update-ca-certificate documentation (#1047)

Author: alpetric

docs/advanced/1_self_host/index.mdx

@@ -606,6 +606,8 @@ TL;DR: below
 3. Modify docker-compose.yml to mount this directory to /usr/local/share/ca-certificates in read-only mode.
 4. Use INIT_SCRIPT in the worker config to run update-ca-certificates in worker containers.
 
+Alternatively, you can use the `RUN_UPDATE_CA_CERTIFICATE_AT_START=true` [environment variable](../../core_concepts/47_environment_variables/index.mdx) to automatically run CA certificate updates at startup. You can also customize the command path using `RUN_UPDATE_CA_CERTIFICATE_PATH` if needed.
+
 ### Establish Deno’s trust
 
 Set environment variable DENO_TLS_CA_STORE=system,mozilla in docker-compose.yml for Windmill workers.

docs/core_concepts/47_environment_variables/index.mdx

@@ -47,6 +47,8 @@ You can use them in a Script by clicking on "+Context Var":
 | MAX_SESSION_VALIDITY_SECONDS | 3 * 24 * 60 * 60    | Session will be invalidated after this amount of seconds of inactivity (default 3 days) 																											  | Server                |
 | INVALIDATE_OLD_SESSIONS   | false                  | Existing session will be invalidated if new session is created if set to true (default false) 																								      | Server                |
 | INVALIDATE_ALL_SESSIONS_ON_LOGOUT | false          | All sessions will be invalidated on logout if set to true (default false) 																								                          | Server                |
+| RUN_UPDATE_CA_CERTIFICATE_AT_START | false | If true, runs CA certificate update command at startup before other initialization | All |
+| RUN_UPDATE_CA_CERTIFICATE_PATH | /usr/sbin/update-ca-certificates | Path to the CA certificate update command/script to run when RUN_UPDATE_CA_CERTIFICATE_AT_START is true | All |
 
 ## Contextual variables