feat(init): run Sentry with mTLS enabled in self-hosted init

README.md

@@ -104,6 +104,18 @@ This step creates the following defaults:
 2. component files in the components folder called `pubsub.yaml` and `statestore.yaml`.
 3. default config file `$HOME/.dapr/config.yaml` for Linux/MacOS or for Windows at `%USERPROFILE%\.dapr\config.yaml` to enable tracing on `dapr init` call. Can be overridden with the `--config` flag on `dapr run`.
 
+#### Enable mTLS for self-hosted Dapr
+
+mTLS is disabled by default in self-hosted mode. To enable mTLS, pass the `--enable-mtls` flag when initializing Dapr:
+
+```bash
+dapr init --enable-mtls
+```
+
+When enabled, the CLI starts the local Sentry service, generates the required certificates, and enables mTLS in the default Dapr configuration. The CLI also makes the generated certificates available automatically when you run an app with `dapr run`, including apps launched through a run file. You do not need to configure the mTLS environment variables manually.
+
+Without `--enable-mtls`, self-hosted initialization behaves as before and mTLS remains disabled.
+
 #### Slim Init
 
 Alternatively to the above, to have the CLI not install any default configuration files or run Docker containers, use the `--slim` flag with the init command. Only Dapr binaries will be installed.

cmd/init.go

@@ -100,6 +100,9 @@ dapr init --runtime-path <path-to-install-directory>
 # Initialize Dapr in self-hosted mode with Redis Stack for RediSearch/vector store support
 dapr init --redis-stack
 
+# Initialize Dapr in self-hosted mode with mTLS enabled for sentry service
+dapr init --enable-mtls
+
 # See more at: https://docs.dapr.io/getting-started/
 `,
 	Run: func(cmd *cobra.Command, args []string) {
@@ -206,6 +209,7 @@ dapr init --redis-stack
 				SchedulerOverrideBroadcastHostPort: schedulerHostPort,
 				SchedulerPlacement:                 schedulerPlacement,
 				RedisStack:                         redisStack,
+				EnableMTLS:                         enableMTLS && cmd.Flags().Changed("enable-mtls"),
 			})
 			if err != nil {
 				print.FailureStatusEvent(os.Stderr, "%s", err.Error())
@@ -248,7 +252,7 @@ func init() {
 	InitCmd.Flags().BoolVarP(&slimMode, "slim", "s", false, "Exclude placement service, scheduler service, Redis and Zipkin containers from self-hosted installation")
 	InitCmd.Flags().StringVarP(&runtimeVersion, "runtime-version", "", defaultRuntimeVersion, "The version of the Dapr runtime to install, for example: 1.0.0")
 	InitCmd.Flags().StringVarP(&initNamespace, "namespace", "n", "dapr-system", "The Kubernetes namespace to install Dapr in")
-	InitCmd.Flags().BoolVarP(&enableMTLS, "enable-mtls", "", true, "Enable mTLS in your cluster")
+	InitCmd.Flags().BoolVarP(&enableMTLS, "enable-mtls", "", true, "Enable mTLS. Kubernetes: on by default. Self-hosted: opt-in, installs and runs the Sentry service")
 	InitCmd.Flags().BoolVarP(&enableHA, "enable-ha", "", false, "Enable high availability (HA) mode")
 	InitCmd.Flags().String("network", "", "The Docker network on which to deploy the Dapr runtime")
 	InitCmd.Flags().StringVarP(&fromDir, "from-dir", "", "", "Use Dapr artifacts from local directory for self-hosted installation")

cmd/run.go

@@ -191,6 +191,22 @@ dapr run --run-file /path/to/directory -k
 			}
 		}
 
+		var mTLSEnv = make(map[string]string, 4)
+		if standalone.IsMTLSEnabled(configFile) {
+			certsDir := standalone.GetDaprSentryCertsPath(daprDirPath)
+			if !standalone.EnsureCerts(certsDir) {
+				print.FailureStatusEvent(os.Stderr, "MTLS enabled, but no certs foudn in dir %s", certsDir)
+				os.Exit(1)
+			}
+
+			var err error
+			mTLSEnv, err = standalone.MTLSEnv(daprDirPath)
+			if err != nil {
+				print.FailureStatusEvent(os.Stderr, "Failed to load mTLS environment: %v", err)
+				os.Exit(1)
+			}
+		}
+
 		sharedRunConfig := &standalone.SharedRunConfig{
 			ConfigFile:         configFile,
 			EnableProfiling:    enableProfiling,
@@ -210,6 +226,7 @@ dapr run --run-file /path/to/directory -k
 			EnableAPILogging:   enableAPILogging,
 			APIListenAddresses: apiListenAddresses,
 			DaprdInstallPath:   cmdruntime.GetDaprRuntimePath(),
+			Env:                mTLSEnv,
 		}
 
 		// placement-host-address flag handling: only set pointer if flag was explicitly changed

pkg/runfileconfig/run_file_config_mtls_test.go

@@ -0,0 +1,184 @@
+/*
+Copyright 2026 The Dapr Authors
+Licensed under the Apache License, Version 2.0
+(the "License");
+you may not use this file except in compliance with
+the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed
+on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS
+OF ANY KIND, either express or implied.
+See the License for the specific language governing
+permissions and limitations under the License.
+*/
+
+package runfileconfig
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/dapr/cli/pkg/standalone"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v2"
+)
+
+func setupRunFileMTLSTest(
+	t *testing.T,
+	mtlsEnabled bool,
+	createCerts bool,
+) (string, string) {
+	t.Helper()
+
+	runtimePath := t.TempDir()
+	t.Setenv("DAPR_RUNTIME_PATH", runtimePath)
+
+	daprDir, err := standalone.GetDaprRuntimePath(runtimePath)
+	require.NoError(t, err)
+
+	require.NoError(t, os.MkdirAll(daprDir, 0o755))
+
+	config := fmt.Sprintf(`apiVersion: dapr.io/v1alpha1
+kind: Configuration
+metadata:
+  name: daprConfig
+spec:
+  mtls:
+    enabled: %t
+`, mtlsEnabled)
+
+	configFile := standalone.GetDaprConfigPath(daprDir)
+
+	require.NoError(t, os.WriteFile(
+		configFile,
+		[]byte(config),
+		0o600,
+	))
+
+	if createCerts {
+		certsDir := standalone.GetDaprSentryCertsPath(daprDir)
+		require.NoError(t, os.MkdirAll(certsDir, 0o755))
+
+		for _, cert := range []struct {
+			name    string
+			content string
+		}{
+			{"ca.crt", "CA"},
+			{"issuer.crt", "CHAIN"},
+			{"issuer.key", "KEY"},
+		} {
+			require.NoError(t, os.WriteFile(
+				filepath.Join(certsDir, cert.name),
+				[]byte(cert.content),
+				0o600,
+			))
+		}
+	}
+
+	return daprDir, configFile
+}
+
+func createMTLSRunFile(
+	t *testing.T,
+	configFile string,
+	appDir string,
+	appEnv map[string]string,
+) string {
+	t.Helper()
+
+	config := RunFileConfig{
+		Version: 1,
+		Common: Common{
+			SharedRunConfig: standalone.SharedRunConfig{
+				ConfigFile: configFile,
+			},
+		},
+		Apps: []App{
+			{
+				AppDirPath: appDir,
+				RunConfig: standalone.RunConfig{
+					SharedRunConfig: standalone.SharedRunConfig{
+						Env: appEnv,
+					},
+					AppID: "mtls-test-app",
+				},
+			},
+		},
+	}
+
+	content, err := yaml.Marshal(&config)
+	require.NoError(t, err)
+
+	runFile := filepath.Join(t.TempDir(), "dapr.yaml")
+	require.NoError(t, os.WriteFile(runFile, content, 0o600))
+
+	return runFile
+}
+
+func TestGetAppsMTLSEnv(t *testing.T) {
+	t.Run("loads generated certificates and preserves app environment", func(t *testing.T) {
+		_, configFile := setupRunFileMTLSTest(t, true, true)
+
+		appDir := t.TempDir()
+		runFile := createMTLSRunFile(
+			t,
+			configFile,
+			appDir,
+			map[string]string{
+				"DAPR_CERT_KEY": "user-defined-key",
+				"CUSTOM_ENV":    "application-value",
+			},
+		)
+
+		cfg := &RunFileConfig{}
+
+		apps, err := cfg.GetApps(runFile)
+
+		require.NoError(t, err)
+		require.Len(t, apps, 1)
+
+		assert.Equal(t, "CA", apps[0].Env[standalone.EnvDaprTrustAnchors])
+		assert.Equal(t, "CHAIN", apps[0].Env[standalone.EnvDaprCertChain])
+
+		// Application-defined environment takes precedence.
+		assert.Equal(t, "user-defined-key", apps[0].Env[standalone.EnvDaprCertKey])
+		assert.Equal(t, "application-value", apps[0].Env["CUSTOM_ENV"])
+	})
+
+	t.Run("disabled mTLS does not inject existing certificates", func(t *testing.T) {
+		_, configFile := setupRunFileMTLSTest(t, false, true)
+
+		appDir := t.TempDir()
+		runFile := createMTLSRunFile(t, configFile, appDir, nil)
+
+		cfg := &RunFileConfig{}
+
+		apps, err := cfg.GetApps(runFile)
+
+		require.NoError(t, err)
+		require.Len(t, apps, 1)
+
+		assert.NotContains(t, apps[0].Env, standalone.EnvDaprTrustAnchors)
+		assert.NotContains(t, apps[0].Env, standalone.EnvDaprCertChain)
+		assert.NotContains(t, apps[0].Env, standalone.EnvDaprCertKey)
+	})
+
+	t.Run("missing certificates return an error when mTLS is enabled", func(t *testing.T) {
+		_, configFile := setupRunFileMTLSTest(t, true, false)
+
+		appDir := t.TempDir()
+		runFile := createMTLSRunFile(t, configFile, appDir, nil)
+
+		cfg := &RunFileConfig{}
+
+		_, err := cfg.GetApps(runFile)
+
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "sentry certs")
+	})
+}

pkg/runfileconfig/run_file_config_parser.go

@@ -20,6 +20,7 @@ import (
 	"reflect"
 	"strings"
 
+	cmdruntime "github.com/dapr/cli/cmd/runtime"
 	"github.com/dapr/cli/pkg/standalone"
 	"github.com/dapr/cli/utils"
 
@@ -28,6 +29,44 @@ import (
 
 var imagePullPolicyValuesAllowed = []string{"Always", "Never", "IfNotPresent"}
 
+func (a *RunFileConfig) addMTLSEnvToCommon() error {
+	daprDir, err := standalone.GetDaprRuntimePath(cmdruntime.GetDaprRuntimePath())
+	if err != nil {
+		return fmt.Errorf("error getting dapr install path: %w", err)
+	}
+
+	configFile := a.Common.ConfigFile
+	if configFile == "" {
+		configFile = standalone.GetDaprConfigPath(daprDir)
+	}
+
+	if !standalone.IsMTLSEnabled(configFile) {
+		return nil
+	}
+
+	certsDir := standalone.GetDaprSentryCertsPath(daprDir)
+	if !standalone.EnsureCerts(certsDir) {
+		return fmt.Errorf("error getting sentry certs")
+	}
+
+	env, err := standalone.MTLSEnv(daprDir)
+	if err != nil {
+		return err
+	}
+
+	if a.Common.Env == nil {
+		a.Common.Env = make(map[string]string, len(env))
+	}
+
+	for key, value := range env {
+		if _, exists := a.Common.Env[key]; !exists {
+			a.Common.Env[key] = value
+		}
+	}
+
+	return nil
+}
+
 // Parse the provided run file into a RunFileConfig struct.
 func (a *RunFileConfig) parseAppsConfig(runFilePath string) error {
 	var err error
@@ -128,6 +167,9 @@ func (a *RunFileConfig) GetApps(runFilePath string) ([]App, error) {
 		return nil, err
 	}
 	a.mergeCommonAndAppsSharedRunConfig()
+	if err = a.addMTLSEnvToCommon(); err != nil {
+		return nil, err
+	}
 	a.mergeCommonAndAppsEnv()
 
 	// Set and validates default fields in the run file.
@@ -257,6 +299,9 @@ func (a *RunFileConfig) resolveResourcesAndConfigFilePaths() error {
 // Precedence order for envs -> apps[i].envs > common.envs.
 func (a *RunFileConfig) mergeCommonAndAppsEnv() {
 	for i := range a.Apps {
+		if a.Apps[i].Env == nil && len(a.Common.Env) > 0 {
+			a.Apps[i].Env = make(map[string]string, len(a.Common.Env))
+		}
 		for k, v := range a.Common.Env {
 			if _, ok := a.Apps[i].Env[k]; !ok {
 				a.Apps[i].Env[k] = v

pkg/standalone/common.go

@@ -18,6 +18,8 @@ import (
 	path_filepath "path/filepath"
 	"runtime"
 	"strings"
+
+	"gopkg.in/yaml.v2"
 )
 
 const (
@@ -29,6 +31,7 @@ const (
 	defaultComponentsDirName    = "components"
 	defaultSchedulerDirName     = "scheduler"
 	defaultSchedulerDataDirName = "data"
+	defaultSentryCertsDirName   = "certs"
 )
 
 // GetDaprRuntimePath returns the dapr runtime installation path.
@@ -84,3 +87,43 @@ func GetDaprComponentsPath(daprDir string) string {
 func GetDaprConfigPath(daprDir string) string {
 	return path_filepath.Join(daprDir, DefaultConfigFileName)
 }
+
+func GetDaprSentryCertsPath(daprDir string) string {
+	return path_filepath.Join(daprDir, defaultSentryCertsDirName)
+}
+
+func GetMTLSConfig(configFile string) (mtlsConfig, error) {
+	b, err := os.ReadFile(configFile)
+	if err != nil {
+		return mtlsConfig{}, err
+	}
+
+	return parseMTLSConfig(b)
+}
+
+func parseMTLSConfig(configBytes []byte) (mtlsConfig, error) {
+	var config mtlsConfig
+	err := yaml.Unmarshal(configBytes, &config)
+	if err != nil {
+		return mtlsConfig{}, err
+	}
+
+	return config, nil
+}
+
+func IsMTLSEnabled(configFile string) bool {
+	if configFile == "" {
+		daprDir, err := GetDaprRuntimePath("")
+		if err != nil {
+			return false
+		}
+		configFile = GetDaprConfigPath(daprDir)
+	}
+
+	mtlsConfig, err := GetMTLSConfig(configFile)
+	if err != nil {
+		return false
+	}
+
+	return mtlsConfig.Spec.MTLS.Enabled
+}