Bugfix: use an HTTP client that supports proxies for APNS push notifications (#23988)

changes/23758-use-fleethttp-client-for-apns-push-notifications

@@ -0,0 +1 @@
+* Fixed a bug where the HTTP client used for MDM APNs push notifications did not support using a configured proxy.

cmd/fleet/serve.go

@@ -22,6 +22,7 @@ import (
 	"github.com/e-dard/netbug"
 	"github.com/fleetdm/fleet/v4/ee/server/licensing"
 	eeservice "github.com/fleetdm/fleet/v4/ee/server/service"
+	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
 	"github.com/fleetdm/fleet/v4/pkg/scripts"
 	"github.com/fleetdm/fleet/v4/server"
 	configpkg "github.com/fleetdm/fleet/v4/server/config"
@@ -498,7 +499,11 @@ the way that the Fleet server works.
 
 			var mdmPushService push.Pusher
 			nanoMDMLogger := service.NewNanoMDMLogger(kitlog.With(logger, "component", "apple-mdm-push"))
-			pushProviderFactory := buford.NewPushProviderFactory()
+			pushProviderFactory := buford.NewPushProviderFactory(buford.WithNewClient(func(cert *tls.Certificate) (*http.Client, error) {
+				return fleethttp.NewClient(fleethttp.WithTLSClientConfig(&tls.Config{
+					Certificates: []tls.Certificate{*cert},
+				})), nil
+			}))
 			if os.Getenv("FLEET_DEV_MDM_APPLE_DISABLE_PUSH") == "1" {
 				mdmPushService = nopPusher{}
 			} else {

pkg/fleethttp/fleethttp.go

@@ -97,7 +97,8 @@ func WithTLSConfig(conf *tls.Config) TransportOpt {
 // NewTransport creates an http transport (a type that implements
 // http.RoundTripper) with the provided optional options. The transport is
 // derived from Go's http.DefaultTransport and only overrides the specific
-// parts it needs to, so that it keeps its sane defaults for the rest.
+// parts it needs to, so that it keeps its sane defaults for the rest (such as
+// timeouts and proxy support).
 func NewTransport(opts ...TransportOpt) *http.Transport {
 	var to transportOpts
 	for _, opt := range opts {