chore(server): fix connection

packages/backend/native/src/runtime/backend_runtime/mod.rs

@@ -41,7 +41,7 @@ pub(crate) use super::types;
 pub(super) use super::{
   BackendRuntimeConfig, ConfigSource, InviteQuotaConfig, RuntimeError, RuntimeResult,
   migrations::{embedding_schema_health, migrate_all_tables},
-  napi_error, to_napi_error,
+  napi_error, to_napi_error, webpki_tls_config,
 };
 use crate::llm::{
   ByokLocalLeaseOutput, ByokPolicyOutput, ByokProbeResultOutput, ByokProfileOutput, CreateByokLocalLeaseInput,

packages/backend/native/src/runtime/backend_runtime/search/mod.rs

@@ -11,6 +11,8 @@ mod worker;
 pub(super) use runtime::SearchRuntime;
 pub(super) use types::{RuntimeAggregateRequest, RuntimeSearchRequest};
 
+pub(super) use super::webpki_tls_config;
+
 const SCHEMA_FINGERPRINT: &str = "search-runtime-v5";
 
 fn exact_token(value: &str) -> String {

packages/backend/native/src/runtime/backend_runtime/search/provider/remote.rs

@@ -5,7 +5,7 @@ use serde_json::{Value, json};
 use sqlx::PgPool;
 
 use super::{
-  super::{store::SearchChange, types::SearchTable},
+  super::{store::SearchChange, types::SearchTable, webpki_tls_config},
   manticore::{manticore_exact_tokens, manticore_fields, prepare_manticore_payload, prepare_manticore_search},
 };
 use crate::runtime::{RuntimeError, RuntimeResult, SearchRuntimeConfig};
@@ -33,6 +33,10 @@ impl RemoteProvider {
       return Err(RuntimeError::config("invalid search provider endpoint"));
     }
     let mut client = Client::builder()
+      .tls_backend_preconfigured(
+        webpki_tls_config()
+          .map_err(|error| RuntimeError::invalid_state(format!("search TLS config failed: {error}")))?,
+      )
       .redirect(Policy::none())
       .timeout(Duration::from_secs(30));
     if config.provider == "manticoresearch" {

packages/backend/native/src/runtime/http.rs

@@ -0,0 +1,13 @@
+use rustls::{ClientConfig, RootCertStore};
+
+pub(in crate::runtime) fn webpki_tls_config() -> Result<ClientConfig, rustls::Error> {
+  let roots = RootCertStore {
+    roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
+  };
+  Ok(
+    ClientConfig::builder_with_provider(rustls::crypto::aws_lc_rs::default_provider().into())
+      .with_safe_default_protocol_versions()?
+      .with_root_certificates(roots)
+      .with_no_client_auth(),
+  )
+}

packages/backend/native/src/runtime/mod.rs

@@ -4,6 +4,7 @@ pub mod storage_runtime;
 pub(crate) mod config;
 mod config_descriptor;
 pub(crate) mod error;
+mod http;
 pub(crate) mod migrations;
 pub(crate) mod object_storage;
 pub(crate) mod types;
@@ -15,3 +16,4 @@ pub(crate) use config::{
 use config::{SUPPORTED_BYOK_PROVIDERS, validate_copilot_config};
 pub use config_descriptor::{AppConfigDescriptor, app_config_descriptors, validate_app_config_value};
 pub(crate) use error::{RuntimeError, RuntimeResult, napi_error, to_napi_error};
+pub(in crate::runtime) use http::webpki_tls_config;

packages/backend/native/src/runtime/object_storage/client.rs

@@ -8,7 +8,6 @@ use reqwest::{
   Client as ReqwestClient, Method, StatusCode,
   header::{CONTENT_LENGTH, CONTENT_TYPE, ETAG, HeaderMap, HeaderName, HeaderValue, LAST_MODIFIED},
 };
-use rustls::RootCertStore;
 use rusty_s3::{
   Bucket, Credentials,
   actions::{
@@ -27,6 +26,7 @@ use super::{
     ObjectListPage, ObjectMetadata, ObjectPrefix, ObjectPutMetadata, PresignedObjectRequest, completed_multipart_parts,
     trim_etag,
   },
+  webpki_tls_config,
 };
 
 const DEFAULT_REQUEST_TIMEOUT_MS: u64 = 30_000;
@@ -60,7 +60,10 @@ struct ReqwestStorageHttpClient {
 impl ReqwestStorageHttpClient {
   fn new(request_timeout_ms: Option<u64>) -> ObjectStorageResult<Self> {
     let builder = ReqwestClient::builder()
-      .tls_backend_preconfigured(Self::webpki_tls_config()?)
+      .tls_backend_preconfigured(
+        webpki_tls_config()
+          .map_err(|err| ObjectStorageError::Config(format!("ObjectStorage TLS config failed: {err}")))?,
+      )
       .timeout(Duration::from_millis(
         request_timeout_ms.unwrap_or(DEFAULT_REQUEST_TIMEOUT_MS),
       ));
@@ -69,19 +72,6 @@ impl ReqwestStorageHttpClient {
     })
   }
 
-  fn webpki_tls_config() -> ObjectStorageResult<rustls::ClientConfig> {
-    let roots = RootCertStore {
-      roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
-    };
-    Ok(
-      rustls::ClientConfig::builder_with_provider(rustls::crypto::aws_lc_rs::default_provider().into())
-        .with_safe_default_protocol_versions()
-        .map_err(|err| ObjectStorageError::Config(format!("ObjectStorage TLS config failed: {err}")))?
-        .with_root_certificates(roots)
-        .with_no_client_auth(),
-    )
-  }
-
   async fn execute(&self, request: StorageHttpRequest) -> ObjectStorageResult<StorageHttpResponse> {
     let mut builder = self.client.request(request.method, request.url);
     for (key, value) in request.headers {

packages/backend/native/src/runtime/object_storage/mod.rs

@@ -14,4 +14,6 @@ pub(in crate::runtime) use backend::{FsStorageConfig, StorageBackendConfig};
 pub(in crate::runtime) use config::ObjectStorageConfig;
 pub(crate) use service::ObjectStorageService;
 
+pub(super) use super::webpki_tls_config;
+
 pub(in crate::runtime) const MAX_BLOB_SIZE: i64 = i32::MAX as i64;