Use Bun runtime and relax gRPC TLS verification

Author: richiemcilroy

apps/api/Dockerfile

@@ -23,20 +23,11 @@ COPY . .
 RUN bun run --filter @sandchest/contract build && \
     bun run --filter @sandchest/api build
 
-# Grab the Node.js binary for the runtime stage
-FROM node:22-slim AS node-bin
-
 FROM oven/bun:1.3.6-slim
 WORKDIR /app
 
 ENV NODE_ENV=production
 
-# Use Node.js runtime instead of Bun for @grpc/grpc-js TLS compatibility.
-# Bun's tls.connect polyfill doesn't properly handle secureContext with custom
-# CA certificates when upgrading existing sockets, causing gRPC mTLS to fail
-# with "unable to verify the first certificate".
-COPY --from=node-bin /usr/local/bin/node /usr/local/bin/node
-
 COPY package.json bun.lock ./
 COPY apps/api/package.json apps/api/
 COPY apps/admin/package.json apps/admin/
@@ -59,4 +50,4 @@ COPY --from=build /app/packages/contract/dist packages/contract/dist
 COPY --from=build /app/packages/db/src packages/db/src
 
 EXPOSE 3001
-CMD ["node", "apps/api/dist/index.js"]
+CMD ["bun", "run", "apps/api/dist/index.js"]

apps/api/src/services/node-client.live.ts

@@ -250,7 +250,18 @@ export function createNodeClientLayer(config: NodeGrpcConfig): Layer.Layer<NodeC
       const key = config.keyPem ? Buffer.from(config.keyPem) : readFileSync(config.keyPath!)
       const cert = config.certPem ? Buffer.from(config.certPem) : readFileSync(config.certPath!)
 
-      const credentials = ChannelCredentials.createSsl(ca, key, cert)
+      yield* Effect.log(`gRPC mTLS: ca=${ca.length}B key=${key.length}B cert=${cert.length}B target=${config.address}`)
+
+      // Bun's tls.connect polyfill does not properly apply custom CA
+      // certificates from secureContext when upgrading an existing TCP
+      // socket to TLS (the pattern @grpc/grpc-js uses). This causes
+      // "unable to verify the first certificate" even with valid certs.
+      // Workaround: skip client-side server cert verification. The server
+      // still verifies our client cert (mTLS), and we connect to a known
+      // IP we control, so MITM risk is minimal.
+      const credentials = ChannelCredentials.createSsl(ca, key, cert, {
+        rejectUnauthorized: false,
+      })
       const channel = createChannel(config.address, credentials)
       const nodeIdBytes = hexToBytes(config.nodeId)