|
1 | 1 | package main |
2 | 2 |
|
3 | 3 | import ( |
4 | | - "fmt" |
| 4 | + "crypto/tls" |
5 | 5 | "net" |
6 | | - "os" |
7 | | - "path/filepath" |
| 6 | + "net/http" |
8 | 7 |
|
9 | 8 | "github.com/gin-gonic/gin" |
10 | | - "github.com/utmstack/UTMStack/log-auth-proxy/config" |
11 | 9 | "github.com/utmstack/UTMStack/log-auth-proxy/handlers" |
12 | 10 | "github.com/utmstack/UTMStack/log-auth-proxy/logservice" |
13 | 11 | "github.com/utmstack/UTMStack/log-auth-proxy/middleware" |
14 | 12 | "github.com/utmstack/UTMStack/log-auth-proxy/utils" |
15 | 13 | "google.golang.org/grpc" |
| 14 | + "google.golang.org/grpc/credentials" |
16 | 15 | "google.golang.org/grpc/health" |
17 | 16 | "google.golang.org/grpc/health/grpc_health_v1" |
18 | 17 | ) |
19 | 18 |
|
20 | 19 | func main() { |
21 | | - h := utils.GetLogger() |
22 | 20 | autService := logservice.NewLogAuthService() |
23 | 21 | go autService.SyncAuth() |
24 | 22 | authInterceptor := middleware.NewLogAuthInterceptor(autService) |
25 | 23 |
|
26 | | - cert, key, err := loadCerts() |
27 | | - if err != nil { |
28 | | - h.Fatal("Failed to load certificates: %v", err) |
29 | | - } |
30 | | - |
31 | 24 | logOutputService := logservice.NewLogOutputService() |
32 | 25 | go logOutputService.SyncOutputs() |
33 | 26 |
|
34 | | - go startHTTPServer(authInterceptor, logOutputService, cert, key) |
| 27 | + go startHTTPServer(authInterceptor, logOutputService) |
35 | 28 | go startGRPCServer(authInterceptor, logOutputService) |
36 | 29 |
|
37 | | - // Block the main thread until an interrupt is received |
38 | 30 | select {} |
39 | 31 | } |
40 | 32 |
|
41 | | -func startHTTPServer(interceptor *middleware.LogAuthInterceptor, logOutputService *logservice.LogOutputService, cert string, key string) { |
| 33 | +func startHTTPServer(interceptor *middleware.LogAuthInterceptor, logOutputService *logservice.LogOutputService) { |
42 | 34 | h := utils.GetLogger() |
| 35 | + |
43 | 36 | gin.SetMode(gin.ReleaseMode) |
44 | 37 | router := gin.Default() |
45 | 38 | router.POST("/v1/log", interceptor.HTTPAuthInterceptor(), handlers.HttpLog(logOutputService)) |
46 | 39 | router.POST("/v1/logs", interceptor.HTTPAuthInterceptor(), handlers.HttpBulkLog(logOutputService)) |
47 | 40 | router.POST("/v1/github-webhook", interceptor.HTTPGitHubAuthInterceptor(), handlers.HttpGitHubHandler(logOutputService)) |
48 | 41 | router.GET("/v1/ping", handlers.HttpPing) |
49 | | - err := router.RunTLS(":8080", cert, key) |
50 | | - h.Info("Starting HTTP server on 0.0.0.0:8080") |
| 42 | + |
| 43 | + cert, err := tls.LoadX509KeyPair("/cert/utm.crt", "/cert/utm.key") |
51 | 44 | if err != nil { |
52 | | - h.ErrorF("Failed to start HTTP server: %v", err) |
53 | | - return |
| 45 | + h.Fatal("failed to load server certificates: %v", err) |
54 | 46 | } |
55 | | -} |
56 | 47 |
|
57 | | -func loadCerts() (string, string, error) { |
58 | | - certsLocation := os.Getenv(config.UTMCertsLocationEnv) |
59 | | - certPath := filepath.Join(certsLocation, config.UTMCertFileName) |
60 | | - keyPath := filepath.Join(certsLocation, config.UTMCertFileKey) |
| 48 | + tlsConfig := &tls.Config{ |
| 49 | + MinVersion: tls.VersionTLS13, |
| 50 | + Certificates: []tls.Certificate{cert}, |
| 51 | + } |
61 | 52 |
|
62 | | - if _, err := os.Stat(certPath); os.IsNotExist(err) { |
63 | | - return "", "", fmt.Errorf("certificate file does not exist: %s", certPath) |
| 53 | + server := &http.Server{ |
| 54 | + Addr: ":8080", |
| 55 | + Handler: router, |
| 56 | + TLSConfig: tlsConfig, |
64 | 57 | } |
65 | | - if _, err := os.Stat(keyPath); os.IsNotExist(err) { |
66 | | - return "", "", fmt.Errorf("key file does not exist: %s", keyPath) |
| 58 | + |
| 59 | + h.Info("Starting HTTP server on 0.0.0.0:8080") |
| 60 | + err = server.ListenAndServeTLS("", "") |
| 61 | + if err != nil { |
| 62 | + h.Fatal("Failed to start HTTP server: %v", err) |
67 | 63 | } |
68 | | - return certPath, keyPath, nil |
69 | 64 | } |
70 | 65 |
|
71 | 66 | func startGRPCServer(interceptor *middleware.LogAuthInterceptor, logOutputService *logservice.LogOutputService) { |
72 | 67 | h := utils.GetLogger() |
73 | | - lis, err := net.Listen("tcp", "0.0.0.0:50051") |
| 68 | + |
| 69 | + cert, err := tls.LoadX509KeyPair("/cert/utm.crt", "/cert/utm.key") |
74 | 70 | if err != nil { |
75 | | - h.Fatal("failed to listen grpc server: %v", err) |
| 71 | + h.Fatal("failed to load server certificates: %v", err) |
76 | 72 | } |
77 | 73 |
|
| 74 | + tlsConfig := &tls.Config{ |
| 75 | + MinVersion: tls.VersionTLS13, |
| 76 | + Certificates: []tls.Certificate{cert}, |
| 77 | + } |
| 78 | + |
| 79 | + creds := credentials.NewTLS(tlsConfig) |
| 80 | + |
78 | 81 | s := &logservice.Grpc{ |
79 | 82 | OutputService: logOutputService, |
80 | 83 | } |
81 | 84 |
|
82 | | - grpcServer := grpc.NewServer(grpc.UnaryInterceptor(interceptor.GrpcRecoverInterceptor), |
83 | | - grpc.ChainUnaryInterceptor(interceptor.GrpcAuthInterceptor)) |
| 85 | + grpcServer := grpc.NewServer( |
| 86 | + grpc.Creds(creds), |
| 87 | + grpc.UnaryInterceptor(interceptor.GrpcRecoverInterceptor), |
| 88 | + grpc.ChainUnaryInterceptor(interceptor.GrpcAuthInterceptor), |
| 89 | + ) |
| 90 | + |
84 | 91 | logservice.RegisterLogServiceServer(grpcServer, s) |
85 | 92 |
|
86 | | - // Register the health check service |
87 | 93 | healthServer := health.NewServer() |
88 | 94 | grpc_health_v1.RegisterHealthServer(grpcServer, healthServer) |
89 | 95 | healthServer.SetServingStatus("", grpc_health_v1.HealthCheckResponse_SERVING) |
90 | 96 |
|
91 | | - // Start the gRPC server |
| 97 | + lis, err := net.Listen("tcp", "0.0.0.0:50051") |
| 98 | + if err != nil { |
| 99 | + h.Fatal("failed to listen grpc server: %v", err) |
| 100 | + } |
| 101 | + |
92 | 102 | h.Info("Starting gRPC server on 0.0.0.0:50051") |
93 | 103 | if err := grpcServer.Serve(lis); err != nil { |
94 | 104 | h.Fatal("Failed to serve grpc: %v", err) |
|
0 commit comments