From 2e4adb5eff521d862ae2a13822a7166ce7fe1d55 Mon Sep 17 00:00:00 2001
From: GotthardG <51994228+GotthardG@users.noreply.github.com>
Date: Tue, 24 Mar 2026 15:01:46 +0100
Subject: [PATCH] Enable mTLS support for WebSocket connections in
 `tellupdater` by configuring certificate and key files.

---
 src/aare/daq/tellupdater.py | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/aare/daq/tellupdater.py b/src/aare/daq/tellupdater.py
index 2616ff4e..6addb2b5 100644
--- a/src/aare/daq/tellupdater.py
+++ b/src/aare/daq/tellupdater.py
@@ -147,6 +147,7 @@ def on_close(ws, close_status_code, close_msg):
 def on_open(ws):
     print("[WS][OPEN] WebSocket opened.")
 
+
 def main():
     # Start SSE listener in a separate background thread
     sse_thread = threading.Thread(target=listen_to_sse, daemon=True)
@@ -163,7 +164,16 @@ def main():
                 on_close=on_close,
                 on_open=on_open,
             )
-            ws.run_forever(sslopt={"cert_reqs": 0})
+
+            # --- mTLS CERTIFICATES ADDED HERE --
+            import ssl
+            ssl_settings = {
+                "certfile": "/etc/ssl/certs/secrets/mx-x10sa-queue-01.crt",
+                "keyfile": "/etc/ssl/certs/secrets/mx-x10sa-queue-01.key",
+                "cert_reqs": ssl.CERT_REQUIRED
+            }
+
+            ws.run_forever(sslopt=ssl_settings)
         except Exception as e:
             print(f"[MAIN][ERROR] ws.run_forever() crashed with: {e}")