ston1th/haproxy-lb
0
0
Fork 0
Code Issues Releases Activity

make tls optional

Browse source
This commit is contained in:
ston1th 2021-03-07 13:20:32 +01:00
commit c9996712de
4 changed files with 46 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

74
pkg/api/server.go
View file

@ -31,8 +31,8 @@ type Server struct {
stop chan struct{} stop chan struct{}
stopKeyReset chan struct{} stopKeyReset chan struct{}
cert tls.Certificate tlsConfig *tls.Config
listen net.Listener listen net.Listener
} }
type notFoundHandler struct { type notFoundHandler struct {
@ -58,16 +58,44 @@ func NewServer(c *config.Config, log logr.Logger) (*Server, error) {
stop: make(chan struct{}), stop: make(chan struct{}),
stopKeyReset: make(chan struct{}), stopKeyReset: make(chan struct{}),
} }
cert, err := tls.LoadX509KeyPair(c.Server.TLS.Cert, c.Server.TLS.Key) if c.Server.TLS != nil {
if err != nil { cert, err := tls.LoadX509KeyPair(c.Server.TLS.Cert, c.Server.TLS.Key)
return nil, err if err != nil {
return nil, err
}
s.tlsConfig = &tls.Config{
MinVersion: tls.VersionTLS12,
CipherSuites: []uint16{
tls.TLS_AES_256_GCM_SHA384,
tls.TLS_CHACHA20_POLY1305_SHA256,
tls.TLS_AES_128_GCM_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
},
CurvePreferences: []tls.CurveID{
tls.X25519,
tls.CurveP384,
tls.CurveP521,
},
PreferServerCipherSuites: true,
Certificates: []tls.Certificate{cert},
}
l, err := tls.Listen("tcp", c.Server.Listen, s.tlsConfig)
if err != nil {
return nil, err
}
s.listen = l
} else {
l, err := net.Listen("tcp", c.Server.Listen)
if err != nil {
return nil, err
}
s.listen = l
} }
s.cert = cert
l, err := net.Listen("tcp", c.Server.Listen)
if err != nil {
return nil, err
}
s.listen = l
s.mux.NotFoundHandler = &notFoundHandler{s} s.mux.NotFoundHandler = &notFoundHandler{s}
for _, v := range serverv1.Routes { for _, v := range serverv1.Routes {
@ -95,28 +123,8 @@ func (s *Server) UpdateDB(db *db.DB) error {
func (s *Server) start() { func (s *Server) start() {
<-s.init <-s.init
s.srv = &http.Server{ s.srv = &http.Server{
Handler: s.mux, Handler: s.mux,
TLSConfig: &tls.Config{ TLSConfig: s.tlsConfig,
MinVersion: tls.VersionTLS12,
CipherSuites: []uint16{
tls.TLS_AES_256_GCM_SHA384,
tls.TLS_CHACHA20_POLY1305_SHA256,
tls.TLS_AES_128_GCM_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
},
CurvePreferences: []tls.CurveID{
tls.X25519,
tls.CurveP384,
tls.CurveP521,
},
PreferServerCipherSuites: true,
Certificates: []tls.Certificate{s.cert},
},
ReadTimeout: 10 * time.Second, ReadTimeout: 10 * time.Second,
WriteTimeout: 10 * time.Second, WriteTimeout: 10 * time.Second,
} }

2
pkg/config/config.go
View file

@ -144,7 +144,7 @@ type Config struct {
type Server struct { type Server struct {
Listen string `yaml:"listen"` Listen string `yaml:"listen"`
TLS TLS `yaml:"tls"` TLS *TLS `yaml:"tls"`
BasicAuth []BasicAuth `yaml:"basicAuth"` BasicAuth []BasicAuth `yaml:"basicAuth"`
} }

4
run_etcd.sh
View file

@ -1,6 +1,4 @@
#!/bin/sh #!/bin/sh
cd data cd data
../vipman -config etcd.yaml & ../haproxy-lb -config etcd.yaml
../vipman -config etcd.yaml &
../vipman -config etcd.yaml

6
run_raft.sh
View file

@ -2,6 +2,6 @@
cd data cd data
rm -rf node* rm -rf node*
../vipman -config raft1.yaml & ../haproxy-lb -config raft1.yaml &
../vipman -config raft2.yaml & ../haproxy-lb -config raft2.yaml &
../vipman -config raft3.yaml ../haproxy-lb -config raft3.yaml