Introduce TLS Settings for go-micro based http services

TLS for the services can be configure by setting the "OCIS_HTTP_TLS_ENABLED",
"OCIS_HTTP_TLS_CERTIFICATE" and "OCIS_HTTP_TLS_KEY" environment variables.
Currently the ocis proxy is this only service that directly accesses backend
services. It determines whether to use TLS or not by looking a the new registry
metadata "use_tls". As specific CA Cert for certificate verification
can be set with the "PROXY_HTTPS_CACERT" environment variable.
This commit is contained in:
Ralf Haferkamp
2022-11-03 11:58:53 +01:00
committed by Ralf Haferkamp
parent cbe41fb85f
commit b24d126b30
31 changed files with 243 additions and 72 deletions
@@ -73,6 +73,10 @@ func EnsureDefaults(cfg *config.Config) {
cfg.GRPCClientTLS.CACert = cfg.Commons.GRPCClientTLS.CACert
}
}
if cfg.Commons != nil {
cfg.HTTP.TLS = cfg.Commons.HTTPServiceTLS
}
}
func Sanitize(cfg *config.Config) {
+7 -4
View File
@@ -1,5 +1,7 @@
package config
import "github.com/owncloud/ocis/v2/ocis-pkg/shared"
// CORS defines the available cors configuration.
type CORS struct {
AllowedOrigins []string `yaml:"allow_origins" env:"OCIS_CORS_ALLOW_ORIGINS;WEBDAV_CORS_ALLOW_ORIGINS" desc:"A comma-separated list of allowed CORS origins. See following chapter for more details: *Access-Control-Allow-Origin* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin"`
@@ -10,8 +12,9 @@ type CORS struct {
// HTTP defines the available http configuration.
type HTTP struct {
Addr string `yaml:"addr" env:"WEBDAV_HTTP_ADDR" desc:"The bind address of the HTTP service."`
Namespace string `yaml:"-"`
Root string `yaml:"root" env:"WEBDAV_HTTP_ROOT" desc:"Subdirectory that serves as the root for this HTTP service."`
CORS CORS `yaml:"cors"`
Addr string `yaml:"addr" env:"WEBDAV_HTTP_ADDR" desc:"The bind address of the HTTP service."`
Namespace string `yaml:"-"`
Root string `yaml:"root" env:"WEBDAV_HTTP_ROOT" desc:"Subdirectory that serves as the root for this HTTP service."`
CORS CORS `yaml:"cors"`
TLS shared.HTTPServiceTLS `yaml:"tls"`
}
+10 -1
View File
@@ -1,6 +1,8 @@
package http
import (
"fmt"
chimiddleware "github.com/go-chi/chi/v5/middleware"
"github.com/owncloud/ocis/v2/ocis-pkg/cors"
"github.com/owncloud/ocis/v2/ocis-pkg/middleware"
@@ -14,7 +16,8 @@ import (
func Server(opts ...Option) (http.Service, error) {
options := newOptions(opts...)
service := http.NewService(
service, err := http.NewService(
http.TLSConfig(options.Config.HTTP.TLS),
http.Logger(options.Logger),
http.Namespace(options.Config.HTTP.Namespace),
http.Name(options.Config.Service.Name),
@@ -23,6 +26,12 @@ func Server(opts ...Option) (http.Service, error) {
http.Context(options.Context),
http.Flags(options.Flags...),
)
if err != nil {
options.Logger.Error().
Err(err).
Msg("Error initializing http service")
return http.Service{}, fmt.Errorf("could not initialize http service: %w", err)
}
handle, err := svc.NewService(
svc.Logger(options.Logger),