin a CA; restart API after change)"
)
raise RuntimeError(f"ume_login_failed:{detail}") from exc
raise RuntimeError(f"ume_login_failed:{str(exc)[:240]}") from exc
token, ttl = self._extract_token_and_ttl(data)
if not token: