Add option to disable TLS #37

pkg/config/config.go

@@ -1,6 +1,8 @@
 package config
 
-import "stash.kopano.io/kc/konnect/bootstrap"
+import (
+	"stash.kopano.io/kc/konnect/bootstrap"
+)
 
 // Log defines the available logging configuration.
 type Log struct {
@@ -24,6 +26,7 @@ type HTTP struct {
 	Root      string
 	TLSCert   string
 	TLSKey    string
+	TLS       bool
 }
 
 // Tracing defines the available tracing configuration.

pkg/flagset/flagset.go

@@ -267,6 +267,13 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 			EnvVars:     []string{"KONNECTD_INSECURE"},
 			Destination: &cfg.Konnectd.Insecure,
 		},
+		&cli.BoolFlag{
+			Name:        "tls",
+			Usage:       "Use TLS (disable only if konnectd is behind a TLS-terminating reverse-proxy).",
+			EnvVars:     []string{"KONNECTD_TLS"},
+			Value:       true,
+			Destination: &cfg.HTTP.TLS,
+		},
 		&cli.StringSliceFlag{
 			Name:    "trusted-proxy",
 			Usage:   "Trusted proxy IP or IP network (can be used multiple times)",

pkg/server/http/server.go

@@ -15,30 +15,33 @@ import (
 func Server(opts ...Option) (http.Service, error) {
 	options := newOptions(opts...)
 
-	if options.Config.HTTP.TLSCert == "" || options.Config.HTTP.TLSKey == "" {
-		_, certErr := os.Stat("./server.crt")
-		_, keyErr := os.Stat("./server.key")
+	var tlsConfig *tls.Config
+	if options.Config.HTTP.TLS {
+		if options.Config.HTTP.TLSCert == "" || options.Config.HTTP.TLSKey == "" {
+			_, certErr := os.Stat("./server.crt")
+			_, keyErr := os.Stat("./server.key")
 
-		if os.IsNotExist(certErr) || os.IsNotExist(keyErr) {
-			options.Logger.Info().Msgf("Generating certs")
-			if err := crypto.GenCert(options.Logger); err != nil {
-				options.Logger.Fatal().Err(err).Msg("Could not setup TLS")
-				os.Exit(1)
+			if os.IsNotExist(certErr) || os.IsNotExist(keyErr) {
+				options.Logger.Info().Msgf("Generating certs")
+				if err := crypto.GenCert(options.Logger); err != nil {
+					options.Logger.Fatal().Err(err).Msg("Could not setup TLS")
+					os.Exit(1)
+				}
 			}
+
+			options.Config.HTTP.TLSCert = "server.crt"
+			options.Config.HTTP.TLSKey = "server.key"
 		}
 
-		options.Config.HTTP.TLSCert = "server.crt"
-		options.Config.HTTP.TLSKey = "server.key"
-	}
+		cer, err := tls.LoadX509KeyPair(options.Config.HTTP.TLSCert, options.Config.HTTP.TLSKey)
+		if err != nil {
+			options.Logger.Fatal().Err(err).Msg("Could not setup TLS")
+			os.Exit(1)
+		}
 
-	cer, err := tls.LoadX509KeyPair(options.Config.HTTP.TLSCert, options.Config.HTTP.TLSKey)
-	if err != nil {
-		options.Logger.Fatal().Err(err).Msg("Could not setup TLS")
-		os.Exit(1)
+		tlsConfig = &tls.Config{Certificates: []tls.Certificate{cer}}
 	}
 
-	config := &tls.Config{Certificates: []tls.Certificate{cer}}
-
 	service := http.NewService(
 		http.Logger(options.Logger),
 		http.Namespace(options.Config.HTTP.Namespace),
@@ -47,7 +50,7 @@ func Server(opts ...Option) (http.Service, error) {
 		http.Address(options.Config.HTTP.Addr),
 		http.Context(options.Context),
 		http.Flags(options.Flags...),
-		http.TLSConfig(config),
+		http.TLSConfig(tlsConfig),
 	)
 
 	options.Config.Konnectd.Listen = options.Config.HTTP.Addr