From c4ff1caf09b49f9f0799a76c8a20364d039554b2 Mon Sep 17 00:00:00 2001
From: Patrick Buckley <eous@users.noreply.github.com>
Date: Mon, 30 Mar 2026 05:57:36 -0700
Subject: [PATCH] fix: sync actual TLS state to ConfigStore on console startup
 (#258)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: sync actual TLS state to ConfigStore on console startup

The console writes tls.enabled to the DB but never clears it when TLS
init fails or isn't configured.  Server nodes read the stale DB value
and attempt TLS negotiation with a non-TLS console, producing noisy
SSL errors on every startup.

Console now syncs the actual TLS state after init: if TLS succeeded,
tls.enabled=true; if it failed or wasn't attempted, tls.enabled=false.
Server TLS failure log reduced from full traceback to one-line warning.

* fix: sync TLS state to ConfigStore on console startup

Console now writes the definitive TLS state to ConfigStore so server
nodes don't attempt TLS against a non-TLS console:

- TLS init succeeded → write true
- TLS not configured (DB false/unset) → write false (definitive)
- TLS configured (DB true) but init failed → don't overwrite
  (transient failure shouldn't permanently disable)

Server TLS warning reduced to one line with exception type, full
traceback available at debug level.
---
 turnstone/console/server.py | 23 +++++++++++++++++++++++
 turnstone/server.py         |  9 +++++++--
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/turnstone/console/server.py b/turnstone/console/server.py
index 3ff5548f..25e38e4a 100644
--- a/turnstone/console/server.py
+++ b/turnstone/console/server.py
@@ -5869,8 +5869,31 @@ def main() -> None:
                 log.info("TLS enabled")
         except ImportError:
             log.warning("TLS enabled but lacme not installed — pip install turnstone[tls]")
+            tls_mgr = None
         except Exception:
             log.warning("TLS initialization failed", exc_info=True)
+            tls_mgr = None
+
+        # Sync TLS state to ConfigStore so server nodes see the correct value.
+        # Three cases:
+        # 1. TLS succeeded → write true
+        # 2. TLS not configured (DB false/unset) → write false (definitive)
+        # 3. TLS configured (DB true) but init failed → don't overwrite
+        #    (transient failure shouldn't permanently disable TLS)
+        try:
+            db_enabled = _cs.get("tls.enabled")
+            if tls_mgr is not None:
+                if not db_enabled:
+                    _cs.set("tls.enabled", True, changed_by="console-startup")
+            elif db_enabled:
+                log.warning(
+                    "tls.enabled is true in ConfigStore but TLS init failed — "
+                    "server nodes will attempt TLS and fall back to plain HTTP"
+                )
+            else:
+                _cs.set("tls.enabled", False, changed_by="console-startup")
+        except Exception:
+            log.debug("Failed to sync TLS state to ConfigStore", exc_info=True)
 
     app = create_app(
         collector=collector,
diff --git a/turnstone/server.py b/turnstone/server.py
index e561cf60..767a53e9 100644
--- a/turnstone/server.py
+++ b/turnstone/server.py
@@ -2800,8 +2800,13 @@ def main() -> None:
                 log.info("TLS enabled — serving HTTPS")
             else:
                 log.warning("TLS enabled but no cert available")
-        except Exception:
-            log.warning("TLS initialization failed — serving plain HTTP", exc_info=True)
+        except Exception as exc:
+            log.warning(
+                "TLS initialization failed — serving plain HTTP: %s: %s",
+                type(exc).__name__,
+                exc,
+            )
+            log.debug("TLS init traceback", exc_info=True)
 
     print("Press Ctrl+C to stop.")