---
import MainLayout from '../../layouts/main.astro';
---

<MainLayout title="CA Certificates - Gitea Mirror">
  <main class="max-w-5xl mx-auto px-4 py-12">
    <div class="sticky top-4 z-10 mb-6">
      <a
        href="/docs/"
        class="inline-flex items-center gap-2 px-3 py-1.5 rounded-md bg-card text-foreground hover:bg-muted transition-colors border border-border focus:ring-2 focus:ring-ring outline-none"
      >
        <span aria-hidden="true">&larr;</span> Back to Documentation
      </a>
    </div>

    <article class="bg-card rounded-2xl shadow-lg p-6 md:p-8 border border-border">
      <!-- Header -->
      <div class="mb-12 space-y-4">
        <div class="flex items-center gap-2 text-sm text-muted-foreground mb-2">
          <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/>
          </svg>
          <span>Security</span>
        </div>
        <h1 class="text-4xl font-bold tracking-tight">CA Certificates Configuration</h1>
        <p class="text-lg text-muted-foreground leading-relaxed max-w-4xl">
          Configure custom Certificate Authority (CA) certificates for connecting to self-signed or privately signed Gitea instances.
        </p>
      </div>

      <!-- Overview -->
      <section class="mb-12">
        <h2 class="text-2xl font-bold mb-6">Overview</h2>
        
        <div class="bg-gradient-to-r from-primary/5 to-transparent rounded-lg p-6 border-l-4 border-primary mb-6">
          <p class="text-base leading-relaxed">
            When your Gitea instance uses a self-signed certificate or a certificate signed by a private Certificate Authority (CA), 
            you need to configure Gitea Mirror to trust these certificates. This guide explains how to add custom CA certificates 
            for different deployment methods.
          </p>
        </div>

        <div class="bg-amber-500/10 border border-amber-500/20 rounded-lg p-4">
          <div class="flex gap-3">
            <div class="text-amber-600 dark:text-amber-500">
              <svg class="w-5 h-5 mt-0.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"/>
              </svg>
            </div>
            <div>
              <p class="font-semibold text-amber-600 dark:text-amber-500 mb-1">Important</p>
              <p class="text-sm">Without proper CA certificate configuration, you'll encounter SSL/TLS errors when connecting to Gitea instances with custom certificates.</p>
            </div>
          </div>
        </div>
      </section>

      <div class="my-12 h-px bg-border/50"></div>

      <!-- Common SSL/TLS Errors -->
      <section class="mb-12">
        <h2 class="text-2xl font-bold mb-6">Common SSL/TLS Errors</h2>
        
        <p class="text-muted-foreground mb-4">If you see any of these errors, you likely need to configure CA certificates:</p>
        
        <div class="space-y-3">
          {[
            'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
            'SELF_SIGNED_CERT_IN_CHAIN',
            'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
            'CERT_UNTRUSTED',
            'unable to verify the first certificate'
          ].map(error => (
            <div class="bg-red-500/10 border border-red-500/20 rounded-lg p-3">
              <code class="text-sm text-red-600 dark:text-red-500">{error}</code>
            </div>
          ))}
        </div>
      </section>

      <div class="my-12 h-px bg-border/50"></div>

      <!-- Docker Configuration -->
      <section class="mb-12">
        <h2 class="text-2xl font-bold mb-6">Docker Configuration</h2>
        
        <p class="text-muted-foreground mb-6">For Docker deployments, you have several options to add custom CA certificates:</p>

        <h3 class="text-xl font-semibold mb-4">Method 1: Volume Mount (Recommended)</h3>
        
        <div class="bg-card rounded-lg border border-border p-6 mb-6">
          <ol class="space-y-4">
            <li>
              <strong>1. Create a certificates directory</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>mkdir -p ./certs</code></pre>
              </div>
            </li>
            <li>
              <strong>2. Copy your CA certificate(s)</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>cp /path/to/your-ca-cert.crt ./certs/</code></pre>
              </div>
            </li>
            <li>
              <strong>3. Update docker-compose.yml</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>{`version: '3.8'
services:
  gitea-mirror:
    image: raylabs/gitea-mirror:latest
    volumes:
      - ./data:/app/data
      - ./certs:/usr/local/share/ca-certificates:ro
    environment:
      - NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/your-ca-cert.crt`}</code></pre>
              </div>
            </li>
            <li>
              <strong>4. Restart the container</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>docker-compose down && docker-compose up -d</code></pre>
              </div>
            </li>
          </ol>
        </div>

        <h3 class="text-xl font-semibold mb-4">Method 2: Custom Docker Image</h3>
        
        <div class="bg-card rounded-lg border border-border p-6">
          <p class="text-sm text-muted-foreground mb-4">For permanent certificate inclusion, create a custom Docker image:</p>
          
          <div class="bg-muted/30 rounded-lg p-4">
            <pre class="text-sm"><code>{`FROM raylabs/gitea-mirror:latest

# Copy CA certificates
COPY ./certs/*.crt /usr/local/share/ca-certificates/

# Update CA certificates
RUN update-ca-certificates

# Set environment variable
ENV NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/your-ca-cert.crt`}</code></pre>
          </div>
          
          <p class="text-sm text-muted-foreground mt-4">Build and use your custom image:</p>
          <div class="bg-muted/30 rounded-lg p-3 mt-2">
            <pre class="text-sm"><code>docker build -t my-gitea-mirror .</code></pre>
          </div>
        </div>
      </section>

      <div class="my-12 h-px bg-border/50"></div>

      <!-- Native/Bun Configuration -->
      <section class="mb-12">
        <h2 class="text-2xl font-bold mb-6">Native/Bun Configuration</h2>
        
        <p class="text-muted-foreground mb-6">For native Bun deployments, configure CA certificates using environment variables:</p>

        <h3 class="text-xl font-semibold mb-4">Method 1: Environment Variable</h3>
        
        <div class="bg-card rounded-lg border border-border p-6 mb-6">
          <ol class="space-y-4">
            <li>
              <strong>1. Export the certificate path</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>export NODE_EXTRA_CA_CERTS=/path/to/your-ca-cert.crt</code></pre>
              </div>
            </li>
            <li>
              <strong>2. Run Gitea Mirror</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>bun run start</code></pre>
              </div>
            </li>
          </ol>
        </div>

        <h3 class="text-xl font-semibold mb-4">Method 2: .env File</h3>
        
        <div class="bg-card rounded-lg border border-border p-6 mb-6">
          <p class="text-sm text-muted-foreground mb-4">Add to your .env file:</p>
          <div class="bg-muted/30 rounded-lg p-3">
            <pre class="text-sm"><code>NODE_EXTRA_CA_CERTS=/path/to/your-ca-cert.crt</code></pre>
          </div>
        </div>

        <h3 class="text-xl font-semibold mb-4">Method 3: System-wide CA Store</h3>
        
        <div class="bg-card rounded-lg border border-border p-6">
          <p class="text-sm text-muted-foreground mb-4">Add certificates to your system's CA store:</p>
          
          <div class="space-y-4">
            <div>
              <strong>Ubuntu/Debian:</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>{`sudo cp your-ca-cert.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates`}</code></pre>
              </div>
            </div>
            
            <div>
              <strong>RHEL/CentOS/Fedora:</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>{`sudo cp your-ca-cert.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust`}</code></pre>
              </div>
            </div>
            
            <div>
              <strong>macOS:</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>{`sudo security add-trusted-cert -d -r trustRoot \\
  -k /Library/Keychains/System.keychain your-ca-cert.crt`}</code></pre>
              </div>
            </div>
          </div>
        </div>
      </section>

      <div class="my-12 h-px bg-border/50"></div>

      <!-- LXC Configuration -->
      <section class="mb-12">
        <h2 class="text-2xl font-bold mb-6">LXC Container Configuration</h2>
        
        <p class="text-muted-foreground mb-6">For LXC deployments on Proxmox VE:</p>

        <div class="bg-card rounded-lg border border-border p-6">
          <ol class="space-y-4">
            <li>
              <strong>1. Enter the container</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>pct enter &lt;container-id&gt;</code></pre>
              </div>
            </li>
            <li>
              <strong>2. Create certificates directory</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>mkdir -p /usr/local/share/ca-certificates</code></pre>
              </div>
            </li>
            <li>
              <strong>3. Copy your CA certificate</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>cat > /usr/local/share/ca-certificates/your-ca.crt</code></pre>
              </div>
              <p class="text-xs text-muted-foreground mt-1">Paste your certificate content and press Ctrl+D</p>
            </li>
            <li>
              <strong>4. Update the systemd service</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>{`cat >> /etc/systemd/system/gitea-mirror.service << EOF
Environment="NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/your-ca.crt"
EOF`}</code></pre>
              </div>
            </li>
            <li>
              <strong>5. Reload and restart</strong>
              <div class="bg-muted/30 rounded-lg p-3 mt-2">
                <pre class="text-sm"><code>{`systemctl daemon-reload
systemctl restart gitea-mirror`}</code></pre>
              </div>
            </li>
          </ol>
        </div>
      </section>

      <div class="my-12 h-px bg-border/50"></div>

      <!-- Multiple CA Certificates -->
      <section class="mb-12">
        <h2 class="text-2xl font-bold mb-6">Multiple CA Certificates</h2>
        
        <p class="text-muted-foreground mb-6">If you need to trust multiple CA certificates:</p>

        <h3 class="text-xl font-semibold mb-4">Option 1: Bundle Certificates</h3>
        
        <div class="bg-card rounded-lg border border-border p-6 mb-6">
          <p class="text-sm text-muted-foreground mb-4">Combine multiple certificates into one file:</p>
          <div class="bg-muted/30 rounded-lg p-3">
            <pre class="text-sm"><code>{`cat ca-cert1.crt ca-cert2.crt ca-cert3.crt > ca-bundle.crt
export NODE_EXTRA_CA_CERTS=/path/to/ca-bundle.crt`}</code></pre>
          </div>
        </div>

        <h3 class="text-xl font-semibold mb-4">Option 2: System CA Store</h3>
        
        <div class="bg-card rounded-lg border border-border p-6">
          <p class="text-sm text-muted-foreground mb-4">Add all certificates to the system CA store (recommended for production):</p>
          <div class="bg-muted/30 rounded-lg p-3">
            <pre class="text-sm"><code>{`# Copy all certificates
cp *.crt /usr/local/share/ca-certificates/
update-ca-certificates`}</code></pre>
          </div>
        </div>
      </section>

      <div class="my-12 h-px bg-border/50"></div>

      <!-- Verification -->
      <section class="mb-12">
        <h2 class="text-2xl font-bold mb-6">Verifying Certificate Configuration</h2>
        
        <p class="text-muted-foreground mb-6">Test your certificate configuration:</p>

        <div class="bg-card rounded-lg border border-border p-6">
          <h4 class="font-semibold mb-4">1. Test Gitea Connection</h4>
          <p class="text-sm text-muted-foreground mb-3">Use the "Test Connection" button in the Gitea configuration section</p>
          
          <h4 class="font-semibold mb-4 mt-6">2. Check Logs</h4>
          <p class="text-sm text-muted-foreground mb-3">Look for SSL/TLS errors in the application logs:</p>
          
          <div class="space-y-3">
            <div>
              <strong class="text-sm">Docker:</strong>
              <div class="bg-muted/30 rounded-lg p-2 mt-1">
                <code class="text-sm">docker logs gitea-mirror</code>
              </div>
            </div>
            <div>
              <strong class="text-sm">Native:</strong>
              <div class="bg-muted/30 rounded-lg p-2 mt-1">
                <code class="text-sm">Check terminal output</code>
              </div>
            </div>
            <div>
              <strong class="text-sm">LXC:</strong>
              <div class="bg-muted/30 rounded-lg p-2 mt-1">
                <code class="text-sm">journalctl -u gitea-mirror -f</code>
              </div>
            </div>
          </div>
          
          <h4 class="font-semibold mb-4 mt-6">3. Manual Certificate Test</h4>
          <p class="text-sm text-muted-foreground mb-3">Test SSL connection directly:</p>
          <div class="bg-muted/30 rounded-lg p-3">
            <pre class="text-sm"><code>openssl s_client -connect your-gitea-domain.com:443 -CAfile /path/to/ca-cert.crt</code></pre>
          </div>
        </div>
      </section>

      <div class="my-12 h-px bg-border/50"></div>

      <!-- Best Practices -->
      <section class="mb-12">
        <h2 class="text-2xl font-bold mb-6">Best Practices</h2>
        
        <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
          {[
            {
              icon: '🔒',
              title: 'Certificate Security',
              items: [
                'Keep CA certificates secure',
                'Use read-only mounts in Docker',
                'Limit certificate file permissions',
                'Regularly update certificates'
              ]
            },
            {
              icon: '📁',
              title: 'Certificate Management',
              items: [
                'Use descriptive certificate filenames',
                'Document certificate purposes',
                'Track certificate expiration dates',
                'Maintain certificate backups'
              ]
            },
            {
              icon: '🏢',
              title: 'Production Deployment',
              items: [
                'Use proper SSL certificates when possible',
                'Consider Let\'s Encrypt for public instances',
                'Implement certificate rotation procedures',
                'Monitor certificate expiration'
              ]
            },
            {
              icon: '🔍',
              title: 'Troubleshooting',
              items: [
                'Verify certificate format (PEM)',
                'Check certificate chain completeness',
                'Ensure proper file permissions',
                'Test with openssl commands'
              ]
            }
          ].map(section => (
            <div class="bg-card rounded-lg border border-border p-4">
              <div class="flex items-center gap-3 mb-3">
                <span class="text-2xl">{section.icon}</span>
                <h4 class="font-semibold">{section.title}</h4>
              </div>
              <ul class="space-y-1 text-sm text-muted-foreground">
                {section.items.map(item => (
                  <li class="flex gap-2">
                    <span>•</span>
                    <span>{item}</span>
                  </li>
                ))}
              </ul>
            </div>
          ))}
        </div>
      </section>

      <div class="my-12 h-px bg-border/50"></div>

      <!-- Common Issues -->
      <section>
        <h2 class="text-2xl font-bold mb-6">Common Issues and Solutions</h2>
        
        <div class="space-y-4">
          <div class="bg-amber-500/10 border border-amber-500/20 rounded-lg p-4">
            <h4 class="font-semibold text-amber-600 dark:text-amber-500 mb-2">Certificate not being recognized</h4>
            <ul class="space-y-2 text-sm">
              <li class="flex gap-2">
                <span class="text-amber-600 dark:text-amber-500">•</span>
                <span>Ensure the certificate is in PEM format</span>
              </li>
              <li class="flex gap-2">
                <span class="text-amber-600 dark:text-amber-500">•</span>
                <span>Check that NODE_EXTRA_CA_CERTS points to the correct file</span>
              </li>
              <li class="flex gap-2">
                <span class="text-amber-600 dark:text-amber-500">•</span>
                <span>Restart the application after adding certificates</span>
              </li>
            </ul>
          </div>

          <div class="bg-amber-500/10 border border-amber-500/20 rounded-lg p-4">
            <h4 class="font-semibold text-amber-600 dark:text-amber-500 mb-2">Still getting SSL errors</h4>
            <ul class="space-y-2 text-sm">
              <li class="flex gap-2">
                <span class="text-amber-600 dark:text-amber-500">•</span>
                <span>Verify the complete certificate chain is included</span>
              </li>
              <li class="flex gap-2">
                <span class="text-amber-600 dark:text-amber-500">•</span>
                <span>Check if intermediate certificates are needed</span>
              </li>
              <li class="flex gap-2">
                <span class="text-amber-600 dark:text-amber-500">•</span>
                <span>Ensure the certificate matches the server hostname</span>
              </li>
            </ul>
          </div>

          <div class="bg-amber-500/10 border border-amber-500/20 rounded-lg p-4">
            <h4 class="font-semibold text-amber-600 dark:text-amber-500 mb-2">Certificate expired</h4>
            <ul class="space-y-2 text-sm">
              <li class="flex gap-2">
                <span class="text-amber-600 dark:text-amber-500">•</span>
                <span>Check certificate validity: <code class="bg-amber-500/10 px-1 rounded">openssl x509 -in cert.crt -noout -dates</code></span>
              </li>
              <li class="flex gap-2">
                <span class="text-amber-600 dark:text-amber-500">•</span>
                <span>Update with new certificate from your CA</span>
              </li>
              <li class="flex gap-2">
                <span class="text-amber-600 dark:text-amber-500">•</span>
                <span>Restart Gitea Mirror after updating</span>
              </li>
            </ul>
          </div>
        </div>
      </section>
    </article>
  </main>
</MainLayout>