Skip to content

Commit 43ec1b5

Browse files
beautifulentropynatalia.astashenko
beautifulentropy
authored and
natalia.astashenko
committed
sfe/redis: Add limiter config to SFE and cleanup creds (letsencrypt#8501)
Add limiter stanza to the SFE's config-next JSON. This should have happened in [letsencrypt#8359](letsencrypt#8359). Also, Cleanup our Redis credentials and secrets. These were a little overly specific, especially now that we've dropped support for OCSP and thus ROCSP. Instead, rely on a single `boulder` user with the same permissions that each of the other users had.
1 parent 922cd9f commit 43ec1b5

20 files changed

+59
-39
lines changed

‎ra/ra_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -362,7 +362,7 @@ func initAuthorities(t *testing.T) (*DummyValidationAuthority, sapb.StorageAutho
362362
rlSource := ratelimits.NewInmemSource()
363363
limiter, err := ratelimits.NewLimiter(fc, rlSource, stats)
364364
test.AssertNotError(t, err, "making limiter")
365-
txnBuilder, err := ratelimits.NewTransactionBuilderFromFiles("../test/config-next/wfe2-ratelimit-defaults.yml", "", metrics.NoopRegisterer, log)
365+
txnBuilder, err := ratelimits.NewTransactionBuilderFromFiles("../test/config-next/ratelimit-defaults.yml", "", metrics.NoopRegisterer, log)
366366
test.AssertNotError(t, err, "making transaction composer")
367367

368368
testKeyPolicy, err := goodkey.NewPolicy(nil, nil)

‎ratelimits/limit_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -259,11 +259,11 @@ func TestLoadAndParseOverrideLimitsFromFile(t *testing.T) {
259259
func TestLoadOverrides(t *testing.T) {
260260
mockLog := blog.NewMock()
261261

262-
tb, err := NewTransactionBuilderFromFiles("../test/config-next/wfe2-ratelimit-defaults.yml", "../test/config-next/wfe2-ratelimit-overrides.yml", metrics.NoopRegisterer, mockLog)
262+
tb, err := NewTransactionBuilderFromFiles("../test/config-next/ratelimit-defaults.yml", "../test/config-next/ratelimit-overrides.yml", metrics.NoopRegisterer, mockLog)
263263
test.AssertNotError(t, err, "creating TransactionBuilder")
264264
err = tb.loadOverrides(context.Background())
265265
test.AssertNotError(t, err, "loading overrides in TransactionBuilder")
266-
overridesData, err := loadOverridesFromFile("../test/config-next/wfe2-ratelimit-overrides.yml")
266+
overridesData, err := loadOverridesFromFile("../test/config-next/ratelimit-overrides.yml")
267267
test.AssertNotError(t, err, "loading overrides from file")
268268
testOverrides, err := parseOverrideLimits(overridesData)
269269
test.AssertNotError(t, err, "parsing overrides")

‎ratelimits/source_redis_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func newTestRedisSource(clk clock.FakeClock, addrs map[string]string) *RedisSour
2929

3030
client := redis.NewRing(&redis.RingOptions{
3131
Addrs: addrs,
32-
Username: "unittest-rw",
32+
Username: "boulder",
3333
Password: "824968fa490f4ecec1e52d5e34916bdb60d45f8d",
3434
TLSConfig: tlsConfig2,
3535
})

‎ratelimits/transaction_test.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ func sortTransactions(txns []Transaction) []Transaction {
4343
func TestNewRegistrationsPerIPAddressTransactions(t *testing.T) {
4444
t.Parallel()
4545

46-
tb, err := NewTransactionBuilderFromFiles("../test/config-next/wfe2-ratelimit-defaults.yml", "", metrics.NoopRegisterer, blog.NewMock())
46+
tb, err := NewTransactionBuilderFromFiles("../test/config-next/ratelimit-defaults.yml", "", metrics.NoopRegisterer, blog.NewMock())
4747
test.AssertNotError(t, err, "creating TransactionBuilder")
4848

4949
// A check-and-spend transaction for the global limit.
@@ -56,7 +56,7 @@ func TestNewRegistrationsPerIPAddressTransactions(t *testing.T) {
5656
func TestNewRegistrationsPerIPv6AddressTransactions(t *testing.T) {
5757
t.Parallel()
5858

59-
tb, err := NewTransactionBuilderFromFiles("../test/config-next/wfe2-ratelimit-defaults.yml", "", metrics.NoopRegisterer, blog.NewMock())
59+
tb, err := NewTransactionBuilderFromFiles("../test/config-next/ratelimit-defaults.yml", "", metrics.NoopRegisterer, blog.NewMock())
6060
test.AssertNotError(t, err, "creating TransactionBuilder")
6161

6262
// A check-and-spend transaction for the global limit.
@@ -69,7 +69,7 @@ func TestNewRegistrationsPerIPv6AddressTransactions(t *testing.T) {
6969
func TestNewOrdersPerAccountTransactions(t *testing.T) {
7070
t.Parallel()
7171

72-
tb, err := NewTransactionBuilderFromFiles("../test/config-next/wfe2-ratelimit-defaults.yml", "", metrics.NoopRegisterer, blog.NewMock())
72+
tb, err := NewTransactionBuilderFromFiles("../test/config-next/ratelimit-defaults.yml", "", metrics.NoopRegisterer, blog.NewMock())
7373
test.AssertNotError(t, err, "creating TransactionBuilder")
7474

7575
// A check-and-spend transaction for the global limit.
@@ -82,7 +82,7 @@ func TestNewOrdersPerAccountTransactions(t *testing.T) {
8282
func TestFailedAuthorizationsPerDomainPerAccountTransactions(t *testing.T) {
8383
t.Parallel()
8484

85-
tb, err := NewTransactionBuilderFromFiles("../test/config-next/wfe2-ratelimit-defaults.yml", "testdata/working_override_13371338.yml", metrics.NoopRegisterer, blog.NewMock())
85+
tb, err := NewTransactionBuilderFromFiles("../test/config-next/ratelimit-defaults.yml", "testdata/working_override_13371338.yml", metrics.NoopRegisterer, blog.NewMock())
8686
test.AssertNotError(t, err, "creating TransactionBuilder")
8787
err = tb.loadOverrides(context.Background())
8888
test.AssertNotError(t, err, "loading overrides")
@@ -121,7 +121,7 @@ func TestFailedAuthorizationsPerDomainPerAccountTransactions(t *testing.T) {
121121
func TestFailedAuthorizationsForPausingPerDomainPerAccountTransactions(t *testing.T) {
122122
t.Parallel()
123123

124-
tb, err := NewTransactionBuilderFromFiles("../test/config-next/wfe2-ratelimit-defaults.yml", "testdata/working_override_13371338.yml", metrics.NoopRegisterer, blog.NewMock())
124+
tb, err := NewTransactionBuilderFromFiles("../test/config-next/ratelimit-defaults.yml", "testdata/working_override_13371338.yml", metrics.NoopRegisterer, blog.NewMock())
125125
test.AssertNotError(t, err, "creating TransactionBuilder")
126126
err = tb.loadOverrides(context.Background())
127127
test.AssertNotError(t, err, "loading overrides")
@@ -137,7 +137,7 @@ func TestFailedAuthorizationsForPausingPerDomainPerAccountTransactions(t *testin
137137
func TestCertificatesPerDomainTransactions(t *testing.T) {
138138
t.Parallel()
139139

140-
tb, err := NewTransactionBuilderFromFiles("../test/config-next/wfe2-ratelimit-defaults.yml", "", metrics.NoopRegisterer, blog.NewMock())
140+
tb, err := NewTransactionBuilderFromFiles("../test/config-next/ratelimit-defaults.yml", "", metrics.NoopRegisterer, blog.NewMock())
141141
test.AssertNotError(t, err, "creating TransactionBuilder")
142142

143143
// One check-only transaction for the global limit.
@@ -158,7 +158,7 @@ func TestCertificatesPerDomainTransactions(t *testing.T) {
158158
func TestCertificatesPerDomainPerAccountTransactions(t *testing.T) {
159159
t.Parallel()
160160

161-
tb, err := NewTransactionBuilderFromFiles("../test/config-next/wfe2-ratelimit-defaults.yml", "testdata/working_override_13371338.yml", metrics.NoopRegisterer, blog.NewMock())
161+
tb, err := NewTransactionBuilderFromFiles("../test/config-next/ratelimit-defaults.yml", "testdata/working_override_13371338.yml", metrics.NoopRegisterer, blog.NewMock())
162162
test.AssertNotError(t, err, "creating TransactionBuilder")
163163
err = tb.loadOverrides(context.Background())
164164
test.AssertNotError(t, err, "loading overrides")
@@ -211,7 +211,7 @@ func TestCertificatesPerDomainPerAccountTransactions(t *testing.T) {
211211
func TestCertificatesPerFQDNSetTransactions(t *testing.T) {
212212
t.Parallel()
213213

214-
tb, err := NewTransactionBuilderFromFiles("../test/config-next/wfe2-ratelimit-defaults.yml", "", metrics.NoopRegisterer, blog.NewMock())
214+
tb, err := NewTransactionBuilderFromFiles("../test/config-next/ratelimit-defaults.yml", "", metrics.NoopRegisterer, blog.NewMock())
215215
test.AssertNotError(t, err, "creating TransactionBuilder")
216216

217217
// A single check-only transaction for the global limit.
@@ -314,7 +314,7 @@ func TestNewTransactionBuilderFromDatabase(t *testing.T) {
314314
for _, tc := range tests {
315315
t.Run(tc.name, func(t *testing.T) {
316316
mockLog := blog.NewMock()
317-
tb, err := NewTransactionBuilderFromDatabase("../test/config-next/wfe2-ratelimit-defaults.yml", tc.overrides, metrics.NoopRegisterer, mockLog)
317+
tb, err := NewTransactionBuilderFromDatabase("../test/config-next/ratelimit-defaults.yml", tc.overrides, metrics.NoopRegisterer, mockLog)
318318
test.AssertNotError(t, err, "creating TransactionBuilder")
319319
err = tb.limitRegistry.loadOverrides(context.Background())
320320
if tc.expectError != "" {

‎redis/lookup_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ func newTestRedisRing() *redis.Ring {
2828
}
2929

3030
client := redis.NewRing(&redis.RingOptions{
31-
Username: "unittest-rw",
31+
Username: "boulder",
3232
Password: "824968fa490f4ecec1e52d5e34916bdb60d45f8d",
3333
TLSConfig: tlsConfig2,
3434
})

‎test/boulder-tools/flushredis/main.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import (
1515

1616
func main() {
1717
rc := bredis.Config{
18-
Username: "unittest-rw",
18+
Username: "boulder",
1919
TLS: cmd.TLSConfig{
2020
CACertFile: "test/certs/ipki/minica.pem",
2121
CertFile: "test/certs/ipki/localhost/cert.pem",
@@ -30,7 +30,7 @@ func main() {
3030
LookupDNSAuthority: "consul.service.consul",
3131
}
3232
rc.PasswordConfig = cmd.PasswordConfig{
33-
PasswordFile: "test/secrets/ratelimits_redis_password",
33+
PasswordFile: "test/secrets/redis_password",
3434
}
3535

3636
stats := metrics.NoopRegisterer

‎test/config-next/ra.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
"ra": {
33
"limiter": {
44
"redis": {
5-
"username": "boulder-wfe",
6-
"passwordFile": "test/secrets/wfe_ratelimits_redis_password",
5+
"username": "boulder",
6+
"passwordFile": "test/secrets/redis_password",
77
"lookups": [
88
{
99
"Service": "redisratelimits",
@@ -21,7 +21,7 @@
2121
"keyFile": "test/certs/ipki/wfe.boulder/key.pem"
2222
}
2323
},
24-
"Defaults": "test/config-next/wfe2-ratelimit-defaults.yml",
24+
"Defaults": "test/config-next/ratelimit-defaults.yml",
2525
"OverridesFromDB": true
2626
},
2727
"maxContactsPerRegistration": 3,

‎test/config-next/wfe2-ratelimit-defaults.yml‎ renamed to ‎test/config-next/ratelimit-defaults.yml‎

File renamed without changes.

‎test/config-next/wfe2-ratelimit-overrides.yml‎ renamed to ‎test/config-next/ratelimit-overrides.yml‎

File renamed without changes.

‎test/config-next/sfe.json‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,29 @@
2828
"noWaitForReady": true,
2929
"hostOverride": "sa.boulder"
3030
},
31+
"limiter": {
32+
"redis": {
33+
"username": "boulder",
34+
"passwordFile": "test/secrets/redis_password",
35+
"lookups": [
36+
{
37+
"Service": "redisratelimits",
38+
"Domain": "service.consul"
39+
}
40+
],
41+
"lookupDNSAuthority": "consul.service.consul",
42+
"readTimeout": "250ms",
43+
"writeTimeout": "250ms",
44+
"poolSize": 100,
45+
"routeRandomly": true,
46+
"tls": {
47+
"caCertFile": "test/certs/ipki/minica.pem",
48+
"certFile": "test/certs/ipki/wfe.boulder/cert.pem",
49+
"keyFile": "test/certs/ipki/wfe.boulder/key.pem"
50+
}
51+
},
52+
"Defaults": "test/config-next/sfe-ratelimit-defaults.yml"
53+
},
3154
"emailExporter": {
3255
"dnsAuthority": "consul.service.consul",
3356
"srvLookup": {

0 commit comments

Comments
 (0)