[PR #132] [MERGED] fix: respect ExternalSSLInsecure config in Langfuse client TLS #180

New Issue

2026-06-06T22:09:35-04:00

yindo commented

2026-06-06 22:09:35 -04:00

📋 Pull Request Information

Original PR: https://github.com/vxcontrol/pentagi/pull/132
Author: @mason5052
Created: 2/22/2026
Status: ✅ Merged
Merged: 2/23/2026
Merged by: @asdek

Base: feature/project_improvements ← Head: fix/langfuse-tls-respect-config

📝 Commits (2)

9cedec5 fix: respect ExternalSSLInsecure config in Langfuse client TLS
86fc81b fix: use SystemCertPool as base when loading custom CA for Langfuse

📊 Changes

1 file changed (+19 additions, -1 deletions)

View changed files

📝 backend/pkg/observability/lfclient.go (+19 -1)

📄 Description

Description of the Change

Problem

NewLangfuseClient receives *config.Config which provides two environment-variable-controlled fields for external TLS behavior:

ExternalSSLInsecure (EXTERNAL_SSL_INSECURE, default false) - disables TLS verification
ExternalSSLCAPath (EXTERNAL_SSL_CA_PATH, default empty) - path to a custom CA certificate bundle

The previous implementation hardcoded InsecureSkipVerify: true, ignoring both config fields entirely. As a result:

TLS certificate verification was always disabled for Langfuse connections, even when EXTERNAL_SSL_INSECURE was not set (its secure default is false).
Custom CA certificates configured via EXTERNAL_SSL_CA_PATH were never applied to Langfuse HTTP connections, making them ineffective for private Langfuse deployments with self-signed certificates.

The same pattern was already correctly implemented in backend/pkg/system/utils.go for LLM provider HTTP clients.

Solution

Mirror the existing pattern from backend/pkg/system/utils.go:

Set InsecureSkipVerify from cfg.ExternalSSLInsecure (secure by default: false)
When cfg.ExternalSSLCAPath is set, read the PEM file, parse it into an x509.CertPool, and set it as RootCAs on the TLS config

Users who have EXTERNAL_SSL_INSECURE=true in their environment retain the previous behavior.

Ref: #101

Type of Change

Bug fix (non-breaking change which fixes an issue)
Security update

Areas Affected

Analytics Platform (Langfuse)

Testing and Verification

Test Steps

With EXTERNAL_SSL_INSECURE=false (default): Langfuse TLS certificate is now verified
With EXTERNAL_SSL_INSECURE=true: existing behavior preserved (InsecureSkipVerify=true)
With EXTERNAL_SSL_CA_PATH=/path/to/ca.pem: custom CA is loaded and applied to Langfuse connections

Security Considerations

Default secure: TLS verification is now ON by default, consistent with EXTERNAL_SSL_INSECURE default of false
No breaking change: Users who previously worked with hardcoded InsecureSkipVerify: true should set EXTERNAL_SSL_INSECURE=true if their Langfuse instance uses a self-signed certificate
Custom CA support: Private Langfuse deployments can now properly use EXTERNAL_SSL_CA_PATH for certificate validation without disabling TLS

Deployment Notes

If your self-hosted Langfuse instance uses a self-signed or private CA certificate:

Set EXTERNAL_SSL_CA_PATH=/path/to/ca.pem for proper certificate validation, OR
Set EXTERNAL_SSL_INSECURE=true to preserve the previous behavior

Checklist

Code Quality

My code follows the project's coding standards
All new and existing tests pass
I have run go fmt and go vet (for Go code)

Security

I have considered security implications
Changes maintain or improve the security model

Compatibility

Changes are backward compatible

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/vxcontrol/pentagi/pull/132 **Author:** [@mason5052](https://github.com/mason5052) **Created:** 2/22/2026 **Status:** ✅ Merged **Merged:** 2/23/2026 **Merged by:** [@asdek](https://github.com/asdek) **Base:** `feature/project_improvements` ← **Head:** `fix/langfuse-tls-respect-config` --- ### 📝 Commits (2) - [`9cedec5`](https://github.com/vxcontrol/pentagi/commit/9cedec5d2906fa36c51f162d5b23af5a2a5bf8ea) fix: respect ExternalSSLInsecure config in Langfuse client TLS - [`86fc81b`](https://github.com/vxcontrol/pentagi/commit/86fc81b0d2ea27d86d621dc7e45e579551b49700) fix: use SystemCertPool as base when loading custom CA for Langfuse ### 📊 Changes **1 file changed** (+19 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `backend/pkg/observability/lfclient.go` (+19 -1) </details> ### 📄 Description ## Description of the Change ### Problem `NewLangfuseClient` receives `*config.Config` which provides two environment-variable-controlled fields for external TLS behavior: - `ExternalSSLInsecure` (`EXTERNAL_SSL_INSECURE`, default `false`) - disables TLS verification - `ExternalSSLCAPath` (`EXTERNAL_SSL_CA_PATH`, default empty) - path to a custom CA certificate bundle The previous implementation hardcoded `InsecureSkipVerify: true`, ignoring both config fields entirely. As a result: 1. TLS certificate verification was **always disabled** for Langfuse connections, even when `EXTERNAL_SSL_INSECURE` was not set (its secure default is `false`). 2. Custom CA certificates configured via `EXTERNAL_SSL_CA_PATH` were **never applied** to Langfuse HTTP connections, making them ineffective for private Langfuse deployments with self-signed certificates. The same pattern was already correctly implemented in `backend/pkg/system/utils.go` for LLM provider HTTP clients. ### Solution Mirror the existing pattern from `backend/pkg/system/utils.go`: 1. Set `InsecureSkipVerify` from `cfg.ExternalSSLInsecure` (secure by default: `false`) 2. When `cfg.ExternalSSLCAPath` is set, read the PEM file, parse it into an `x509.CertPool`, and set it as `RootCAs` on the TLS config Users who have `EXTERNAL_SSL_INSECURE=true` in their environment retain the previous behavior. Ref: #101 ### Type of Change - [x] Bug fix (non-breaking change which fixes an issue) - [x] Security update ### Areas Affected - [x] Analytics Platform (Langfuse) ### Testing and Verification #### Test Steps 1. With `EXTERNAL_SSL_INSECURE=false` (default): Langfuse TLS certificate is now verified 2. With `EXTERNAL_SSL_INSECURE=true`: existing behavior preserved (InsecureSkipVerify=true) 3. With `EXTERNAL_SSL_CA_PATH=/path/to/ca.pem`: custom CA is loaded and applied to Langfuse connections ### Security Considerations - **Default secure**: TLS verification is now ON by default, consistent with `EXTERNAL_SSL_INSECURE` default of `false` - **No breaking change**: Users who previously worked with hardcoded `InsecureSkipVerify: true` should set `EXTERNAL_SSL_INSECURE=true` if their Langfuse instance uses a self-signed certificate - **Custom CA support**: Private Langfuse deployments can now properly use `EXTERNAL_SSL_CA_PATH` for certificate validation without disabling TLS ### Deployment Notes If your self-hosted Langfuse instance uses a self-signed or private CA certificate: - Set `EXTERNAL_SSL_CA_PATH=/path/to/ca.pem` for proper certificate validation, OR - Set `EXTERNAL_SSL_INSECURE=true` to preserve the previous behavior ### Checklist #### Code Quality - [x] My code follows the project's coding standards - [x] All new and existing tests pass - [x] I have run `go fmt` and `go vet` (for Go code) #### Security - [x] I have considered security implications - [x] Changes maintain or improve the security model #### Compatibility - [x] Changes are backward compatible --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

yindo added the pull-request label 2026-06-06 22:09:35 -04:00

yindo closed this issue

2026-06-06 22:09:35 -04:00

yindo referenced this issue

2026-06-06 22:09:44 -04:00

[PR #180] [MERGED] test: add unit tests for repeatingDetector and clearCallArguments #217

yindo referenced this issue

2026-06-06 22:09:49 -04:00

[PR #206] [MERGED] Agent Supervision System and Open Source Model Enhancements #235

Sign in to join this conversation.