Merge branch 'fix/emudhra-ca-trust' (#77) into release/2.11

lib/pleroma/emails/mailer.ex

@@ -68,6 +68,21 @@ defmodule Pleroma.Emails.Mailer do
   end
 
   defp parse_config(config) do
-    Swoosh.Mailer.parse_config(@otp_app, __MODULE__, @mailer_config, config)
+    @otp_app
+    |> Swoosh.Mailer.parse_config(__MODULE__, @mailer_config, config)
+    |> put_mua_cacertfile()
+  end
+
+  @doc false
+  # Mua otherwise trusts the OS CA store. Keep a CA that the admin set.
+  def put_mua_cacertfile(config) do
+    ssl = Keyword.get(config, :ssl, [])
+
+    if config[:adapter] == Swoosh.Adapters.Mua and
+         not Keyword.has_key?(ssl, :cacertfile) and not Keyword.has_key?(ssl, :cacerts) do
+      Keyword.put(config, :ssl, [{:cacertfile, CAStore.file_path()} | ssl])
+    else
+      config
+    end
   end
 end

lib/pleroma/http/adapter_helper.ex

@@ -46,6 +46,24 @@ defmodule Pleroma.HTTP.AdapterHelper do
     |> adapter_helper().options(uri)
   end
 
+  @doc """
+  The configured Tesla adapter with TLS options, for clients that do not go
+  through `Pleroma.HTTP`.
+  """
+  @spec tesla_adapter() :: module() | {module(), keyword()}
+  def tesla_adapter do
+    case adapter() do
+      Tesla.Adapter.Hackney ->
+        {Tesla.Adapter.Hackney, Pleroma.HTTP.TLS.put_hackney_ssl_options([])}
+
+      Tesla.Adapter.Gun ->
+        {Tesla.Adapter.Gun, certificates_verification: true}
+
+      adapter ->
+        adapter
+    end
+  end
+
   defp adapter, do: Application.get_env(:tesla, :adapter)
 
   defp adapter_helper do

lib/pleroma/search/qdrant_search.ex

@@ -160,7 +160,7 @@ defmodule Pleroma.Search.QdrantSearch.OpenAIClient do
   end
 
   defp client do
-    Tesla.client(middleware())
+    Tesla.client(middleware(), Pleroma.HTTP.AdapterHelper.tesla_adapter())
   end
 
   defp middleware do
@@ -191,7 +191,7 @@ defmodule Pleroma.Search.QdrantSearch.QdrantClient do
   end
 
   defp client do
-    Tesla.client(middleware())
+    Tesla.client(middleware(), Pleroma.HTTP.AdapterHelper.tesla_adapter())
   end
 
   defp middleware do