Merge pull request 'Remove insecure NODE_TLS_REJECT_UNAUTHORIZED=0 TLS workaround (follow-up to #56)' (#57) from feat/meshmonitor-connection into main

Merge pull request 'Remove insecure NODE_TLS_REJECT_UNAUTHORIZED=0 TLS workaround' (#57) from feat/meshmonitor-connection into main

CHANGELOG.md

@@ -7,7 +7,7 @@
   - Outbound: broadcasts ride `send({ text, channel })` on the pinned send channel (default 3, `MESH_SEND_CHANNEL`); DMs ride `send({ text, toNodeId: '!hex' })` on the primary channel in mesh terms. Gateway-rejected sends are recorded as failed tx history entries; HTTP 413 → 400 BadRequest, anything else → 503 ServiceUnavailable. `respond()` semantics are unchanged (rx → DM back to the sender unless the original was a broadcast, tx → its destination, injected → broadcast; always threaded via `replyId`).
   - Documented degradations vs the raw socket: `GET /api/device` is degraded (no device metadata / local+module config — only the firmware version when present in the node record); there is no idle-watchdog/periodic-reconnect (steady polling replaces it); world state (nodes/channels/telemetry) is not cleared when the status drops — each refreshes on its own interval.
 - **Test migration:** the `MeshService`, MCP controller, command auto-responder and battery-alert specs now drive the real service through `FakeMeshMonitorClient` — the fake TCP bridge is gone (`src/mesh/fake-bridge.ts` deleted, zero imports remain). The fake client's test API was widened to match: the constructor takes the source identity (`{ connected, nodeNum, longName, shortName }`), auto-seeds the bot's own node (the gateway always reports it), `pushNode` upserts by num, plus the existing `pushInbound`/`setDeliveryState`/`clearTraffic`/`sends[]` mirror. Suite: 17 files / 245 tests green (baseline 234).
-- **Docker:** compose drops `MESH_HOST`/`MESH_PORT` and adds `MESHMONITOR_API_TOKEN` (from `.env`, never committed), `MESHMONITOR_API_BASE` (default `https://meshmonitor.kkhost.pl/api/v1`), `MESHMONITOR_SOURCE` (default `default`), `MESHMONITOR_TIMEOUT_MS` (default 15000) and `NODE_TLS_REJECT_UNAUTHORIZED=0` (the gateway uses a self-signed certificate).
+- **Docker:** compose drops `MESH_HOST`/`MESH_PORT` and adds `MESHMONITOR_API_TOKEN` (from `.env`, never committed), `MESHMONITOR_API_BASE` (default `https://meshmonitor.kkhost.pl/api/v1`), `MESHMONITOR_SOURCE` (default `default`) and `MESHMONITOR_TIMEOUT_MS` (default 15000). The gateway uses a valid Let's Encrypt certificate, so normal TLS verification applies — no `NODE_TLS_REJECT_UNAUTHORIZED` workaround.
 
 ## v0.21.12 — 2026-10-06 08:01
 

docker-compose.yml

@@ -7,8 +7,6 @@ services:
       MESHMONITOR_API_BASE: ${MESHMONITOR_API_BASE:-https://meshmonitor.kkhost.pl/api/v1}
       MESHMONITOR_SOURCE: ${MESHMONITOR_SOURCE:-default}
       MESHMONITOR_TIMEOUT_MS: ${MESHMONITOR_TIMEOUT_MS:-15000}
-      # the gateway uses a self-signed certificate
-      NODE_TLS_REJECT_UNAUTHORIZED: '0'
       MESH_DB_PATH: ./data/mesh-bot.db
       MESH_POLL_MS: '1000'
       MESH_NOTIFY_CHANNEL: '${MESH_NOTIFY_CHANNEL:-3}'

src/main.ts

@@ -6,10 +6,6 @@ import { apiReference } from '@scalar/nestjs-api-reference';
 import * as pkg from '../package.json';
 import { AppModule } from './app.module.js';
 
-// the MeshMonitor gateway (https://meshmonitor.kkhost.pl) uses a self-signed certificate — accept it
-// (compose sets the same variable for the deployed stack; this covers local runs too)
-process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
-
 async function bootstrap() {
   const app = await NestFactory.create<NestExpressApplication>(AppModule);
   app.enableShutdownHooks();