ston1th/haproxy-lb
0
0
Fork 0
Code Issues Releases Activity

make tls optional

Browse source
This commit is contained in:
ston1th 2021-03-07 13:20:32 +01:00
commit c9996712de
4 changed files with 46 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

74
pkg/api/server.go
View file

@ -31,8 +31,8 @@ type Server struct {
stop chan struct{}
stopKeyReset chan struct{}
cert tls.Certificate
listen net.Listener
tlsConfig *tls.Config
listen net.Listener
}
type notFoundHandler struct {
@ -58,16 +58,44 @@ func NewServer(c *config.Config, log logr.Logger) (*Server, error) {
stop: make(chan struct{}),
stopKeyReset: make(chan struct{}),
}
cert, err := tls.LoadX509KeyPair(c.Server.TLS.Cert, c.Server.TLS.Key)
if err != nil {
return nil, err
if c.Server.TLS != nil {
cert, err := tls.LoadX509KeyPair(c.Server.TLS.Cert, c.Server.TLS.Key)
if err != nil {
return nil, err
}
s.tlsConfig = &tls.Config{
MinVersion: tls.VersionTLS12,
CipherSuites: []uint16{
tls.TLS_AES_256_GCM_SHA384,
tls.TLS_CHACHA20_POLY1305_SHA256,
tls.TLS_AES_128_GCM_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
},
CurvePreferences: []tls.CurveID{
tls.X25519,
tls.CurveP384,
tls.CurveP521,
},
PreferServerCipherSuites: true,
Certificates: []tls.Certificate{cert},
}
l, err := tls.Listen("tcp", c.Server.Listen, s.tlsConfig)
if err != nil {
return nil, err
}
s.listen = l
} else {
l, err := net.Listen("tcp", c.Server.Listen)
if err != nil {
return nil, err
}
s.listen = l
}
s.cert = cert
l, err := net.Listen("tcp", c.Server.Listen)
if err != nil {
return nil, err
}
s.listen = l
s.mux.NotFoundHandler = &notFoundHandler{s}
for _, v := range serverv1.Routes {
@ -95,28 +123,8 @@ func (s *Server) UpdateDB(db *db.DB) error {
func (s *Server) start() {
<-s.init
s.srv = &http.Server{
Handler: s.mux,
TLSConfig: &tls.Config{
MinVersion: tls.VersionTLS12,
CipherSuites: []uint16{
tls.TLS_AES_256_GCM_SHA384,
tls.TLS_CHACHA20_POLY1305_SHA256,
tls.TLS_AES_128_GCM_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
},
CurvePreferences: []tls.CurveID{
tls.X25519,
tls.CurveP384,
tls.CurveP521,
},
PreferServerCipherSuites: true,
Certificates: []tls.Certificate{s.cert},
},
Handler: s.mux,
TLSConfig: s.tlsConfig,
ReadTimeout: 10 * time.Second,
WriteTimeout: 10 * time.Second,
}