-
Notifications
You must be signed in to change notification settings - Fork 296
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
pd: 🔨 rework RootCommand::start auto-https logic
## 👀 overview fixes #3627. this reorganizes the logic in pd's startup code related to automatically managed https functionality. ## 🎨 background & motivation this PR, besides cleaning up the `rustls-acme`-related auto-https logic, is also interested in *creating a state-of-affairs that will dovetail into pr #3522*. in particular, this expression to start the GRPC serve given a bound listener... ```rust tokio::task::Builder::new() .name("grpc_server") .spawn(grpc_server.serve_with_incoming(tls_incoming)) .expect("failed to spawn grpc server") ``` ...should be adjusted so as to work with an `axum::Router`. ### ⚖️ `rustls-acme` and `tokio-rustls-acme` quoth the #3627 description, citing an earlier comment: > In the ~year since this code was written, there may be better options. > `tokio-rustls-acme` seems promising \- <#3522 (comment)> for reference, the repositories for each live here, and here: - <https://github.com/FlorianUekermann/rustls-acme> - <https://github.com/n0-computer/tokio-rustls-acme> after some comparison, i have come to the opinion that `rustls-acme` will still be adequate for our purposes. the latter is a fork of the former, but active development appears to have continued in the former, and i did not see any particular "_must-have_" features for us in the latter. ## 🎴 changes this commit moves some of the auto-https related code from the `main` entrypoint, into standalone functions in `pd::main`. some constants are defined, to keep control flow clear and to help facilitate the addition of future options e.g. a flag to control the LetsEncrypt environment to use. ## 🚰 dropping down to `axum`; a brief note on future upgrades as stated above, we want to switch to an `axum::Router`. this means that we won't be able to use the `AcmeConfig::incoming` function. the `rustls-acme` library provides some "low-level" examples this work is based upon - <https://github.com/FlorianUekermann/rustls-acme/blob/main/examples/low_level_tokio.rs> - <https://github.com/FlorianUekermann/rustls-acme/blob/main/examples/low_level_axum.rs> we also use `tonic` 0.10.2 in pd, and elsewhere in the penumbra monorepo. tonic isn't using hyper 1.x yet. this was being worked on in hyperium/tonic#1583, continued on in hyperium/tonic#1595, and tracked in hyperium/tonic#1579. that work also depends upon hyperium/hyper#3461. we will need to be wait for tonic to finish its migration over to hyper 1.0, see: hyperium/tonic#1579 (comment) this is understandable, but i make note of this situation as a signpost for our future selves when considering a migration to recent versions of axum-server, axum, rustls-acme, or hyper. for now, it's easiest to stay in lock-step with tonic, and we can revisit the upgrade path(s) at a future date. === Refs: #3627 Refs: #3646 Refs: #3522
- Loading branch information
Showing
4 changed files
with
137 additions
and
93 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,54 +1,94 @@ | ||
| use std::{ | ||
| pin::Pin, | ||
| task::{Context, Poll}, | ||
| }; | ||
| //! Automatic HTTPS certificate management facilities. | ||
| //! | ||
| //! See [`axum_acceptor`] for more information. | ||
|
|
||
| use pin_project::pin_project; | ||
| use rustls_acme::futures_rustls::server::TlsStream; | ||
| use tokio::{ | ||
| io::{AsyncRead, AsyncWrite, ReadBuf}, | ||
| net::TcpStream, | ||
| use { | ||
| anyhow::Error, | ||
| futures::Future, | ||
| rustls::ServerConfig, | ||
| rustls_acme::{axum::AxumAcceptor, caches::DirCache, AcmeConfig, AcmeState}, | ||
| std::{fmt::Debug, path::PathBuf, sync::Arc}, | ||
| }; | ||
| use tokio_util::compat::Compat; | ||
| use tonic::transport::server::Connected; | ||
|
|
||
| /// Wrapper type needed to convert between futures_io and tokio traits | ||
| #[pin_project] | ||
| pub struct Wrapper { | ||
| #[pin] | ||
| pub inner: Compat<TlsStream<Compat<TcpStream>>>, | ||
| } | ||
|
|
||
| impl Connected for Wrapper { | ||
| type ConnectInfo = <TcpStream as Connected>::ConnectInfo; | ||
| /// Protocols supported by this server, in order of preference. | ||
| /// | ||
| /// See [rfc7301] for more info on ALPN. | ||
| /// | ||
| /// [rfc7301]: https://datatracker.ietf.org/doc/html/rfc7301 | ||
| // | ||
| // We also permit HTTP1.1 for backwards-compatibility, specifically for grpc-web. | ||
| const ALPN_PROTOCOLS: [&'static [u8]; 2] = [b"h2", b"http/1.1"]; | ||
|
|
||
| fn connect_info(&self) -> Self::ConnectInfo { | ||
| self.inner.get_ref().get_ref().0.get_ref().connect_info() | ||
| } | ||
| /// The location of the file-based certificate cache. | ||
| // NB: this must not be an absolute path see [Path::join]. | ||
| const CACHE_DIR: &'static str = "tokio_rustls_acme_cache"; | ||
|
|
||
| /// If true, use the production Let's Encrypt environment. | ||
| /// | ||
| /// If false, the ACME resolver will use the [staging environment]. | ||
| /// | ||
| /// [staging environment]: https://letsencrypt.org/docs/staging-environment/ | ||
| const PRODUCTION_LETS_ENCRYPT: bool = true; | ||
|
|
||
| /// Use ACME to resolve certificates and handle new connections. | ||
| /// | ||
| /// This returns a tuple containing an [`AxumAcceptor`] that may be used with [`axum_server`], and | ||
| /// a [`Future`] that represents the background task to poll and log for changes in the | ||
| /// certificate environment. | ||
| pub fn axum_acceptor( | ||
| home: PathBuf, | ||
| domain: String, | ||
| ) -> (AxumAcceptor, impl Future<Output = Result<(), Error>>) { | ||
| // Use a file-based cache located within the home directory. | ||
| let cache = home.join(CACHE_DIR); | ||
| let cache = DirCache::new(cache); | ||
|
|
||
| // Create an ACME client, which we will use to resolve certificates. | ||
| let state = AcmeConfig::new(vec![domain]) | ||
| .cache(cache) | ||
| .directory_lets_encrypt(PRODUCTION_LETS_ENCRYPT) | ||
| .state(); | ||
|
|
||
| // Define our server configuration, using the ACME certificate resolver. | ||
| let mut rustls_config = ServerConfig::builder() | ||
| .with_safe_defaults() | ||
| .with_no_client_auth() | ||
| .with_cert_resolver(state.resolver()); | ||
| rustls_config.alpn_protocols = self::alpn_protocols(); | ||
| let rustls_config = Arc::new(rustls_config); | ||
|
|
||
| // Return our connection acceptor and our background worker task. | ||
| let acceptor = state.axum_acceptor(rustls_config.clone()); | ||
| let worker = self::acme_worker(state); | ||
| (acceptor, worker) | ||
| } | ||
|
|
||
| impl AsyncRead for Wrapper { | ||
| fn poll_read( | ||
| self: Pin<&mut Self>, | ||
| cx: &mut Context<'_>, | ||
| buf: &mut ReadBuf<'_>, | ||
| ) -> Poll<std::io::Result<()>> { | ||
| self.project().inner.poll_read(cx, buf) | ||
| /// This function defines the task responsible for handling ACME events. | ||
| /// | ||
| /// This function will never return, unless an error is encountered. | ||
| #[tracing::instrument(level = "error", skip_all)] | ||
| async fn acme_worker<EC, EA>(mut state: AcmeState<EC, EA>) -> Result<(), anyhow::Error> | ||
| where | ||
| EC: Debug + 'static, | ||
| EA: Debug + 'static, | ||
| { | ||
| use futures::StreamExt; | ||
| loop { | ||
| match state.next().await { | ||
| Some(Ok(ok)) => tracing::debug!("received acme event: {:?}", ok), | ||
| Some(Err(err)) => tracing::error!("acme error: {:?}", err), | ||
| None => { | ||
| debug_assert!(false, "acme worker unexpectedly reached end-of-stream"); | ||
| tracing::error!("acme worker unexpectedly reached end-of-stream"); | ||
| anyhow::bail!("unexpected end-of-stream"); | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| impl AsyncWrite for Wrapper { | ||
| fn poll_write( | ||
| self: Pin<&mut Self>, | ||
| cx: &mut Context<'_>, | ||
| buf: &[u8], | ||
| ) -> Poll<std::io::Result<usize>> { | ||
| self.project().inner.poll_write(cx, buf) | ||
| } | ||
| fn poll_flush(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<std::io::Result<()>> { | ||
| self.project().inner.poll_flush(cx) | ||
| } | ||
| fn poll_shutdown(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<std::io::Result<()>> { | ||
| self.project().inner.poll_shutdown(cx) | ||
| } | ||
| /// Returns a vector of the protocols supported by this server. | ||
| /// | ||
| /// This is a convenience method to retrieve an owned copy of [`ALPN_PROTOCOLS`]. | ||
| fn alpn_protocols() -> Vec<Vec<u8>> { | ||
| ALPN_PROTOCOLS.into_iter().map(<[u8]>::to_vec).collect() | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters