-
-
Notifications
You must be signed in to change notification settings - Fork 607
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Adds a new `remoteva` binary that takes a distinct configuration from
the existing `boulder-va`
* Removed the `boulder-remoteva` name registration from `boulder-va`.
* Existing users of `boulder-remoteva` must either
1. laterally migrate to `boulder-va` which uses that same config, or
2. switch to using `remoteva` with a new config.
Part of #5294- Loading branch information
Showing
20 changed files
with
436 additions
and
70 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,110 @@ | ||
| package notmain | ||
|
|
||
| import ( | ||
| "context" | ||
| "flag" | ||
| "os" | ||
| "time" | ||
|
|
||
| "github.com/letsencrypt/boulder/bdns" | ||
| "github.com/letsencrypt/boulder/cmd" | ||
| "github.com/letsencrypt/boulder/features" | ||
| bgrpc "github.com/letsencrypt/boulder/grpc" | ||
| "github.com/letsencrypt/boulder/va" | ||
| vaConfig "github.com/letsencrypt/boulder/va/config" | ||
| vapb "github.com/letsencrypt/boulder/va/proto" | ||
| ) | ||
|
|
||
| type Config struct { | ||
| RVA struct { | ||
| vaConfig.Common | ||
| Features features.Config | ||
| } | ||
|
|
||
| Syslog cmd.SyslogConfig | ||
| OpenTelemetry cmd.OpenTelemetryConfig | ||
| } | ||
|
|
||
| func main() { | ||
| grpcAddr := flag.String("addr", "", "gRPC listen address override") | ||
| debugAddr := flag.String("debug-addr", "", "Debug server address override") | ||
| configFile := flag.String("config", "", "File path to the configuration file for this service") | ||
| flag.Parse() | ||
| if *configFile == "" { | ||
| flag.Usage() | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| var c Config | ||
| err := cmd.ReadConfigFile(*configFile, &c) | ||
| cmd.FailOnError(err, "Reading JSON config file into config structure") | ||
| err = c.RVA.SetDefaultsAndValidate(grpcAddr, debugAddr) | ||
| cmd.FailOnError(err, "Setting and validating default config values") | ||
| features.Set(c.RVA.Features) | ||
|
|
||
| scope, logger, oTelShutdown := cmd.StatsAndLogging(c.Syslog, c.OpenTelemetry, c.RVA.DebugAddr) | ||
| defer oTelShutdown(context.Background()) | ||
| logger.Info(cmd.VersionString()) | ||
| clk := cmd.Clock() | ||
|
|
||
| var servers bdns.ServerProvider | ||
| proto := "udp" | ||
| if features.Get().DOH { | ||
| proto = "tcp" | ||
| } | ||
|
|
||
| if len(c.RVA.DNSStaticResolvers) != 0 { | ||
| servers, err = bdns.NewStaticProvider(c.RVA.DNSStaticResolvers) | ||
| cmd.FailOnError(err, "Couldn't start static DNS server resolver") | ||
| } else { | ||
| servers, err = bdns.StartDynamicProvider(c.RVA.DNSProvider, 60*time.Second, proto) | ||
| cmd.FailOnError(err, "Couldn't start dynamic DNS server resolver") | ||
| } | ||
| defer servers.Stop() | ||
|
|
||
| tlsConfig, err := c.RVA.TLS.Load(scope) | ||
| cmd.FailOnError(err, "tlsConfig config") | ||
|
|
||
| var resolver bdns.Client | ||
| if !c.RVA.DNSAllowLoopbackAddresses { | ||
| resolver = bdns.New( | ||
| c.RVA.DNSTimeout.Duration, | ||
| servers, | ||
| scope, | ||
| clk, | ||
| c.RVA.DNSTries, | ||
| logger, | ||
| tlsConfig) | ||
| } else { | ||
| resolver = bdns.NewTest( | ||
| c.RVA.DNSTimeout.Duration, | ||
| servers, | ||
| scope, | ||
| clk, | ||
| c.RVA.DNSTries, | ||
| logger, | ||
| tlsConfig) | ||
| } | ||
|
|
||
| vai, err := va.NewValidationAuthorityImpl( | ||
| resolver, | ||
| nil, // Our RVAs will never have RVAs of their own. | ||
| 0, // Only the VA is concerned with max validation failures | ||
| c.RVA.UserAgent, | ||
| c.RVA.IssuerDomain, | ||
| scope, | ||
| clk, | ||
| logger, | ||
| c.RVA.AccountURIPrefixes) | ||
| cmd.FailOnError(err, "Unable to create Remote-VA server") | ||
|
|
||
| start, err := bgrpc.NewServer(c.RVA.GRPC, logger).Add( | ||
| &vapb.VA_ServiceDesc, vai).Add( | ||
| &vapb.CAA_ServiceDesc, vai).Build(tlsConfig, scope, clk) | ||
| cmd.FailOnError(err, "Unable to setup Remote-VA gRPC server") | ||
| cmd.FailOnError(start(), "Remote-VA gRPC service failed") | ||
| } | ||
|
|
||
| func init() { | ||
| cmd.RegisterCommand("remoteva", main, &cmd.ConfigValidator{Config: &Config{}}) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| { | ||
| "rva": { | ||
| "userAgent": "remoteva-a", | ||
| "dnsTries": 3, | ||
| "dnsStaticResolvers": [ | ||
| "10.77.77.77:8343", | ||
| "10.77.77.77:8443" | ||
| ], | ||
| "dnsTimeout": "1s", | ||
| "dnsAllowLoopbackAddresses": true, | ||
| "issuerDomain": "happy-hacker-ca.invalid", | ||
| "tls": { | ||
| "caCertfile": "test/grpc-creds/minica.pem", | ||
| "certFile": "test/grpc-creds/rva.boulder/cert.pem", | ||
| "keyFile": "test/grpc-creds/rva.boulder/key.pem" | ||
| }, | ||
| "grpc": { | ||
| "maxConnectionAge": "30s", | ||
| "services": { | ||
| "va.VA": { | ||
| "clientNames": [ | ||
| "va.boulder" | ||
| ] | ||
| }, | ||
| "grpc.health.v1.Health": { | ||
| "clientNames": [ | ||
| "health-checker.boulder" | ||
| ] | ||
| } | ||
| } | ||
| }, | ||
| "features": { | ||
| "DOH": true | ||
| }, | ||
| "accountURIPrefixes": [ | ||
| "http://boulder.service.consul:4000/acme/reg/", | ||
| "http://boulder.service.consul:4001/acme/acct/" | ||
| ] | ||
| }, | ||
| "syslog": { | ||
| "stdoutlevel": 4, | ||
| "sysloglevel": -1 | ||
| }, | ||
| "openTelemetry": { | ||
| "endpoint": "bjaeger:4317", | ||
| "sampleratio": 1 | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| { | ||
| "rva": { | ||
| "userAgent": "remoteva-b", | ||
| "dnsTries": 3, | ||
| "dnsStaticResolvers": [ | ||
| "10.77.77.77:8343", | ||
| "10.77.77.77:8443" | ||
| ], | ||
| "dnsTimeout": "1s", | ||
| "dnsAllowLoopbackAddresses": true, | ||
| "issuerDomain": "happy-hacker-ca.invalid", | ||
| "tls": { | ||
| "caCertfile": "test/grpc-creds/minica.pem", | ||
| "certFile": "test/grpc-creds/rva.boulder/cert.pem", | ||
| "keyFile": "test/grpc-creds/rva.boulder/key.pem" | ||
| }, | ||
| "grpc": { | ||
| "maxConnectionAge": "30s", | ||
| "services": { | ||
| "va.VA": { | ||
| "clientNames": [ | ||
| "va.boulder" | ||
| ] | ||
| }, | ||
| "grpc.health.v1.Health": { | ||
| "clientNames": [ | ||
| "health-checker.boulder" | ||
| ] | ||
| } | ||
| } | ||
| }, | ||
| "features": { | ||
| "DOH": true | ||
| }, | ||
| "accountURIPrefixes": [ | ||
| "http://boulder.service.consul:4000/acme/reg/", | ||
| "http://boulder.service.consul:4001/acme/acct/" | ||
| ] | ||
| }, | ||
| "syslog": { | ||
| "stdoutlevel": 4, | ||
| "sysloglevel": -1 | ||
| }, | ||
| "openTelemetry": { | ||
| "endpoint": "bjaeger:4317", | ||
| "sampleratio": 1 | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.