From 7820b8e0bfdf5b4ece042cf40133575c2aab93ff Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Thu, 22 Oct 2026 09:13:02 +0200
Subject: [PATCH] immich: use a CA bundle without the compromised eMudhra roots

Mount patched-ca-bundle (see ca-bundle/) over /etc/ssl/certs so it stops trusting the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com). The server gets --use-openssl-ca for Node, machine-learning points requests at the bundle instead of certifi.
---
 immich/helm-immich.yaml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/immich/helm-immich.yaml b/immich/helm-immich.yaml
index ae8ec9f..0c11a02 100644
--- a/immich/helm-immich.yaml
+++ b/immich/helm-immich.yaml
@@ -91,6 +91,20 @@ spec:
                     image:
                       repository: ghcr.io/immich-app/immich-server
                       pullPolicy: IfNotPresent
+                    # Node trusts its built-in roots, which still include the
+                    # ones above the compromised eMudhra intermediates. Use
+                    # patched-ca-bundle through OpenSSL until Node ships a fix.
+                    env:
+                      NODE_OPTIONS: --use-openssl-ca
+                      SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
+            persistence:
+              patched-ca-bundle:
+                enabled: true
+                type: configMap
+                name: patched-ca-bundle
+                globalMounts:
+                  - path: /etc/ssl/certs
+                    readOnly: true
             ingress:
               main:
                 enabled: true
@@ -135,7 +149,18 @@ spec:
                       TRANSFORMERS_CACHE: /cache
                       HF_XET_CACHE: /cache/huggingface-xet
                       MPLCONFIGDIR: /cache/matplotlib-config
+                      # Trust store without the compromised eMudhra
+                      # intermediates; requests would otherwise use certifi.
+                      SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
+                      REQUESTS_CA_BUNDLE: /etc/ssl/certs/ca-certificates.crt
             persistence:
+              patched-ca-bundle:
+                enabled: true
+                type: configMap
+                name: patched-ca-bundle
+                globalMounts:
+                  - path: /etc/ssl/certs
+                    readOnly: true
               cache:
                 enabled: true
                 size: 10Gi