3bcfb3c576
- Add BUILD.bazel across tidal, tidal-net, tidal-server, tidalctl for bzlmod build - Add tidal/ crate docs (README, CHANGELOG, CONTRIBUTING, AGENTS, CLAUDE, API, ARCHITECTURE) and ai-lookup reference - Add docker standalone/cluster/deploy images, compose, and prometheus config - Harden WAL (batch format, writer, dedup, diagnostics), text syncer/collectors, and vector registry - Expand tidalctl CLI and tests; restructure WAL/visibility integration test suites - Refine tidal-net transport/client/server and tidal-server cluster/scatter-gather
52 lines
2.0 KiB
Rust
52 lines
2.0 KiB
Rust
//! TLS configuration helpers for tonic server and client.
|
|
|
|
use std::fs;
|
|
|
|
use tonic::transport::{Certificate, ClientTlsConfig, Identity, ServerTlsConfig};
|
|
|
|
use crate::{config::TlsConfig, error::GrpcTransportError};
|
|
|
|
/// Build a tonic `ServerTlsConfig` from our TLS config.
|
|
///
|
|
/// # Errors
|
|
///
|
|
/// Returns [`GrpcTransportError`] if the server cert, server key, or CA cert
|
|
/// file cannot be read.
|
|
pub fn server_tls_config(tls: &TlsConfig) -> Result<ServerTlsConfig, GrpcTransportError> {
|
|
let server_cert = fs::read(&tls.server_cert)
|
|
.map_err(|e| GrpcTransportError::TlsConfig(format!("read server cert: {e}")))?;
|
|
let server_key = fs::read(&tls.server_key)
|
|
.map_err(|e| GrpcTransportError::TlsConfig(format!("read server key: {e}")))?;
|
|
let ca_cert = fs::read(&tls.ca_cert)
|
|
.map_err(|e| GrpcTransportError::TlsConfig(format!("read CA cert: {e}")))?;
|
|
|
|
let identity = Identity::from_pem(server_cert, server_key);
|
|
let ca = Certificate::from_pem(ca_cert);
|
|
|
|
Ok(ServerTlsConfig::new().identity(identity).client_ca_root(ca))
|
|
}
|
|
|
|
/// Build a tonic `ClientTlsConfig` from our TLS config.
|
|
///
|
|
/// # Errors
|
|
///
|
|
/// Returns [`GrpcTransportError`] if the CA cert (or, when mutual TLS is
|
|
/// configured, the client cert/key) file cannot be read.
|
|
pub fn client_tls_config(tls: &TlsConfig) -> Result<ClientTlsConfig, GrpcTransportError> {
|
|
let ca_cert = fs::read(&tls.ca_cert)
|
|
.map_err(|e| GrpcTransportError::TlsConfig(format!("read CA cert: {e}")))?;
|
|
let ca = Certificate::from_pem(ca_cert);
|
|
|
|
let mut config = ClientTlsConfig::new().ca_certificate(ca);
|
|
|
|
if let (Some(cert_path), Some(key_path)) = (&tls.client_cert, &tls.client_key) {
|
|
let cert = fs::read(cert_path)
|
|
.map_err(|e| GrpcTransportError::TlsConfig(format!("read client cert: {e}")))?;
|
|
let key = fs::read(key_path)
|
|
.map_err(|e| GrpcTransportError::TlsConfig(format!("read client key: {e}")))?;
|
|
config = config.identity(Identity::from_pem(cert, key));
|
|
}
|
|
|
|
Ok(config)
|
|
}
|