From fd20ae50d805a0065c0778701d83d5f087f12131 Mon Sep 17 00:00:00 2001
From: GotthardG <51994228+GotthardG@users.noreply.github.com>
Date: Wed, 25 Mar 2026 14:08:00 +0100
Subject: [PATCH] modify tellupdater mTLS certificates

---
 src/aare/daq/aaredb.py      | 13 +++++++++----
 src/aare/daq/tellupdater.py | 21 ++++++++++++++-------
 2 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/src/aare/daq/aaredb.py b/src/aare/daq/aaredb.py
index 1e70683b..2d1b9785 100644
--- a/src/aare/daq/aaredb.py
+++ b/src/aare/daq/aaredb.py
@@ -46,14 +46,19 @@ class AareWrapper:
     ):
         configuration = aareDB.Configuration(host=host)
 
-
-        # Point this to the CA bundle that signed the server's certificate
+        # --- mTLS & SSL CONFIGURATION ---
+        # 1. Trust the Server (CA that signed mx-aaredb-dmz-01)
         configuration.verify_ssl = True
         configuration.ssl_ca_cert = "/etc/ssl/certs/secrets/mx-aaredb-dmz-01_Full_Chain_CA.pem"
-        configuration.cert_file =  "/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.crt"
-        configuration.key_file = "/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.key"
 
+        # 2. Present Machine Identity (The certs that worked in curl)
+        configuration.cert_file = "/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.crt"
+        configuration.key_file  = "/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.key"
+
+        # 3. Initialize the Client with this config
         self.client = aareDB.ApiClient(configuration)
+
+        # Identity Forwarding (Optional now that mTLS is active, but safe to keep)
         self.client.default_headers["X-Shared-Password"] = os.getenv("AAREDB_SHARED_PASSWORD")
         self.__host = host
         self.__tell_api = aareDB.TellsRunnerApi(self.client)
diff --git a/src/aare/daq/tellupdater.py b/src/aare/daq/tellupdater.py
index c87e1059..9792741d 100644
--- a/src/aare/daq/tellupdater.py
+++ b/src/aare/daq/tellupdater.py
@@ -167,22 +167,28 @@ def main():
     sse_thread = threading.Thread(target=listen_to_sse, daemon=True)
     sse_thread.start()
 
-    # Main thread runs websocket client loop
+    """
+        Main function to initiate WebSocket connection with mTLS.
+        """
     while True:
         try:
             import ssl
-            # 1. Create a proper SSL Context
+            # 1. Create a modern SSL Context for a TLS Client
             context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
 
-            # 2. Load the CA to trust the server
+            # 2. Load the CA to verify the NGINX server's identity
             context.load_verify_locations(cafile="/etc/ssl/certs/secrets/mx-aaredb-dmz-01_Full_Chain_CA.pem")
 
-            # 3. Load the Client Certificate (mTLS)
+            # 3. Load the Client Certificate and Key (mTLS)
+            # Using the 'dmz-01' paths that worked in your curl
             context.load_cert_chain(
                 certfile="/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.crt",
                 keyfile="/etc/ssl/certs/secrets/mx-x10sa-queue-01_from_dmz-01.key"
             )
 
+            # Optional: Ensure hostname matching is active (recommended)
+            context.check_hostname = True
+
             ws = websocket.WebSocketApp(
                 WS_URL,
                 header=WS_HEADERS,
@@ -192,13 +198,14 @@ def main():
                 on_open=on_open,
             )
 
-            # 4. Pass the context object to run_forever
+            # 4. Pass the context directly via sslopt
+            print(f"[WS][INFO] Connecting to {WS_URL} using mTLS...")
             ws.run_forever(sslopt={"context": context})
 
         except Exception as e:
-            print(f"[MAIN][ERROR] ws.run_forever() crashed with: {e}")
+            print(f"[MAIN][ERROR] WebSocket connection failed: {e}")
 
-        print("[WS][INFO] WebSocket connection lost. Reconnecting in 5 seconds...")
+        print("[WS][INFO] Reconnecting in 5 seconds...")
         time.sleep(5)
 
 if __name__ == "__main__":