1
0
mirror of https://github.com/mainflux/mainflux.git synced 2025-04-27 13:48:49 +08:00
nwest1 260df3ae40 MF-426 - Add optional MF_CA_CERTS env variable to allow GRPC client to use TLS certs (#430)
* MF-426-Add optional MF_CA_CERTS env variable to allow GRPC client to use TLS certs

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* enable things client to be configured with a ca cert path

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* MF_CA_CERTS docs for http adapter and things service, additional logging and improved error handling when setting up TLS gRPC client

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* refactor things connect to separate function

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* getting-started updates, corrected things env variable

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* clarifying ca certs default functionality

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* configuring tls termination at service endpoint

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* enable TLS configuration for users and things

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* nginx forwarding

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* go imports

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* bad logging change

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* naming specifically to the http adapter component

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* updated tls keys, slightly different grpc configuration

set localhost, users and things as subject alternative names

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* log message consistency

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* readme updates related to server ssl configuration

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* Trying to resolve confilcts

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* removing conflicting lines from docker-compose

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* adding back http-adapter configuration

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* slight readme update

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>

* readme tweaks

Signed-off-by: nwest1 <nwest1@users.noreply.github.com>
2018-11-06 21:09:17 +01:00

142 lines
3.4 KiB
Go

//
// Copyright (c) 2018
// Mainflux
//
// SPDX-License-Identifier: Apache-2.0
//
package main
import (
"fmt"
"log"
"net/http"
"os"
"os/signal"
"syscall"
"google.golang.org/grpc/credentials"
kitprometheus "github.com/go-kit/kit/metrics/prometheus"
"github.com/mainflux/mainflux"
adapter "github.com/mainflux/mainflux/http"
"github.com/mainflux/mainflux/http/api"
"github.com/mainflux/mainflux/http/nats"
"github.com/mainflux/mainflux/logger"
thingsapi "github.com/mainflux/mainflux/things/api/grpc"
broker "github.com/nats-io/go-nats"
stdprometheus "github.com/prometheus/client_golang/prometheus"
"google.golang.org/grpc"
)
const (
defCACerts string = ""
defPort string = "8180"
defLogLevel string = "error"
defNatsURL string = broker.DefaultURL
defThingsURL string = "localhost:8181"
envCACerts string = "MF_HTTP_ADAPTER_CA_CERTS"
envPort string = "MF_HTTP_ADAPTER_PORT"
envLogLevel string = "MF_HTTP_ADAPTER_LOG_LEVEL"
envNatsURL string = "MF_NATS_URL"
envThingsURL string = "MF_THINGS_URL"
)
type config struct {
ThingsURL string
NatsURL string
LogLevel string
Port string
CACerts string
}
func main() {
cfg := loadConfig()
logger, err := logger.New(os.Stdout, cfg.LogLevel)
if err != nil {
log.Fatalf(err.Error())
}
nc, err := broker.Connect(cfg.NatsURL)
if err != nil {
logger.Error(fmt.Sprintf("Failed to connect to NATS: %s", err))
os.Exit(1)
}
defer nc.Close()
conn := connectToThingsService(cfg, logger)
defer conn.Close()
cc := thingsapi.NewClient(conn)
pub := nats.NewMessagePublisher(nc)
svc := adapter.New(pub)
svc = api.LoggingMiddleware(svc, logger)
svc = api.MetricsMiddleware(
svc,
kitprometheus.NewCounterFrom(stdprometheus.CounterOpts{
Namespace: "http_adapter",
Subsystem: "api",
Name: "request_count",
Help: "Number of requests received.",
}, []string{"method"}),
kitprometheus.NewSummaryFrom(stdprometheus.SummaryOpts{
Namespace: "http_adapter",
Subsystem: "api",
Name: "request_latency_microseconds",
Help: "Total duration of requests in microseconds.",
}, []string{"method"}),
)
errs := make(chan error, 2)
go func() {
p := fmt.Sprintf(":%s", cfg.Port)
logger.Info(fmt.Sprintf("HTTP adapter service started on port %s", cfg.Port))
errs <- http.ListenAndServe(p, api.MakeHandler(svc, cc))
}()
go func() {
c := make(chan os.Signal)
signal.Notify(c, syscall.SIGINT)
errs <- fmt.Errorf("%s", <-c)
}()
err = <-errs
logger.Error(fmt.Sprintf("HTTP adapter terminated: %s", err))
}
func loadConfig() config {
return config{
ThingsURL: mainflux.Env(envThingsURL, defThingsURL),
NatsURL: mainflux.Env(envNatsURL, defNatsURL),
LogLevel: mainflux.Env(envLogLevel, defLogLevel),
Port: mainflux.Env(envPort, defPort),
CACerts: mainflux.Env(envCACerts, defCACerts),
}
}
func connectToThingsService(cfg config, logger logger.Logger) *grpc.ClientConn {
var opts []grpc.DialOption
if cfg.CACerts != "" {
tpc, err := credentials.NewClientTLSFromFile(cfg.CACerts, "")
if err != nil {
logger.Error(fmt.Sprintf("Failed to load certs: %s", err))
os.Exit(1)
}
opts = append(opts, grpc.WithTransportCredentials(tpc))
} else {
logger.Info("gRPC communication is not encrypted")
opts = append(opts, grpc.WithInsecure())
}
conn, err := grpc.Dial(cfg.ThingsURL, opts...)
if err != nil {
logger.Error(fmt.Sprintf("Failed to connect to things service: %s", err))
os.Exit(1)
}
return conn
}