add config option to enable or disable TLS for nats

services/graph/pkg/config/config.go

@@ -74,4 +74,5 @@ type Events struct {
 	Cluster              string `yaml:"cluster" env:"GRAPH_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
 	TLSInsecure          bool   `yaml:"tls_insecure" env:"OCIS_INSECURE;GRAPH_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."`
 	TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"GRAPH_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided GRAPH_EVENTS_TLS_INSECURE will be seen as false."`
+	EnableTLS            bool   `yaml:"enable_tls" env:"OCIS_EVENTS_ENABLE_TLS;GRAPH_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker."`
 }

services/graph/pkg/config/defaults/defaultconfig.go

@@ -66,8 +66,9 @@ func DefaultConfig() *config.Config {
 			},
 		},
 		Events: config.Events{
-			Endpoint: "127.0.0.1:9233",
-			Cluster:  "ocis-cluster",
+			Endpoint:  "127.0.0.1:9233",
+			Cluster:   "ocis-cluster",
+			EnableTLS: false,
 		},
 	}
 }

services/graph/pkg/server/http/server.go

@@ -38,23 +38,27 @@ func Server(opts ...Option) (http.Service, error) {
 
 	if options.Config.Events.Endpoint != "" {
 		var err error
-		var rootCAPool *x509.CertPool
-		if options.Config.Events.TLSRootCACertificate != "" {
-			rootCrtFile, err := os.Open(options.Config.Events.TLSRootCACertificate)
-			if err != nil {
-				return http.Service{}, err
+
+		var tlsConf *tls.Config
+		if options.Config.Events.EnableTLS {
+			var rootCAPool *x509.CertPool
+			if options.Config.Events.TLSRootCACertificate != "" {
+				rootCrtFile, err := os.Open(options.Config.Events.TLSRootCACertificate)
+				if err != nil {
+					return http.Service{}, err
+				}
+
+				rootCAPool, err = ociscrypto.NewCertPoolFromPEM(rootCrtFile)
+				if err != nil {
+					return http.Service{}, err
+				}
+				options.Config.Events.TLSInsecure = false
 			}
 
-			rootCAPool, err = ociscrypto.NewCertPoolFromPEM(rootCrtFile)
-			if err != nil {
-				return http.Service{}, err
+			tlsConf = &tls.Config{
+				InsecureSkipVerify: options.Config.Events.TLSInsecure, //nolint:gosec
+				RootCAs:            rootCAPool,
 			}
-			options.Config.Events.TLSInsecure = false
-		}
-
-		tlsConf := &tls.Config{
-			InsecureSkipVerify: options.Config.Events.TLSInsecure, //nolint:gosec
-			RootCAs:            rootCAPool,
 		}
 		publisher, err = server.NewNatsStream(
 			natsjs.TLSConfig(tlsConf),