Skip to content

Commit 10f1462

Browse files
leifjleifj
authored
Merge pull request #5 from AniaAlex/Add-tls-support
feat:Add tls support
2 parents 218de41 + a779e1e commit 10f1462

File tree

3 files changed

+99
-12
lines changed

3 files changed

+99
-12
lines changed

‎cmd/main.go‎

Lines changed: 40 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,10 @@ func usage() {
154154
fmt.Fprintln(os.Stderr, " --port API server port (default: 6001)")
155155
fmt.Fprintln(os.Stderr, " --frequency Pipeline update frequency (default: 5m)")
156156
fmt.Fprintln(os.Stderr, " --no-server Run pipeline once and exit (no API server)")
157+
fmt.Fprintln(os.Stderr, "TLS/HTTPS options:")
158+
fmt.Fprintln(os.Stderr, " --tls-enable Enable TLS/HTTPS (default: false)")
159+
fmt.Fprintln(os.Stderr, " --tls-cert TLS certificate file path")
160+
fmt.Fprintln(os.Stderr, " --tls-key TLS private key file path")
157161
fmt.Fprintln(os.Stderr, "Logging options:")
158162
fmt.Fprintln(os.Stderr, " --log-level Logging level: debug, info, warn, error, fatal (default: info)")
159163
fmt.Fprintln(os.Stderr, " --log-format Logging format: text or json (default: text)")
@@ -194,6 +198,11 @@ func main() {
194198
freq := flag.Duration("frequency", 0, "Pipeline update frequency (overrides config file)")
195199
noServer := flag.Bool("no-server", false, "Run pipeline once and exit (no API server)")
196200

201+
// TLS configuration
202+
tlsEnabled := flag.Bool("tls-enable", false, "Enable TLS/HTTPS (overrides config file)")
203+
tlsCertFile := flag.String("tls-cert", "", "TLS certificate file path (overrides config file)")
204+
tlsKeyFile := flag.String("tls-key", "", "TLS private key file path (overrides config file)")
205+
197206
// Logging configuration
198207
logLevel := flag.String("log-level", "", "Logging level (overrides config file)")
199208
logFormat := flag.String("log-format", "", "Logging format (overrides config file)")
@@ -237,6 +246,15 @@ func main() {
237246
if *freq != 0 {
238247
cfg.Server.Frequency = *freq
239248
}
249+
if *tlsEnabled {
250+
cfg.Server.TLS.Enabled = *tlsEnabled
251+
}
252+
if *tlsCertFile != "" {
253+
cfg.Server.TLS.CertFile = *tlsCertFile
254+
}
255+
if *tlsKeyFile != "" {
256+
cfg.Server.TLS.KeyFile = *tlsKeyFile
257+
}
240258
if *logLevel != "" {
241259
cfg.Logging.Level = *logLevel
242260
}
@@ -352,17 +370,36 @@ func main() {
352370
listenAddr := fmt.Sprintf("%s:%s", cfg.Server.Host, cfg.Server.Port)
353371

354372
// Log startup information
373+
protocol := "HTTP"
374+
if cfg.Server.TLS.Enabled {
375+
protocol = "HTTPS"
376+
}
355377
logger.Info("API server starting",
356378
logging.F("address", listenAddr),
379+
logging.F("protocol", protocol),
380+
logging.F("tls_enabled", cfg.Server.TLS.Enabled),
357381
logging.F("version", Version),
358382
logging.F("pipeline", pipelineFile),
359383
logging.F("log_level", cfg.Logging.Level),
360384
logging.F("frequency", cfg.Server.Frequency.String()))
361385

362-
if err := r.Run(listenAddr); err != nil {
386+
// Start server with or without TLS based on configuration
387+
var serverErr error
388+
if cfg.Server.TLS.Enabled {
389+
logger.Info("Starting HTTPS server",
390+
logging.F("cert_file", cfg.Server.TLS.CertFile),
391+
logging.F("key_file", cfg.Server.TLS.KeyFile))
392+
serverErr = r.RunTLS(listenAddr, cfg.Server.TLS.CertFile, cfg.Server.TLS.KeyFile)
393+
} else {
394+
logger.Info("Starting HTTP server")
395+
serverErr = r.Run(listenAddr)
396+
}
397+
398+
if serverErr != nil {
363399
logger.Error("API server failed to start",
364-
logging.F("error", err.Error()),
365-
logging.F("address", listenAddr))
400+
logging.F("error", serverErr.Error()),
401+
logging.F("address", listenAddr),
402+
logging.F("protocol", protocol))
366403
os.Exit(1)
367404
}
368405
}

‎example/config.yaml‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,17 @@ server:
66
# HTTP server hostname (default: 127.0.0.1)
77
# Environment variable: GT_HOST
88
host: "127.0.0.1"
9-
9+
10+
# TLS/HTTPS configuration
11+
tls:
12+
enabled: false
13+
cert_file: "/etc/certs/go-trust.pem"
14+
key_file: "/etc/certsgo-trust.key"
15+
1016
# HTTP server port (default: 6001)
1117
# Environment variable: GT_PORT
1218
port: "6001"
13-
19+
1420
# Pipeline update frequency (default: 5m)
1521
# Accepts duration strings: 10s, 1m, 5m, 1h
1622
# Environment variable: GT_FREQUENCY
@@ -21,11 +27,11 @@ logging:
2127
# Log level: debug, info, warn, error, fatal (default: info)
2228
# Environment variable: GT_LOG_LEVEL
2329
level: "info"
24-
30+
2531
# Log format: text or json (default: text)
2632
# Environment variable: GT_LOG_FORMAT
2733
format: "text"
28-
34+
2935
# Log output: stdout, stderr, or file path (default: stdout)
3036
# Environment variable: GT_LOG_OUTPUT
3137
output: "stdout"
@@ -35,15 +41,15 @@ pipeline:
3541
# Request timeout duration (default: 30s)
3642
# Environment variable: GT_PIPELINE_TIMEOUT
3743
timeout: "30s"
38-
44+
3945
# Maximum request size in bytes (default: 10485760 = 10MB)
4046
# Environment variable: GT_MAX_REQUEST_SIZE
4147
max_request_size: 10485760
42-
48+
4349
# Maximum number of HTTP redirects to follow (default: 3)
4450
# Environment variable: GT_MAX_REDIRECTS
4551
max_redirects: 3
46-
52+
4753
# List of allowed hosts for TSL fetching (wildcard supported)
4854
# Leave empty to allow all hosts
4955
# Environment variable: GT_ALLOWED_HOSTS (comma-separated)
@@ -56,11 +62,11 @@ security:
5662
# API rate limit in requests per second (default: 100)
5763
# Environment variable: GT_RATE_LIMIT_RPS
5864
rate_limit_rps: 100
59-
65+
6066
# Enable CORS (Cross-Origin Resource Sharing) (default: false)
6167
# Environment variable: GT_ENABLE_CORS (true/false)
6268
enable_cors: false
63-
69+
6470
# List of allowed CORS origins (requires enable_cors: true)
6571
# Environment variable: GT_ALLOWED_ORIGINS (comma-separated)
6672
allowed_origins:

‎pkg/config/config.go‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,14 @@ type ServerConfig struct {
2828
Port string `yaml:"port"`
2929
Frequency time.Duration `yaml:"frequency"`
3030
ExternalURL string `yaml:"external_url"` // External URL for PDP discovery (e.g., https://pdp.example.com)
31+
TLS TLSConfig `yaml:"tls"`
32+
}
33+
34+
// TLSConfig contains TLS/HTTPS server configuration settings.
35+
type TLSConfig struct {
36+
Enabled bool `yaml:"enabled"` // Enable TLS/HTTPS
37+
CertFile string `yaml:"cert_file"` // Path to TLS certificate file
38+
KeyFile string `yaml:"key_file"` // Path to TLS private key file
3139
}
3240

3341
// LoggingConfig contains logging configuration settings.
@@ -59,6 +67,11 @@ func DefaultConfig() *Config {
5967
Host: "127.0.0.1",
6068
Port: "6001",
6169
Frequency: 5 * time.Minute,
70+
TLS: TLSConfig{
71+
Enabled: false,
72+
CertFile: "",
73+
KeyFile: "",
74+
},
6275
},
6376
Logging: LoggingConfig{
6477
Level: "info",
@@ -130,6 +143,20 @@ func applyEnvOverrides(cfg *Config) {
130143
cfg.Server.Frequency = d
131144
}
132145
}
146+
if v := os.Getenv("GT_EXTERNAL_URL"); v != "" {
147+
cfg.Server.ExternalURL = v
148+
}
149+
150+
// TLS configuration
151+
if v := os.Getenv("GT_TLS_ENABLED"); v != "" {
152+
cfg.Server.TLS.Enabled = strings.ToLower(v) == "true" || v == "1"
153+
}
154+
if v := os.Getenv("GT_TLS_CERT_FILE"); v != "" {
155+
cfg.Server.TLS.CertFile = v
156+
}
157+
if v := os.Getenv("GT_TLS_KEY_FILE"); v != "" {
158+
cfg.Server.TLS.KeyFile = v
159+
}
133160

134161
// Logging configuration
135162
if v := os.Getenv("GT_LOG_LEVEL"); v != "" {
@@ -187,6 +214,23 @@ func (c *Config) Validate() error {
187214
return fmt.Errorf("server frequency must be positive")
188215
}
189216

217+
// Validate TLS configuration
218+
if c.Server.TLS.Enabled {
219+
if c.Server.TLS.CertFile == "" {
220+
return fmt.Errorf("TLS certificate file is required when TLS is enabled")
221+
}
222+
if c.Server.TLS.KeyFile == "" {
223+
return fmt.Errorf("TLS key file is required when TLS is enabled")
224+
}
225+
// Check if certificate and key files exist
226+
if err := validation.ValidateFilePath(c.Server.TLS.CertFile); err != nil {
227+
return fmt.Errorf("invalid TLS certificate file: %w", err)
228+
}
229+
if err := validation.ValidateFilePath(c.Server.TLS.KeyFile); err != nil {
230+
return fmt.Errorf("invalid TLS key file: %w", err)
231+
}
232+
}
233+
190234
// Validate logging configuration
191235
validLevels := map[string]bool{"debug": true, "info": true, "warn": true, "error": true, "fatal": true}
192236
if !validLevels[strings.ToLower(c.Logging.Level)] {

0 commit comments

Comments
 (0)