From 767facc5e2bb5f8aa6845bd13964ad0f19090fca Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Thu, 22 Oct 2026 09:13:02 +0200
Subject: [PATCH] bolletjestrui: use a CA bundle without the compromised
 eMudhra roots

Mount patched-ca-bundle (see ca-bundle/) over /etc/ssl/certs so it stops trusting the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com). Node uses its built-in roots, so also switch it to OpenSSL's store with --use-openssl-ca.
---
 bolletjestrui/bolletjestrui-deployment.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/bolletjestrui/bolletjestrui-deployment.yaml b/bolletjestrui/bolletjestrui-deployment.yaml
index 24692e0..6ae047d 100644
--- a/bolletjestrui/bolletjestrui-deployment.yaml
+++ b/bolletjestrui/bolletjestrui-deployment.yaml
@@ -69,6 +69,13 @@ spec:
                   optional: true
             - name: VAPID_SUBJECT
               value: mailto:ruben.hensen@protonmail.com
+            # Node trusts its built-in roots, which still include the ones
+            # above the compromised eMudhra intermediates. Use
+            # patched-ca-bundle through OpenSSL instead until Node ships a fix.
+            - name: NODE_OPTIONS
+              value: --use-openssl-ca
+            - name: SSL_CERT_FILE
+              value: /etc/ssl/certs/ca-certificates.crt
           resources:
             requests:
               memory: "128Mi"
@@ -91,8 +98,14 @@ spec:
           volumeMounts:
             - mountPath: /app/data
               name: data
+            - mountPath: /etc/ssl/certs
+              name: patched-ca-bundle
+              readOnly: true
       restartPolicy: Always
       volumes:
         - name: data
           persistentVolumeClaim:
             claimName: bolletjestrui-data
+        - name: patched-ca-bundle
+          configMap:
+            name: patched-ca-bundle