Repository navigation
feat: TLS and mutual TLS support, in-place reconfigure - #1
Merged
Merged
Conversation
Add tls.py, which builds an ssl.SSLContext from PEM text: optional private CA, optional client certificate/key (mutual TLS) and key passphrase. Server verification is always on; TLS 1.2 is the minimum. VERIFY_X509_STRICT is relaxed so private CAs whose certificates lack an Authority Key Identifier still work on Python 3.13+. Failures carry precise translation keys. Add the config keys and the English/German strings, including a new translations/en.json, which custom integrations need.
Add optional CA, client certificate, client key and passphrase fields to setup, validated against /version with the resulting SSL context. Add a reconfigure step that edits an entry in place (entities and history are kept), updates the unique ID when the URL changes, keeps stored files when a field is left empty and can remove all stored TLS material. Requires the file_upload dependency and Home Assistant 2024.11.0 for reconfigure support.
Build the SSL context at setup in the executor and pass it on both API calls; invalid stored TLS material is a ConfigEntryError. Entries without TLS data behave exactly as before. Failures are logged once per distinct reason (certificate verification, handshake, missing client certificate, refused, timeout, HTTP 401/403) with a recovery message.
Redact the client key, passphrase, certificate PEMs and proxy host. Include certificate subject/expiry summaries and live coordinator state.
Add pytest tests (TLS helper, config flow and reconfigure, end-to-end mTLS against a real local server, diagnostics redaction), a tests workflow, README documentation for TLS/mTLS and troubleshooting, updated contributor notes, and bump the version to 1.1.0.
Match the existing workflow, which pins its actions to full commit SHAs.
hassfest rejects URLs inside translation strings. Use a plain 'Proxy URL' label and describe the expected address in data_description instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds TLS and mutual TLS (client certificate) support so the integration can talk to a TLS-protected Docker socket proxy.
tls.py): builds anssl.SSLContextfrom PEM text. Optional private CA, optional client certificate and key, optional key passphrase. Server verification is always on and there is no skip-verify option. TLS 1.2 minimum.VERIFY_X509_STRICTis relaxed so private CAs without an Authority Key Identifier work on Python 3.13+./version. New Reconfigure step edits an entry in place, so entities and history are kept; the unique ID follows the URL.Compatibility
file_upload.Testing
pytest: 41 passed on Home Assistant 2026.2.3 / Python 3.13.