-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feats: sticky folder up tile in explorer, tls with generated self sig…
…ned certificates
- Loading branch information
Nicolas Pernoud
committed
Nov 25, 2024
1 parent
826ce95
commit 37152f2
Showing
8 changed files
with
402 additions
and
308 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,7 +3,7 @@ hostname: atrium.127.0.0.1.nip.io # required : fully qualified domain name of th | |
| debug_mode: true # optional, defaults to false : prints a lot of debug logs ; disable in production as it has a big performance impact | ||
| single_proxy: false # optional, default to false : in single proxy mode, atrium will route only to the first app available, it is meant to secure a single proxied application with Open ID Connect | ||
| http_port: 8080 # required, defaults to 8080 : http port to listen to if tls mode is not Auto | ||
| tls_mode: No # required, defaults to No : use No for development/test http mode, Auto to generate Let's Encrypt certificates automatically (most common production usage) or ̀BehindProxy to use atrium behind a TLS offloading proxy | ||
| tls_mode: No # required, defaults to No : use No for development/test http mode, Auto to generate Let's Encrypt certificates automatically (most common production usage) or ̀BehindProxy to use atrium behind a TLS offloading proxy or SelfSigned to generate self signed certificates (using http_port for https) | ||
| letsencrypt_email: [email protected] # required if `tls_mode: Auto` is used : email for receiving Let's Encrypt information | ||
| #cookie_key : # required, will be generated on first start : cookies and token signing key !!! SENSITIVE INFORMATION : TO BE KEPT HIDDEN !!! | ||
| log_to_file: false # optional, defaults to false : log to a file in addition to std out | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| use crate::CONFIG_FILE; | ||
| use anyhow::Result; | ||
| use axum::{extract::connect_info::IntoMakeServiceWithConnectInfo, routing::MethodRouter}; | ||
| use axum_server::{tls_rustls::RustlsConfig, Handle}; | ||
| use std::{net::SocketAddr, path::Path}; | ||
| use tokio::fs; | ||
| use tracing::info; | ||
|
|
||
| const CERT_PATH: &str = "cert.pem"; | ||
| const KEY_PATH: &str = "key.pem"; | ||
|
|
||
| pub async fn serve_with_self_signed_cert( | ||
| ip: &str, | ||
| port: &u16, | ||
| handle: Handle, | ||
| app: IntoMakeServiceWithConnectInfo<MethodRouter, SocketAddr>, | ||
| ) -> anyhow::Result<()> { | ||
| // Certificates | ||
| let (cert, key) = load_or_generate_cert().await?; | ||
| let rustls_config = RustlsConfig::from_pem(cert, key).await?; | ||
|
|
||
| // Main server | ||
| let addr = format!("{ip}:{}", port).parse::<std::net::SocketAddr>()?; | ||
|
|
||
| // Start the server with TLS | ||
| Ok(axum_server::bind_rustls(addr, rustls_config) | ||
| .handle(handle) | ||
| .serve(app) | ||
| .await?) | ||
| } | ||
|
|
||
| /// Load or generate a self-signed certificate and private key | ||
| async fn load_or_generate_cert() -> Result<(Vec<u8>, Vec<u8>)> { | ||
| if Path::new(CERT_PATH).exists() && Path::new(KEY_PATH).exists() { | ||
| info!("Loading existing certificate and key from disk..."); | ||
| let cert = fs::read(CERT_PATH).await?; | ||
| let key = fs::read(KEY_PATH).await?; | ||
| Ok((cert, key)) | ||
| } else { | ||
| info!("Generating new self-signed certificate and key..."); | ||
| let (cert, key) = generate_self_signed_cert().await?; | ||
| persist_cert_and_key(&cert, &key).await?; | ||
| Ok((cert, key)) | ||
| } | ||
| } | ||
|
|
||
| /// Generate a self-signed certificate and private key | ||
| async fn generate_self_signed_cert() -> Result<(Vec<u8>, Vec<u8>)> { | ||
| let config = atrium::configuration::load_config(CONFIG_FILE).await?; | ||
| let domains: Vec<String> = config.0.domains(); | ||
| // Generate a self-signed certificate using rcgen | ||
| let cert = rcgen::generate_simple_self_signed(domains)?; | ||
| Ok(( | ||
| cert.cert.pem().into_bytes(), | ||
| cert.key_pair.serialize_pem().into_bytes(), | ||
| )) | ||
| } | ||
|
|
||
| /// Persist the certificate and key to files | ||
| async fn persist_cert_and_key(cert: &[u8], key: &[u8]) -> Result<()> { | ||
| info!("Persisting certificate and key to disk..."); | ||
| fs::write(CERT_PATH, cert).await?; | ||
| fs::write(KEY_PATH, key).await?; | ||
| Ok(()) | ||
| } |
Oops, something went wrong.