chore : bump version to v1.9.52

fix(security) : passe le MCP inventory en HTTPS dans .mcp.json
Le endpoint était en http:// : les credentials statiques (X-Profile-Id / X-Profile-Password) transitaient en clair sur le premier hop avant la redirection 301 vers https. Le serveur sert déjà le TLS (CA MALIO embarquée côté image prod), donc on bascule l'URL en https://.
2026-06-29 14:40:33 +00:00 · 2026-06-29 16:40:23 +02:00 · 2026-06-29 14:38:52 +00:00 · 2026-06-29 16:38:38 +02:00
4 changed files with 39 additions and 3 deletions
@@ -2,7 +2,7 @@
    "mcpServers": {
        "inventory": {
            "type": "http",
-            "url": "http://inventory.malio-dev.fr/_mcp",
+            "url": "https://inventory.malio-dev.fr/_mcp",
            "headers": {
                "X-Profile-Id": "admin-default-profile",
                "X-Profile-Password": "A123"
@@ -1,2 +1,2 @@
 parameters:
-    app.version: '1.9.50'
+    app.version: '1.9.52'
@@ -58,10 +58,15 @@ FROM php:8.4-fpm AS production

 RUN apt-get update && apt-get install -y \
        libicu-dev libpq-dev libpng-dev libzip-dev libxml2-dev \
-        nginx supervisor qpdf \
+        nginx supervisor qpdf ca-certificates \
    && docker-php-ext-install -j$(nproc) intl pdo_pgsql zip gd opcache \
    && rm -rf /var/lib/apt/lists/*

+# CA racine interne MALIO (auto-signée) — permet au SDK Sentry/HttpClient de
+# joindre les services HTTPS internes (ex. GlitchTip sur logs.malio-dev.fr).
+COPY infra/prod/malio-dev-root-ca.crt /usr/local/share/ca-certificates/malio-dev-root-ca.crt
+RUN update-ca-certificates
+
 # PHP production config
 RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"

@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFZzCCA0+gAwIBAgIUOiZigxwgIgtLipnLnu4eSgItc5MwDQYJKoZIhvcNAQEL
+BQAwQzELMAkGA1UEBhMCRlIxEjAQBgNVBAoMCU1BTElPLURFVjEgMB4GA1UEAwwX
+TUFMSU8tREVWIExvY2FsIFJvb3QgQ0EwHhcNMjYwNjI1MTYxMjIwWhcNMzYwNjIy
+MTYxMjIwWjBDMQswCQYDVQQGEwJGUjESMBAGA1UECgwJTUFMSU8tREVWMSAwHgYD
+VQQDDBdNQUxJTy1ERVYgTG9jYWwgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBALqHXVWEae9aKtveLfSpxYy9RS0Aslw2Ls9+LWI33lpMRs02
+QssE9wquf3WGjz8NnHUWl5RM0QHC0DOCCddcbnRBciDRJeTaU43IGdNg+TSY+7aM
+3t/jysZrpc/eu/udlIs7npCPaOGnRiuGN68Fkf9Q70FtmaASpusUe7J3jKDinznr
+R2hARplO4OF01tFauu039A4yudLrZTUFTldicuZ6a5U3NhajgfNZA+pyJqvL3tLT
+lXG3KupPD9BsbWe4zSM96CmyHM22QNlcL+M5XG5+EtDtM07tkDcyxFOsREjQHvSQ
+NH+7h6G/QBHHKkYJhdyiuvpj6b5tEJBM2PVgy1T2JX5TuOBOLx6HvHLbNjUY/JI5
+0sIjnHbeybQCOfnKNAwidtnqjAfVg+XJ9UZCiGJOeRJOdN5isvvqEKydsX4ouCTj
+89kwBbfCJeCS6BiadvNFUwnM0PksV0ovnOiUEEAPHRiP74jZ3IvH95BEwiZzyLpy
+tXiJMW7cJMaqlT3jNwq3P00irfrpJNy4S1Mg2cBQh5ucv+PcMBfQT8YiarzlTQJo
+saksh/2C43WH+qIFAL2aeD+rKReVBZcGa1XOBI8FUJTu3rLd37+iS4N2BUKq4fWo
+FttuX5NOfeU3BRDLlCJ2AXau7o0czVy896R9iZTfBJC95QWD07PdHgoctuexAgMB
+AAGjUzBRMB0GA1UdDgQWBBRNU0WsMg/pqo5XF/WXx78GrAzD5TAfBgNVHSMEGDAW
+gBRNU0WsMg/pqo5XF/WXx78GrAzD5TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+DQEBCwUAA4ICAQBFXsuT7Rm2oJBlWT/RsJtmWr95NoFLHovVDycgM8Vjm+E8hv/m
+AcSjPjZDmXQLOrN31T/XUAs0nURHxSFgVzdIKpq2gOlGgHkZRMAW/iTON9Cqjn81
+Arjp5fjAJyFkoCiT3eTOElpteF4NhL8xMFaOg1Y2CEfOYO9OZR7Z38HdB6IArVwr
+W3Dxq3DPtarCeo1k8SHJmJzUduYCltV8urB43gIiI2Hqd7aAlpkTfDhruKxxr7sJ
+3/TpemJDCN9m8XMv2QvxqpMwH6EXg/7oqit5k0MvD445f3xt9vZydmV/x6F7u/A/
+gJitN+ixA4AKv7Lw210vaupiChqdY+78TXgLoPJ2/l2QPWG/R7Fb4yNZ2rEd6lyt
+KLPxHDcdZetFnyqyaoB2SNtLx9hNUE5G3udU6DkNhDfQlDhqEG4f7GAInOu/cMWE
+2uiIUEjcGSLM+XrrTFRc1tdXy6hnu+sw5ckvhwJ+kjah/pVGz21/y5a0p42AUznI
+iN7HBV8YaSkeJLvBPnfakUAat1R98e0l72DucHe8RF44NmZCywpaUBsTpNy+bO2f
+atqp4/ZEGJJlJ38rLv9bAuwr6d8x6T+m0oHknqtJHcWfO0kr4l3Lxsd8mRpGgmBe
+zOjqjrat4vSc04Rqic4UV2IEoWCiSS/TSiBx8JAB6Ck0+YR9dUgXVQsFFg==
+-----END CERTIFICATE-----
Author	SHA1	Message	Date
gitea-actions	0de63d3136	chore : bump version to v1.9.52 Auto Tag Develop / tag (push) Successful in 12s Details Build & Push Docker Image / build (push) Successful in 1m42s Details	2026-06-29 14:40:33 +00:00
Matthieu	35f3feb59c	fix(security) : passe le MCP inventory en HTTPS dans .mcp.json Auto Tag Develop / tag (push) Successful in 9s Details Le endpoint était en http:// : les credentials statiques (X-Profile-Id / X-Profile-Password) transitaient en clair sur le premier hop avant la redirection 301 vers https. Le serveur sert déjà le TLS (CA MALIO embarquée côté image prod), donc on bascule l'URL en https://.	2026-06-29 16:40:23 +02:00
gitea-actions	e0ac8e75be	chore : bump version to v1.9.51 Auto Tag Develop / tag (push) Successful in 6s Details Build & Push Docker Image / build (push) Failing after 19s Details	2026-06-29 14:38:52 +00:00
Matthieu	7cad0f933f	fix(infra) : embarque la CA racine MALIO dans l'image prod Auto Tag Develop / tag (push) Successful in 13s Details Le SDK Sentry (back) valide le TLS de GlitchTip (logs.malio-dev.fr, certificat signé par la CA interne MALIO auto-signée). Sans cette CA dans le trust store du conteneur, le handshake échoue et l'event est silencieusement abandonné (sentry:test -> "Message not sent"). On installe ca-certificates, on copie la root CA et on lance update-ca-certificates, comme côté Lesstime.	2026-06-29 16:38:38 +02:00