From 6a0761250980111e6dfbb7627cafd2772593830f Mon Sep 17 00:00:00 2001 From: GotthardG <51994228+GotthardG@users.noreply.github.com> Date: Tue, 24 Mar 2026 15:39:21 +0100 Subject: [PATCH] Enable mandatory mTLS for SSE connections in `tellupdater` by configuring client certificates and CA root files. --- src/aare/daq/tellupdater.py | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/src/aare/daq/tellupdater.py b/src/aare/daq/tellupdater.py index 6c21f535..13bf63af 100644 --- a/src/aare/daq/tellupdater.py +++ b/src/aare/daq/tellupdater.py @@ -38,12 +38,25 @@ def listen_to_sse(): print(f"[SSE][WARN] No TELL URL configured – SSE listener not started. (tell_client.url={tell_client.url})") return sse_url = tell_client.url + "/events" - + while True: try: print(f"[SSE][INFO] Attempting to connect to {sse_url}...") - # Use URL directly for sseclient variants that manage their own HTTP stream. - client = sseclient.SSEClient(sse_url) + + # --- MANDATORY mTLS FOR mx-db-01 --- + import requests + cert_pair = ( + "/etc/ssl/certs/secrets/mx-x10sa-queue-01.crt", + "/etc/ssl/certs/secrets/mx-x10sa-queue-01.key" + ) + # The DigiCert root you have on the machine + ca_root = "/etc/ssl/certs/secrets/mx-db-01_DigiCert_Global_Root_G2.pem" + + # Open the stream using the certificates required by Nginx + response = requests.get(sse_url, stream=True, cert=cert_pair, verify=ca_root) + response.raise_for_status() + + client = sseclient.SSEClient(response) print("[SSE][listen_to_sse] Initial detected pucks fetch on connect") handle_tell_change_event()