feat: insecure tls & cacert for self-hosted repos #277
Conversation
WalkthroughAdds a Collapsible UI component suite; introduces an Advanced TLS settings form and integrates it into repository creation; moves cacert and insecureTls fields from REST-only schema to the base repository schema; globalizes server-side CACERT/insecure TLS handling and simplifies temporary key cleanup usage. Changes
Possibly related PRs
Pre-merge checks✅ Passed checks (5 passed)
📜 Recent review detailsConfiguration used: Organization UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🧰 Additional context used📓 Path-based instructions (3)**/*.{ts,tsx,js,jsx,json}📄 CodeRabbit inference engine (AGENTS.md)
Files:
**/*.{ts,tsx,js,jsx}📄 CodeRabbit inference engine (AGENTS.md)
Files:
app/server/modules/**/*.ts📄 CodeRabbit inference engine (AGENTS.md)
Files:
🧠 Learnings (2)📚 Learning: 2025-12-28T17:31:39.171ZApplied to files:
📚 Learning: 2025-12-28T17:31:39.171ZApplied to files:
🧬 Code graph analysis (1)app/server/modules/lifecycle/migration.ts (1)
🔇 Additional comments (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
app/client/components/ui/collapsible.tsx (1)
80-92: Thehiddenattribute may prevent close animations from being visible.When
openbecomesfalse, thehiddenattribute immediately hides the element and{open && children}unmounts children, both before theanimate-accordion-upanimation can complete. If smooth close animations are desired, consider using CSS-only visibility transitions or delaying the hidden state until the animation completes.If the current behavior (instant close) is intentional for simplicity, this is fine as-is.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (10)
app/client/components/ui/collapsible.tsxapp/client/modules/repositories/components/create-repository-form.tsxapp/client/modules/repositories/components/repository-forms/advanced-tls-form.tsxapp/client/modules/repositories/components/repository-forms/index.tsapp/client/modules/repositories/components/repository-forms/rest-repository-form.tsxapp/client/modules/repositories/tabs/info.tsxapp/schemas/restic.tsapp/server/modules/repositories/repositories.service.tsapp/server/utils/restic.tspackage.json
💤 Files with no reviewable changes (1)
- app/client/modules/repositories/components/repository-forms/rest-repository-form.tsx
🧰 Additional context used
📓 Path-based instructions (7)
**/*.{ts,tsx,js,jsx,json}
📄 CodeRabbit inference engine (AGENTS.md)
Use Biome for code formatting and linting with
bunx biome check --write ., format only withbunx biome format --write ., or lint withbunx biome lint .
Files:
app/client/modules/repositories/components/create-repository-form.tsxapp/client/modules/repositories/components/repository-forms/index.tspackage.jsonapp/client/components/ui/collapsible.tsxapp/client/modules/repositories/tabs/info.tsxapp/schemas/restic.tsapp/client/modules/repositories/components/repository-forms/advanced-tls-form.tsxapp/server/modules/repositories/repositories.service.tsapp/server/utils/restic.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx,js,jsx}: Use tabs (not spaces) for indentation with a line width of 120 characters
Use double quotes for strings
Do not auto-organize imports - imports organization is disabled in Biome
All imports must include file extensions when targeting Node/Bun, as the project uses"type": "module"
Files:
app/client/modules/repositories/components/create-repository-form.tsxapp/client/modules/repositories/components/repository-forms/index.tsapp/client/components/ui/collapsible.tsxapp/client/modules/repositories/tabs/info.tsxapp/schemas/restic.tsapp/client/modules/repositories/components/repository-forms/advanced-tls-form.tsxapp/server/modules/repositories/repositories.service.tsapp/server/utils/restic.ts
app/client/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
app/client/**/*.{ts,tsx}: Client uses TanStack Query for server state management
Client uses Radix UI primitives with custom Tailwind styling
Use Server-Sent Events hook (use-server-events.ts) for real-time updates in the client
Files:
app/client/modules/repositories/components/create-repository-form.tsxapp/client/modules/repositories/components/repository-forms/index.tsapp/client/components/ui/collapsible.tsxapp/client/modules/repositories/tabs/info.tsxapp/client/modules/repositories/components/repository-forms/advanced-tls-form.tsx
app/schemas/**/*.ts
📄 CodeRabbit inference engine (AGENTS.md)
Prefer ArkType over Zod for runtime schema validation
Files:
app/schemas/restic.ts
app/server/modules/**/*.ts
📄 CodeRabbit inference engine (AGENTS.md)
Server follows a modular service-oriented architecture with controller-service-database pattern in each module
Files:
app/server/modules/repositories/repositories.service.ts
app/server/modules/repositories/**/*.ts
📄 CodeRabbit inference engine (AGENTS.md)
Local repositories are stored in
/var/lib/zerobyte/repositories/<repo-name>
Files:
app/server/modules/repositories/repositories.service.ts
app/server/utils/restic.ts
📄 CodeRabbit inference engine (AGENTS.md)
app/server/utils/restic.ts: Restic password file must have 0600 permissions and should never be exposed
UpdatebuildRepoUrl()inapp/server/utils/restic.tswhen adding a new repository backend
UpdatebuildEnv()inapp/server/utils/restic.tsto handle credentials and configuration when adding a new repository backend
Restic password file is stored in/var/lib/zerobyte/restic/passwordand auto-generated on first run
Restic cache is stored in/var/lib/zerobyte/restic/cache
Files:
app/server/utils/restic.ts
🧠 Learnings (10)
📚 Learning: 2025-12-28T17:31:39.171Z
Learnt from: CR
Repo: nicotsx/zerobyte PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-28T17:31:39.171Z
Learning: Applies to app/server/modules/repositories/repositories.dto.ts : Add DTO schemas in `app/server/modules/repositories/repositories.dto.ts` when adding a new repository backend
Applied to files:
app/client/modules/repositories/components/create-repository-form.tsxapp/client/modules/repositories/components/repository-forms/index.tsapp/client/modules/repositories/tabs/info.tsxapp/schemas/restic.ts
📚 Learning: 2025-12-22T19:49:56.761Z
Learnt from: nicotsx
Repo: nicotsx/zerobyte PR: 197
File: app/client/modules/repositories/components/create-repository-form.tsx:112-112
Timestamp: 2025-12-22T19:49:56.761Z
Learning: During the repository import flow, when users provide a full path to an existing restic repository, do not implement server-side path sanitization for this flow. Rely on Restic to validate the path; the operation will fail if the path does not point to a valid restic repository. This guidance applies to repository import components under app/client/modules/repositories (not just the specified file).
Applied to files:
app/client/modules/repositories/components/create-repository-form.tsxapp/client/modules/repositories/tabs/info.tsxapp/client/modules/repositories/components/repository-forms/advanced-tls-form.tsx
📚 Learning: 2025-12-28T17:31:39.171Z
Learnt from: CR
Repo: nicotsx/zerobyte PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-28T17:31:39.171Z
Learning: Applies to app/client/**/*.{ts,tsx} : Client uses Radix UI primitives with custom Tailwind styling
Applied to files:
package.json
📚 Learning: 2025-12-28T17:31:39.171Z
Learnt from: CR
Repo: nicotsx/zerobyte PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-28T17:31:39.171Z
Learning: Applies to app/server/utils/restic.ts : Update `buildRepoUrl()` in `app/server/utils/restic.ts` when adding a new repository backend
Applied to files:
app/client/modules/repositories/tabs/info.tsxapp/schemas/restic.tsapp/server/modules/repositories/repositories.service.tsapp/server/utils/restic.ts
📚 Learning: 2025-12-28T17:31:39.171Z
Learnt from: CR
Repo: nicotsx/zerobyte PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-28T17:31:39.171Z
Learning: Applies to app/server/utils/restic.ts : Update `buildEnv()` in `app/server/utils/restic.ts` to handle credentials and configuration when adding a new repository backend
Applied to files:
app/client/modules/repositories/tabs/info.tsxapp/schemas/restic.tsapp/server/modules/repositories/repositories.service.tsapp/server/utils/restic.ts
📚 Learning: 2025-12-28T17:31:39.171Z
Learnt from: CR
Repo: nicotsx/zerobyte PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-28T17:31:39.171Z
Learning: Applies to app/schemas/volumes.ts : Add schemas for new volume backends to `app/schemas/volumes.ts` and update `volumeConfigSchema` discriminated union
Applied to files:
app/schemas/restic.ts
📚 Learning: 2025-12-28T17:31:39.171Z
Learnt from: CR
Repo: nicotsx/zerobyte PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-28T17:31:39.171Z
Learning: Applies to app/server/utils/restic.ts : Restic password file is stored in `/var/lib/zerobyte/restic/password` and auto-generated on first run
Applied to files:
app/server/utils/restic.ts
📚 Learning: 2025-12-28T17:31:39.171Z
Learnt from: CR
Repo: nicotsx/zerobyte PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-28T17:31:39.171Z
Learning: Applies to app/server/utils/restic.ts : Restic password file must have 0600 permissions and should never be exposed
Applied to files:
app/server/utils/restic.ts
📚 Learning: 2025-12-28T17:31:39.171Z
Learnt from: CR
Repo: nicotsx/zerobyte PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-12-28T17:31:39.171Z
Learning: Applies to app/server/utils/restic.ts : Restic cache is stored in `/var/lib/zerobyte/restic/cache`
Applied to files:
app/server/utils/restic.ts
📚 Learning: 2025-11-29T15:55:09.080Z
Learnt from: nicotsx
Repo: nicotsx/zerobyte PR: 78
File: app/server/modules/repositories/repositories.service.ts:221-223
Timestamp: 2025-11-29T15:55:09.080Z
Learning: Restic's restore command has built-in path validation that prevents writing outside the specified --target directory. It normalizes and validates paths to reject any attempts to escape the target location, so application-level path sanitization is not required when using restic restore.
Applied to files:
app/server/utils/restic.ts
🧬 Code graph analysis (2)
app/client/modules/repositories/tabs/info.tsx (1)
app/schemas/restic.ts (1)
RepositoryConfig(97-97)
app/server/modules/repositories/repositories.service.ts (2)
app/server/core/config.ts (1)
config(32-32)app/server/utils/crypto.ts (1)
cryptoUtils(186-189)
🔇 Additional comments (11)
package.json (1)
36-36: LGTM!The addition of
@radix-ui/react-collapsiblealigns with the project's existing usage of Radix UI primitives for custom Tailwind styling, as per coding guidelines.app/server/utils/restic.ts (3)
208-217: LGTM!The global CACERT and insecure TLS handling is correctly implemented:
- CA certificate is written to a temp file with secure permissions (0600)
- Uses
cryptoUtils.resolveSecretfor proper decryption- Internal env vars (
RESTIC_CACERT,_INSECURE_TLS) correctly propagate toaddCommonArgs
877-897: LGTM!The
cleanupTemporaryKeysfunction correctly:
- Guards against deleting the default
RESTIC_PASS_FILE(line 886)- Cleans up the temporary CA certificate file (lines 894-896)
- Handles all temporary sensitive files consistently
906-912: LGTM!The
addCommonArgsfunction correctly adds the--insecure-tlsand--cacertflags to restic commands when the corresponding environment variables are set.app/client/modules/repositories/components/repository-forms/index.ts (1)
9-9: LGTM!The
AdvancedFormexport follows the existing barrel export pattern.app/client/modules/repositories/components/create-repository-form.tsx (1)
272-273: LGTM!The
AdvancedFormis correctly rendered after backend-specific forms, making TLS settings available for all repository types. This aligns with the schema changes that movedcacertandinsecureTlsto the base configuration.app/server/modules/repositories/repositories.service.ts (1)
37-40: LGTM!The
cacertfield is now correctly sealed unconditionally when present, aligning with the schema change that moved TLS settings to the base configuration. This ensures the CA certificate is encrypted for all backends, not just REST.app/client/modules/repositories/tabs/info.tsx (2)
62-63: LGTM!The type assertion to
RepositoryConfigprovides proper type safety for accessing TLS-related fields. This is a reasonable approach given thatrepository.configlikely comes from an API response with a generic type.
121-140: LGTM!The TLS settings display logic correctly:
- Shows CA certificate status when configured
- Uses defensive
"insecureTls" in configcheck for backwards compatibility with existing configs- Appropriately uses red/green indicators for TLS validation status
app/schemas/restic.ts (1)
17-22: LGTM!Moving
cacertandinsecureTlstobaseRepositoryConfigSchemais a clean architectural change that makes TLS settings available to all repository backends through composition. This aligns with the PR objective of supporting insecure TLS and CA certificates for self-hosted repositories across all backends.app/client/modules/repositories/components/repository-forms/advanced-tls-form.tsx (1)
21-112: Well-implemented interdependent form fields.The mutual exclusivity logic between
insecureTlsandcacertis correctly implemented with appropriate disabling and contextual tooltips. The external link has proper security attributes (rel="noopener noreferrer"), and the defensivefield.value ?? falsehandles undefined checkbox values gracefully.
Close #218
Summary by CodeRabbit
New Features
Behavior Changes
Dependencies
✏️ Tip: You can customize this high-level summary in your review settings.