diff --git a/.drone.star b/.drone.star index 68f39c0c58..3d74bf5759 100644 --- a/.drone.star +++ b/.drone.star @@ -1892,11 +1892,6 @@ def ocisServer(storage, accounts_hash_difficulty = 4, volumes = [], depends_on = "IDM_CREATE_DEMO_USERS": True, "IDM_ADMIN_PASSWORD": "admin", # override the random admin password from `ocis init` "FRONTEND_SEARCH_MIN_LENGTH": "2", - "AUDIT_EVENTS_TLS_INSECURE": True, - "GRAPH_EVENTS_TLS_INSECURE": True, - "NOTIFICATIONS_EVENTS_TLS_INSECURE": True, - "SEARCH_EVENTS_TLS_INSECURE": True, - "NATS_TLS_SKIP_VERIFY_CLIENT_CERT": True, } wait_for_ocis = { "name": "wait-for-ocis-server", diff --git a/changelog/unreleased/nats-tls.md b/changelog/unreleased/nats-tls.md index 316c35b814..3c88254e2b 100644 --- a/changelog/unreleased/nats-tls.md +++ b/changelog/unreleased/nats-tls.md @@ -1,6 +1,16 @@ -Enhancement: Secure the nats connectin with TLS +Enhancement: Secure the nats connection with TLS Encyrpted the connection to the event broker using TLS. +Per default TLS is not enabled but can be enabled by setting either `OCIS_EVENTS_ENABLE_TLS=true` or the respective service configs: + +- `AUDIT_EVENTS_ENABLE_TLS=true` +- `GRAPH_EVENTS_ENABLE_TLS=true` +- `NATS_EVENTS_ENABLE_TLS=true` +- `NOTIFICATIONS_EVENTS_ENABLE_TLS=true` +- `SEARCH_EVENTS_ENABLE_TLS=true` +- `SHARING_EVENTS_ENABLE_TLS=true` +- `STORAGE_USERS_EVENTS_ENABLE_TLS=true` https://github.com/owncloud/ocis/pull/4781 https://github.com/owncloud/ocis/pull/4800 +https://github.com/owncloud/ocis/pull/4867 diff --git a/changelog/unreleased/update-reva-rc1.md b/changelog/unreleased/update-reva-rc1.md index 9c836745b4..2d4069ec01 100644 --- a/changelog/unreleased/update-reva-rc1.md +++ b/changelog/unreleased/update-reva-rc1.md @@ -7,3 +7,4 @@ https://github.com/owncloud/ocis/pull/4716 https://github.com/owncloud/ocis/pull/4719 https://github.com/owncloud/ocis/pull/4750 https://github.com/owncloud/ocis/pull/4833 +https://github.com/owncloud/ocis/pull/4867 diff --git a/go.mod b/go.mod index 00976d1485..3eca765bc4 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/blevesearch/bleve/v2 v2.3.4 github.com/coreos/go-oidc/v3 v3.4.0 github.com/cs3org/go-cs3apis v0.0.0-20221012090518-ef2996678965 - github.com/cs3org/reva/v2 v2.10.1-0.20221020120219-2482ef11bdef + github.com/cs3org/reva/v2 v2.10.1-0.20221021085610-dafcf7b27a1e github.com/disintegration/imaging v1.6.2 github.com/ggwhite/go-masker v1.0.9 github.com/go-chi/chi/v5 v5.0.7 diff --git a/go.sum b/go.sum index 108e783d0c..2d8130f325 100644 --- a/go.sum +++ b/go.sum @@ -351,8 +351,8 @@ github.com/crewjam/saml v0.4.6 h1:XCUFPkQSJLvzyl4cW9OvpWUbRf0gE7VUpU8ZnilbeM4= github.com/crewjam/saml v0.4.6/go.mod h1:ZBOXnNPFzB3CgOkRm7Nd6IVdkG+l/wF+0ZXLqD96t1A= github.com/cs3org/go-cs3apis v0.0.0-20221012090518-ef2996678965 h1:y4n2j68LLnvac+zw/al8MfPgO5aQiIwLmHM/JzYN8AM= github.com/cs3org/go-cs3apis v0.0.0-20221012090518-ef2996678965/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY= -github.com/cs3org/reva/v2 v2.10.1-0.20221020120219-2482ef11bdef h1:3w1/KfXfouh1gZXfwYAtYyAAfcCrlooWw60OcXsiyoU= -github.com/cs3org/reva/v2 v2.10.1-0.20221020120219-2482ef11bdef/go.mod h1:lq+LRpBDYU1vHUmJDeK7sGquREciO8GDj5/SYIibMPY= +github.com/cs3org/reva/v2 v2.10.1-0.20221021085610-dafcf7b27a1e h1:TmLgTIwQnU1kqF1nohiciwkCnG8aVxKvefkUv4LZKQ4= +github.com/cs3org/reva/v2 v2.10.1-0.20221021085610-dafcf7b27a1e/go.mod h1:lq+LRpBDYU1vHUmJDeK7sGquREciO8GDj5/SYIibMPY= github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8 h1:Z9lwXumT5ACSmJ7WGnFl+OMLLjpz5uR2fyz7dC255FI= github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8/go.mod h1:4abs/jPXcmJzYoYGF91JF9Uq9s/KL5n1jvFDix8KcqY= github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4= diff --git a/services/audit/pkg/command/server.go b/services/audit/pkg/command/server.go index 11c312dc06..8bbabfe1a3 100644 --- a/services/audit/pkg/command/server.go +++ b/services/audit/pkg/command/server.go @@ -41,23 +41,26 @@ func Server(cfg *config.Config) *cli.Command { evtsCfg := cfg.Events - var rootCAPool *x509.CertPool - if evtsCfg.TLSRootCACertificate != "" { - rootCrtFile, err := os.Open(evtsCfg.TLSRootCACertificate) - if err != nil { - return err + var tlsConf *tls.Config + if evtsCfg.EnableTLS { + var rootCAPool *x509.CertPool + if evtsCfg.TLSRootCACertificate != "" { + rootCrtFile, err := os.Open(evtsCfg.TLSRootCACertificate) + if err != nil { + return err + } + + rootCAPool, err = ociscrypto.NewCertPoolFromPEM(rootCrtFile) + if err != nil { + return err + } + evtsCfg.TLSInsecure = false } - rootCAPool, err = ociscrypto.NewCertPoolFromPEM(rootCrtFile) - if err != nil { - return err + tlsConf = &tls.Config{ + InsecureSkipVerify: evtsCfg.TLSInsecure, //nolint:gosec + RootCAs: rootCAPool, } - evtsCfg.TLSInsecure = false - } - - tlsConf := &tls.Config{ - InsecureSkipVerify: evtsCfg.TLSInsecure, //nolint:gosec - RootCAs: rootCAPool, } client, err := server.NewNatsStream( natsjs.TLSConfig(tlsConf), diff --git a/services/audit/pkg/config/config.go b/services/audit/pkg/config/config.go index ef6ba9f492..d4ea95a1d5 100644 --- a/services/audit/pkg/config/config.go +++ b/services/audit/pkg/config/config.go @@ -28,6 +28,7 @@ type Events struct { ConsumerGroup string `yaml:"group" env:"AUDIT_EVENTS_GROUP" desc:"The consumergroup of the service. One group will only get one copy of an event."` TLSInsecure bool `yaml:"tls_insecure" env:"OCIS_INSECURE;AUDIT_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."` TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"AUDIT_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided AUDIT_EVENTS_TLS_INSECURE will be seen as false."` + EnableTLS bool `yaml:"enable_tls" env:"OCIS_EVENTS_ENABLE_TLS;AUDIT_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker. The events broker is the ocis service which receives and delivers events between the services.."` } // Auditlog holds audit log information diff --git a/services/audit/pkg/config/defaults/defaultconfig.go b/services/audit/pkg/config/defaults/defaultconfig.go index 5a4286cbc5..51d0140dd0 100644 --- a/services/audit/pkg/config/defaults/defaultconfig.go +++ b/services/audit/pkg/config/defaults/defaultconfig.go @@ -25,6 +25,7 @@ func DefaultConfig() *config.Config { Endpoint: "127.0.0.1:9233", Cluster: "ocis-cluster", ConsumerGroup: "audit", + EnableTLS: false, }, Auditlog: config.Auditlog{ LogToConsole: true, diff --git a/services/graph/pkg/config/config.go b/services/graph/pkg/config/config.go index 6d6e565810..7caa0b643c 100644 --- a/services/graph/pkg/config/config.go +++ b/services/graph/pkg/config/config.go @@ -74,4 +74,5 @@ type Events struct { Cluster string `yaml:"cluster" env:"GRAPH_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."` TLSInsecure bool `yaml:"tls_insecure" env:"OCIS_INSECURE;GRAPH_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."` TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"GRAPH_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided GRAPH_EVENTS_TLS_INSECURE will be seen as false."` + EnableTLS bool `yaml:"enable_tls" env:"OCIS_EVENTS_ENABLE_TLS;GRAPH_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker. The events broker is the ocis service which receives and delivers events between the services.."` } diff --git a/services/graph/pkg/config/defaults/defaultconfig.go b/services/graph/pkg/config/defaults/defaultconfig.go index a4648a5578..34d05c2b09 100644 --- a/services/graph/pkg/config/defaults/defaultconfig.go +++ b/services/graph/pkg/config/defaults/defaultconfig.go @@ -66,8 +66,9 @@ func DefaultConfig() *config.Config { }, }, Events: config.Events{ - Endpoint: "127.0.0.1:9233", - Cluster: "ocis-cluster", + Endpoint: "127.0.0.1:9233", + Cluster: "ocis-cluster", + EnableTLS: false, }, } } diff --git a/services/graph/pkg/server/http/server.go b/services/graph/pkg/server/http/server.go index d7ba70be8a..489e6ed866 100644 --- a/services/graph/pkg/server/http/server.go +++ b/services/graph/pkg/server/http/server.go @@ -38,23 +38,27 @@ func Server(opts ...Option) (http.Service, error) { if options.Config.Events.Endpoint != "" { var err error - var rootCAPool *x509.CertPool - if options.Config.Events.TLSRootCACertificate != "" { - rootCrtFile, err := os.Open(options.Config.Events.TLSRootCACertificate) - if err != nil { - return http.Service{}, err + + var tlsConf *tls.Config + if options.Config.Events.EnableTLS { + var rootCAPool *x509.CertPool + if options.Config.Events.TLSRootCACertificate != "" { + rootCrtFile, err := os.Open(options.Config.Events.TLSRootCACertificate) + if err != nil { + return http.Service{}, err + } + + rootCAPool, err = ociscrypto.NewCertPoolFromPEM(rootCrtFile) + if err != nil { + return http.Service{}, err + } + options.Config.Events.TLSInsecure = false } - rootCAPool, err = ociscrypto.NewCertPoolFromPEM(rootCrtFile) - if err != nil { - return http.Service{}, err + tlsConf = &tls.Config{ + InsecureSkipVerify: options.Config.Events.TLSInsecure, //nolint:gosec + RootCAs: rootCAPool, } - options.Config.Events.TLSInsecure = false - } - - tlsConf := &tls.Config{ - InsecureSkipVerify: options.Config.Events.TLSInsecure, //nolint:gosec - RootCAs: rootCAPool, } publisher, err = server.NewNatsStream( natsjs.TLSConfig(tlsConf), diff --git a/services/nats/pkg/command/server.go b/services/nats/pkg/command/server.go index fae3e0cd6f..c8de4e2eee 100644 --- a/services/nats/pkg/command/server.go +++ b/services/nats/pkg/command/server.go @@ -38,25 +38,28 @@ func Server(cfg *config.Config) *cli.Command { defer cancel() - // Generate a self-signing cert if no certificate is present - if err := pkgcrypto.GenCert(cfg.Nats.TLSCert, cfg.Nats.TLSKey, logger); err != nil { - logger.Fatal().Err(err).Msgf("Could not generate test-certificate") - } + var tlsConf *tls.Config + if cfg.Nats.EnableTLS { + // Generate a self-signing cert if no certificate is present + if err := pkgcrypto.GenCert(cfg.Nats.TLSCert, cfg.Nats.TLSKey, logger); err != nil { + logger.Fatal().Err(err).Msgf("Could not generate test-certificate") + } - crt, err := tls.LoadX509KeyPair(cfg.Nats.TLSCert, cfg.Nats.TLSKey) - if err != nil { - return err - } + crt, err := tls.LoadX509KeyPair(cfg.Nats.TLSCert, cfg.Nats.TLSKey) + if err != nil { + return err + } - clientAuth := tls.RequireAndVerifyClientCert - if cfg.Nats.TLSSkipVerifyClientCert { - clientAuth = tls.NoClientCert - } + clientAuth := tls.RequireAndVerifyClientCert + if cfg.Nats.TLSSkipVerifyClientCert { + clientAuth = tls.NoClientCert + } - tlsConf := &tls.Config{ - MinVersion: tls.VersionTLS12, - ClientAuth: clientAuth, - Certificates: []tls.Certificate{crt}, + tlsConf = &tls.Config{ + MinVersion: tls.VersionTLS12, + ClientAuth: clientAuth, + Certificates: []tls.Certificate{crt}, + } } natsServer, err := nats.NewNATSServer( ctx, @@ -66,6 +69,7 @@ func Server(cfg *config.Config) *cli.Command { nats.ClusterID(cfg.Nats.ClusterID), nats.StoreDir(cfg.Nats.StoreDir), nats.TLSConfig(tlsConf), + nats.AllowNonTLS(!cfg.Nats.EnableTLS), ) if err != nil { return err diff --git a/services/nats/pkg/config/config.go b/services/nats/pkg/config/config.go index 903a4de9be..4c24e876f3 100644 --- a/services/nats/pkg/config/config.go +++ b/services/nats/pkg/config/config.go @@ -29,4 +29,5 @@ type Nats struct { TLSCert string `yaml:"tls_cert" env:"NATS_TLS_CERT" desc:"File name of the TLS server certificate for the nats listener."` TLSKey string `yaml:"tls_key" env:"NATS_TLS_KEY" desc:"File name for the TLS certificate key for the server certificate."` TLSSkipVerifyClientCert bool `yaml:"tls_skip_verify_client_cert" env:"OCIS_INSECURE;NATS_TLS_SKIP_VERIFY_CLIENT_CERT" desc:"Whether the NATS server should skip the client certificate verification during the TLS handshake."` + EnableTLS bool `yaml:"enable_tls" env:"OCIS_EVENTS_ENABLE_TLS;NATS_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker. The events broker is the ocis service which receives and delivers events between the services.."` } diff --git a/services/nats/pkg/config/defaults/defaultconfig.go b/services/nats/pkg/config/defaults/defaultconfig.go index fb5f91a8ee..30ef1ace24 100644 --- a/services/nats/pkg/config/defaults/defaultconfig.go +++ b/services/nats/pkg/config/defaults/defaultconfig.go @@ -32,6 +32,7 @@ func DefaultConfig() *config.Config { StoreDir: filepath.Join(defaults.BaseDataPath(), "nats"), TLSCert: filepath.Join(defaults.BaseDataPath(), "nats/tls.crt"), TLSKey: filepath.Join(defaults.BaseDataPath(), "nats/tls.key"), + EnableTLS: false, }, } } diff --git a/services/nats/pkg/server/nats/nats.go b/services/nats/pkg/server/nats/nats.go index 8536804cc7..e346596fd7 100644 --- a/services/nats/pkg/server/nats/nats.go +++ b/services/nats/pkg/server/nats/nats.go @@ -23,7 +23,6 @@ func NewNATSServer(ctx context.Context, logger nserver.Logger, opts ...NatsOptio // enable JetStream natsOpts.JetStream = true - natsOpts.AllowNonTLS = false server, err := nserver.NewServer(natsOpts) if err != nil { diff --git a/services/nats/pkg/server/nats/options.go b/services/nats/pkg/server/nats/options.go index d2c66869e7..fa596e235e 100644 --- a/services/nats/pkg/server/nats/options.go +++ b/services/nats/pkg/server/nats/options.go @@ -43,3 +43,10 @@ func TLSConfig(c *tls.Config) NatsOption { o.TLSConfig = c } } + +// AllowNonTLS sets the allow non tls options for the nats server +func AllowNonTLS(v bool) NatsOption { + return func(o *nserver.Options) { + o.AllowNonTLS = v + } +} diff --git a/services/notifications/pkg/command/server.go b/services/notifications/pkg/command/server.go index 6bc5034db8..c27787ac33 100644 --- a/services/notifications/pkg/command/server.go +++ b/services/notifications/pkg/command/server.go @@ -39,23 +39,27 @@ func Server(cfg *config.Config) *cli.Command { } evtsCfg := cfg.Notifications.Events - var rootCAPool *x509.CertPool - if evtsCfg.TLSRootCACertificate != "" { - rootCrtFile, err := os.Open(evtsCfg.TLSRootCACertificate) - if err != nil { - return err + + var tlsConf *tls.Config + if evtsCfg.EnableTLS { + var rootCAPool *x509.CertPool + if evtsCfg.TLSRootCACertificate != "" { + rootCrtFile, err := os.Open(evtsCfg.TLSRootCACertificate) + if err != nil { + return err + } + + rootCAPool, err = crypto.NewCertPoolFromPEM(rootCrtFile) + if err != nil { + return err + } + evtsCfg.TLSInsecure = false } - rootCAPool, err = crypto.NewCertPoolFromPEM(rootCrtFile) - if err != nil { - return err + tlsConf = &tls.Config{ + InsecureSkipVerify: evtsCfg.TLSInsecure, //nolint:gosec + RootCAs: rootCAPool, } - evtsCfg.TLSInsecure = false - } - - tlsConf := &tls.Config{ - InsecureSkipVerify: evtsCfg.TLSInsecure, //nolint:gosec - RootCAs: rootCAPool, } client, err := server.NewNatsStream( natsjs.TLSConfig(tlsConf), diff --git a/services/notifications/pkg/config/config.go b/services/notifications/pkg/config/config.go index c2c20f025d..fae9ec89e8 100644 --- a/services/notifications/pkg/config/config.go +++ b/services/notifications/pkg/config/config.go @@ -48,4 +48,5 @@ type Events struct { ConsumerGroup string `yaml:"group" env:"NOTIFICATIONS_EVENTS_GROUP" desc:"Name of the event group / queue on the event system."` TLSInsecure bool `yaml:"tls_insecure" env:"OCIS_INSECURE;NOTIFICATIONS_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."` TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"NOTIFICATIONS_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided NOTIFICATIONS_EVENTS_TLS_INSECURE will be seen as false."` + EnableTLS bool `yaml:"enable_tls" env:"OCIS_EVENTS_ENABLE_TLS;NOTIFICATIONS_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker. The events broker is the ocis service which receives and delivers events between the services.."` } diff --git a/services/notifications/pkg/config/defaults/defaultconfig.go b/services/notifications/pkg/config/defaults/defaultconfig.go index 849592926c..53f8faa1d6 100644 --- a/services/notifications/pkg/config/defaults/defaultconfig.go +++ b/services/notifications/pkg/config/defaults/defaultconfig.go @@ -34,6 +34,7 @@ func DefaultConfig() *config.Config { Endpoint: "127.0.0.1:9233", Cluster: "ocis-cluster", ConsumerGroup: "notifications", + EnableTLS: false, }, RevaGateway: "127.0.0.1:9142", }, diff --git a/services/search/pkg/config/config.go b/services/search/pkg/config/config.go index 6a1f56e839..5e4eed9344 100644 --- a/services/search/pkg/config/config.go +++ b/services/search/pkg/config/config.go @@ -34,4 +34,5 @@ type Events struct { ConsumerGroup string `yaml:"group" env:"SEARCH_EVENTS_GROUP" desc:"The customer group of the service. One group will only get one copy of an event"` TLSInsecure bool `yaml:"tls_insecure" env:"OCIS_INSECURE;SEARCH_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."` TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"SEARCH_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided SEARCH_EVENTS_TLS_INSECURE will be seen as false."` + EnableTLS bool `yaml:"enable_tls" env:"OCIS_EVENTS_ENABLE_TLS;SEARCH_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker. The events broker is the ocis service which receives and delivers events between the services.."` } diff --git a/services/search/pkg/config/defaults/defaultconfig.go b/services/search/pkg/config/defaults/defaultconfig.go index 58eef06619..e3b2a5535a 100644 --- a/services/search/pkg/config/defaults/defaultconfig.go +++ b/services/search/pkg/config/defaults/defaultconfig.go @@ -36,6 +36,7 @@ func DefaultConfig() *config.Config { Endpoint: "127.0.0.1:9233", Cluster: "ocis-cluster", ConsumerGroup: "search", + EnableTLS: false, }, MachineAuthAPIKey: "", } diff --git a/services/search/pkg/service/v0/service.go b/services/search/pkg/service/v0/service.go index ec7ef06c26..cd6a3baaee 100644 --- a/services/search/pkg/service/v0/service.go +++ b/services/search/pkg/service/v0/service.go @@ -37,23 +37,26 @@ func NewHandler(opts ...Option) (searchsvc.SearchProviderHandler, error) { // Connect to nats to listen for changes that need to trigger an index update evtsCfg := cfg.Events - var rootCAPool *x509.CertPool - if evtsCfg.TLSRootCACertificate != "" { - rootCrtFile, err := os.Open(evtsCfg.TLSRootCACertificate) - if err != nil { - return nil, err + var tlsConf *tls.Config + if evtsCfg.EnableTLS { + var rootCAPool *x509.CertPool + if evtsCfg.TLSRootCACertificate != "" { + rootCrtFile, err := os.Open(evtsCfg.TLSRootCACertificate) + if err != nil { + return nil, err + } + + rootCAPool, err = ociscrypto.NewCertPoolFromPEM(rootCrtFile) + if err != nil { + return nil, err + } + evtsCfg.TLSInsecure = false } - rootCAPool, err = ociscrypto.NewCertPoolFromPEM(rootCrtFile) - if err != nil { - return nil, err + tlsConf = &tls.Config{ + InsecureSkipVerify: evtsCfg.TLSInsecure, //nolint:gosec + RootCAs: rootCAPool, } - evtsCfg.TLSInsecure = false - } - - tlsConf := &tls.Config{ - InsecureSkipVerify: evtsCfg.TLSInsecure, //nolint:gosec - RootCAs: rootCAPool, } client, err := server.NewNatsStream( natsjs.TLSConfig(tlsConf), diff --git a/services/sharing/pkg/config/config.go b/services/sharing/pkg/config/config.go index 74a9804316..b9b2714f5c 100644 --- a/services/sharing/pkg/config/config.go +++ b/services/sharing/pkg/config/config.go @@ -154,4 +154,5 @@ type Events struct { ClusterID string `yaml:"cluster" env:"SHARING_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."` TLSInsecure bool `yaml:"tls_insecure" env:"OCIS_INSECURE;SHARING_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."` TLSRootCaCertPath string `yaml:"tls_root_ca_cert_path" env:"SHARING_EVENTS_TLS_ROOT_CA_CERT" desc:"The root CA certificate used to validate the server's TLS certificate. If provided SHARING_EVENTS_TLS_INSECURE will be seen as false."` + EnableTLS bool `yaml:"enable_tls" env:"OCIS_EVENTS_ENABLE_TLS;SHARING_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker. The events broker is the ocis service which receives and delivers events between the services.."` } diff --git a/services/sharing/pkg/config/defaults/defaultconfig.go b/services/sharing/pkg/config/defaults/defaultconfig.go index 0b136a97a7..d404b874d1 100644 --- a/services/sharing/pkg/config/defaults/defaultconfig.go +++ b/services/sharing/pkg/config/defaults/defaultconfig.go @@ -69,9 +69,9 @@ func DefaultConfig() *config.Config { // TODO implement and add owncloudsql publicshare driver }, Events: config.Events{ - Addr: "127.0.0.1:9233", - ClusterID: "ocis-cluster", - TLSInsecure: true, + Addr: "127.0.0.1:9233", + ClusterID: "ocis-cluster", + EnableTLS: false, }, } } diff --git a/services/sharing/pkg/revaconfig/config.go b/services/sharing/pkg/revaconfig/config.go index 49761b8ae0..a054d85ad3 100644 --- a/services/sharing/pkg/revaconfig/config.go +++ b/services/sharing/pkg/revaconfig/config.go @@ -108,6 +108,7 @@ func SharingConfigFromStruct(cfg *config.Config) map[string]interface{} { "clusterID": cfg.Events.ClusterID, "tls-insecure": cfg.Events.TLSInsecure, "tls-root-ca-cert": cfg.Events.TLSRootCaCertPath, + "enable-tls": cfg.Events.EnableTLS, }, "prometheus": map[string]interface{}{ "namespace": "ocis", diff --git a/services/storage-users/pkg/config/config.go b/services/storage-users/pkg/config/config.go index 4fb933caee..3081c42e02 100644 --- a/services/storage-users/pkg/config/config.go +++ b/services/storage-users/pkg/config/config.go @@ -137,6 +137,7 @@ type Events struct { ClusterID string `yaml:"cluster" env:"STORAGE_USERS_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."` TLSInsecure bool `yaml:"tls_insecure" env:"OCIS_INSECURE;STORAGE_USERS_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."` TLSRootCaCertPath string `yaml:"tls_root_ca_cert_path" env:"STORAGE_USERS_EVENTS_TLS_ROOT_CA_CERT" desc:"The root CA certificate used to validate the server's TLS certificate. If provided STORAGE_USERS_EVENTS_TLS_INSECURE will be seen as false."` + EnableTLS bool `yaml:"enable_tls" env:"OCIS_EVENTS_ENABLE_TLS;STORAGE_USERS_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker. The events broker is the ocis service which receives and delivers events between the services.."` } // Cache holds cache config diff --git a/services/storage-users/pkg/config/defaults/defaultconfig.go b/services/storage-users/pkg/config/defaults/defaultconfig.go index 0fdad518c1..e1f98cb000 100644 --- a/services/storage-users/pkg/config/defaults/defaultconfig.go +++ b/services/storage-users/pkg/config/defaults/defaultconfig.go @@ -75,9 +75,9 @@ func DefaultConfig() *config.Config { }, }, Events: config.Events{ - Addr: "127.0.0.1:9233", - ClusterID: "ocis-cluster", - TLSInsecure: true, + Addr: "127.0.0.1:9233", + ClusterID: "ocis-cluster", + EnableTLS: false, }, Cache: config.Cache{ Store: "memory", diff --git a/services/storage-users/pkg/revaconfig/config.go b/services/storage-users/pkg/revaconfig/config.go index 332f8a5efd..4bc0ce9880 100644 --- a/services/storage-users/pkg/revaconfig/config.go +++ b/services/storage-users/pkg/revaconfig/config.go @@ -40,6 +40,7 @@ func StorageUsersConfigFromStruct(cfg *config.Config) map[string]interface{} { "clusterID": cfg.Events.ClusterID, "tls-insecure": cfg.Events.TLSInsecure, "tls-root-ca-cert": cfg.Events.TLSRootCaCertPath, + "enable-tls": cfg.Events.EnableTLS, }, "prometheus": map[string]interface{}{ "namespace": "ocis", @@ -60,6 +61,7 @@ func StorageUsersConfigFromStruct(cfg *config.Config) map[string]interface{} { "nats_clusterID": cfg.Events.ClusterID, "nats_tls_insecure": cfg.Events.TLSInsecure, "nats_root_ca_cert_path": cfg.Events.TLSRootCaCertPath, + "nats_enable_tls": cfg.Events.EnableTLS, "data_txs": map[string]interface{}{ "simple": map[string]interface{}{ "cache_store": cfg.Cache.Store,