From dfcf5bf5a5e7a08b15fa802f49f8d75177642539 Mon Sep 17 00:00:00 2001
From: OpenClaw Assistant <assistant@openclaw.local>
Date: Tue, 3 Mar 2026 10:40:05 +0300
Subject: [PATCH] fix(nextcloud): add TLS-aware wrapper and local cert bundle

---
 integrations/nextcloud/nextcloud-ca.pem | 19 +++++++++++++++++++
 scripts/nextcloud-cli.sh                | 15 +++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 integrations/nextcloud/nextcloud-ca.pem
 create mode 100755 scripts/nextcloud-cli.sh

diff --git a/integrations/nextcloud/nextcloud-ca.pem b/integrations/nextcloud/nextcloud-ca.pem
new file mode 100644
index 0000000..6333c3b
--- /dev/null
+++ b/integrations/nextcloud/nextcloud-ca.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDFzCCAf+gAwIBAgIUF7WZSWMV/cd4eihMtP1UxUbdCxowDQYJKoZIhvcNAQEL
+BQAwFDESMBAGA1UEAwwJbmV4dGNsb3VkMB4XDTI2MDIxNjExNTA0MloXDTI3MDIx
+NjExNTA0MlowFDESMBAGA1UEAwwJbmV4dGNsb3VkMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAy1y346KNZov42snu2Yc6Yi4HHJlq5gDc/zPSvdIjg40U
+p9otXReRWED2u5P1h18edfDg3/D7QyjHRHLcZCm2GSceGeB2eRgKoajS/0GKV4tb
+YvshlrzR9bO3XFtp0VQvRXhPv82csEMvzDpdxI1AWAnMiNgu8zd9biqQ8WNRU6O+
+pU69Xaki5gKzBdJv6tMTKtEcSPnR+D0YgYRL3cXnexxrIst8nXbZH2ftqPWePb9W
+ltg+vDM1wEtCI22WyvjYhnIU+9ifM+ImYRjnclWFgH1OD6vhshTS9p7g3MpuoQ3k
+UYEJ0LVoY43GfXFbvkIeHQYh63ZuaTklwNs0vIwBYQIDAQABo2EwXzAJBgNVHRME
+AjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAUBgNVHREEDTALgglu
+ZXh0Y2xvdWQwHQYDVR0OBBYEFERFSm/Iwa2qkMWM2tZygEn6wM7PMA0GCSqGSIb3
+DQEBCwUAA4IBAQBm+qgBEZP+pMAIOaFZpYgo6XX5bnNTYZr7f6SIkHDBNw8K1kIo
+/HaRHxKbJnVqQ4r8HTAZ0m5V9I4WkSEliIjayXl6Hh0nH3eZnvMBh4m7soX4dnuN
+fCO2EpeGmXp0Q8/NkKUjsoX/v/SB4vH2L0UhgyDe8iCjxkQ5tFa7aQMU/jcqGRFX
+5QmI723xHgQl0WqM5Rbv3Tn9McTNFcRiVOAytM2e4JFZq073NeRFi8T+Uil/vlhq
+jiAO+3IEqOr62AfLMkUnXW+4HRaSscPqhvLgnHJHgdon7mrhh9M02/R6dKpBWmia
+BLQjkHTeHsklhO6EpHq70VnFZ2eqGHRaqqA6
+-----END CERTIFICATE-----
diff --git a/scripts/nextcloud-cli.sh b/scripts/nextcloud-cli.sh
new file mode 100755
index 0000000..d2e9e05
--- /dev/null
+++ b/scripts/nextcloud-cli.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Load workspace env and export all vars for child process
+if [[ -f "/home/openclaw/.openclaw/workspace/.env" ]]; then
+  set -a
+  source /home/openclaw/.openclaw/workspace/.env
+  set +a
+fi
+
+# TLS workaround for self-signed/internal Nextcloud cert
+: "${NODE_TLS_REJECT_UNAUTHORIZED:=0}"
+export NODE_TLS_REJECT_UNAUTHORIZED
+
+exec node /home/openclaw/.openclaw/workspace/skills/openclaw-nextcloud/scripts/nextcloud.js "$@"