add config option to enable or disable TLS for nats

services/search/pkg/config/config.go

@@ -34,4 +34,5 @@ type Events struct {
 	ConsumerGroup        string `yaml:"group" env:"SEARCH_EVENTS_GROUP" desc:"The customer group of the service. One group will only get one copy of an event"`
 	TLSInsecure          bool   `yaml:"tls_insecure" env:"OCIS_INSECURE;SEARCH_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."`
 	TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"SEARCH_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided SEARCH_EVENTS_TLS_INSECURE will be seen as false."`
+	EnableTLS            bool   `yaml:"enable_tls" env:"OCIS_EVENTS_ENABLE_TLS;SEARCH_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker."`
 }

services/search/pkg/config/defaults/defaultconfig.go

@@ -36,6 +36,7 @@ func DefaultConfig() *config.Config {
 			Endpoint:      "127.0.0.1:9233",
 			Cluster:       "ocis-cluster",
 			ConsumerGroup: "search",
+			EnableTLS:     false,
 		},
 		MachineAuthAPIKey: "",
 	}

services/search/pkg/service/v0/service.go

@@ -37,23 +37,26 @@ func NewHandler(opts ...Option) (searchsvc.SearchProviderHandler, error) {
 	// Connect to nats to listen for changes that need to trigger an index update
 	evtsCfg := cfg.Events
 
-	var rootCAPool *x509.CertPool
-	if evtsCfg.TLSRootCACertificate != "" {
-		rootCrtFile, err := os.Open(evtsCfg.TLSRootCACertificate)
-		if err != nil {
-			return nil, err
+	var tlsConf *tls.Config
+	if evtsCfg.EnableTLS {
+		var rootCAPool *x509.CertPool
+		if evtsCfg.TLSRootCACertificate != "" {
+			rootCrtFile, err := os.Open(evtsCfg.TLSRootCACertificate)
+			if err != nil {
+				return nil, err
+			}
+
+			rootCAPool, err = ociscrypto.NewCertPoolFromPEM(rootCrtFile)
+			if err != nil {
+				return nil, err
+			}
+			evtsCfg.TLSInsecure = false
 		}
 
-		rootCAPool, err = ociscrypto.NewCertPoolFromPEM(rootCrtFile)
-		if err != nil {
-			return nil, err
+		tlsConf = &tls.Config{
+			InsecureSkipVerify: evtsCfg.TLSInsecure, //nolint:gosec
+			RootCAs:            rootCAPool,
 		}
-		evtsCfg.TLSInsecure = false
-	}
-
-	tlsConf := &tls.Config{
-		InsecureSkipVerify: evtsCfg.TLSInsecure, //nolint:gosec
-		RootCAs:            rootCAPool,
 	}
 	client, err := server.NewNatsStream(
 		natsjs.TLSConfig(tlsConf),