Skip to content

Add VL_INSTANCE_TLS_SKIP_VERIFY option to skip TLS certificate verification#86

Open
mkobozev wants to merge 1 commit intoVictoriaMetrics:mainfrom
mkobozev:feature/tls-skip-verify
Open

Add VL_INSTANCE_TLS_SKIP_VERIFY option to skip TLS certificate verification#86
mkobozev wants to merge 1 commit intoVictoriaMetrics:mainfrom
mkobozev:feature/tls-skip-verify

Conversation

@mkobozev
Copy link
Copy Markdown

What does this PR do?

Adds a new environment variable VL_INSTANCE_TLS_SKIP_VERIFY that allows
skipping TLS certificate verification when connecting to VictoriaLogs instances over HTTPS.

Why is this needed?

Many internal/on-premise deployments use self-signed or corporate CA certificates
that are not trusted by the system certificate store. Without this option, the MCP
server cannot connect to such VictoriaLogs instances over HTTPS.

Changes

  • cmd/mcp-victorialogs/config/config.go: new tlsSkipVerify field, env var parsing, getter
  • cmd/mcp-victorialogs/main.go: configure http.DefaultTransport with InsecureSkipVerify
    when enabled; uses .Clone() to preserve default transport settings (connection pooling, timeouts, keep-alives)
  • README.md: added variable to configuration table with a security warning

Notes

  • Disabled by default — no behavioral change for existing users
  • Logs a warning via slog.Warn when enabled
  • Follows existing naming convention (VL_INSTANCE_*)

@mkobozev mkobozev requested a review from Amper as a code owner April 21, 2026 14:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant