Sync with self-hosted sync server: Flatpak Certificate issue // Feature port from Android app

[overcuriousity]

I am running a self-hosted sync server.
This sync server is available on a local domain (e.g. anki.domain.internal) which is encrypted with a self-signed TLS certificate, signed by a self-signed root Certificate.

This is generally working across all my network, but not with the anki app. As I discovered by flatpak/flatpak#2721, this is a matter of properly calling a parameter during flatpak packaging to use the system trust anchor.

The anki Android app has another approach which might also work, providing an input field where the root cert can be supplied manually.

[iamllama]

@voczi would you happen to already have an addon that lets someone pass a cert to set_custom_certificate?

Since it's already integrated into anki, we might as well expose it in sync settings, but then again, the "anki is too complex" faction might get angry 😅, hence my bringing it up as an addon first

[overcuriousity]

Its actually only a matter to package it correctly in flatpak to properly use the network configurations available on the system.

Setting a different certificate or even installing an addon for that purpose should not be necessary and is just a workaround in that scope.

[iamllama]

Might be best to bring this up in https://github.com/flathub/net.ankiweb.Anki in that case

Still, feature parity with ankidroid and making it more convenient for folks to switch to self-hosting seem like plusses 🙂

[voczi]

@voczi would you happen to already have an addon that lets someone pass a cert to set_custom_certificate?

Nope, but you could just do:

from aqt import mw
mw.backend.set_custom_certificate("your cert")

So it shouldn't be that hard to make an addon from this.

Its actually only a matter to package it correctly in flatpak to properly use the network configurations available on the system.

It would probably be up to the maintainers of the Anki Flatpak to do this as llama said. But perhaps setting the SSL_CERT_FILE environment variable can serve as a workaround for now:
rustls/rustls-native-certs#32
#2324 (comment)