Skip to content

Commit bea8e57

Browse files
benileocpu
benileo
authored and
cpu
committed
Split up boulder-config.json (VA) (letsencrypt#1979)
1 parent 21e0b3b commit bea8e57

File tree

7 files changed

+250
-195
lines changed

7 files changed

+250
-195
lines changed

‎cmd/boulder-va/main.go‎

Lines changed: 151 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
package main
22

33
import (
4+
"flag"
5+
"os"
46
"time"
57

68
"github.com/jmhodges/clock"
@@ -10,113 +12,165 @@ import (
1012
"github.com/letsencrypt/boulder/cmd"
1113
caaPB "github.com/letsencrypt/boulder/cmd/caa-checker/proto"
1214
bgrpc "github.com/letsencrypt/boulder/grpc"
13-
blog "github.com/letsencrypt/boulder/log"
1415
"github.com/letsencrypt/boulder/metrics"
1516
"github.com/letsencrypt/boulder/rpc"
1617
"github.com/letsencrypt/boulder/va"
1718
)
1819

1920
const clientName = "VA"
2021

22+
type config struct {
23+
VA struct {
24+
cmd.ServiceConfig
25+
26+
UserAgent string
27+
28+
IssuerDomain string
29+
30+
PortConfig cmd.PortConfig
31+
32+
MaxConcurrentRPCServerRequests int64
33+
34+
LookupIPv6 bool
35+
36+
GoogleSafeBrowsing *cmd.GoogleSafeBrowsingConfig
37+
38+
CAAService *cmd.GRPCClientConfig
39+
40+
CAADistributedResolver *cmd.CAADistributedResolverConfig
41+
42+
// The number of times to try a DNS query (that has a temporary error)
43+
// before giving up. May be short-circuited by deadlines. A zero value
44+
// will be turned into 1.
45+
DNSTries int
46+
47+
// Feature flag to enable enforcement of CAA SERVFAILs.
48+
CAASERVFAILExceptions string
49+
}
50+
51+
Statsd cmd.StatsdConfig
52+
53+
Syslog cmd.SyslogConfig
54+
55+
Common struct {
56+
DNSResolver string
57+
DNSTimeout string
58+
DNSAllowLoopbackAddresses bool
59+
}
60+
}
61+
2162
func main() {
22-
app := cmd.NewAppShell("boulder-va", "Handles challenge validation")
23-
app.Action = func(c cmd.Config, stats metrics.Statter, logger blog.Logger) {
24-
go cmd.DebugServer(c.VA.DebugAddr)
25-
26-
go cmd.ProfileCmd("VA", stats)
27-
28-
pc := &cmd.PortConfig{
29-
HTTPPort: 80,
30-
HTTPSPort: 443,
31-
TLSPort: 443,
32-
}
33-
if c.VA.PortConfig.HTTPPort != 0 {
34-
pc.HTTPPort = c.VA.PortConfig.HTTPPort
35-
}
36-
if c.VA.PortConfig.HTTPSPort != 0 {
37-
pc.HTTPSPort = c.VA.PortConfig.HTTPSPort
38-
}
39-
if c.VA.PortConfig.TLSPort != 0 {
40-
pc.TLSPort = c.VA.PortConfig.TLSPort
41-
}
42-
var caaClient caaPB.CAACheckerClient
43-
if c.VA.CAAService != nil {
44-
conn, err := bgrpc.ClientSetup(c.VA.CAAService)
45-
cmd.FailOnError(err, "Failed to load credentials and create connection to service")
46-
caaClient = caaPB.NewCAACheckerClient(conn)
47-
}
48-
scoped := metrics.NewStatsdScope(stats, "VA", "DNS")
49-
sbc := newGoogleSafeBrowsing(c.VA.GoogleSafeBrowsing)
50-
var cdrClient *cdr.CAADistributedResolver
51-
if c.VA.CAADistributedResolver != nil {
52-
var err error
53-
cdrClient, err = cdr.New(
54-
scoped,
55-
c.VA.CAADistributedResolver.Timeout.Duration,
56-
c.VA.CAADistributedResolver.MaxFailures,
57-
c.VA.CAADistributedResolver.Proxies,
58-
logger,
59-
)
60-
cmd.FailOnError(err, "Failed to create CAADistributedResolver")
61-
}
62-
dnsTimeout, err := time.ParseDuration(c.Common.DNSTimeout)
63-
cmd.FailOnError(err, "Couldn't parse DNS timeout")
64-
dnsTries := c.VA.DNSTries
65-
if dnsTries < 1 {
66-
dnsTries = 1
67-
}
68-
clk := clock.Default()
69-
caaSERVFAILExceptions, err := bdns.ReadHostList(c.VA.CAASERVFAILExceptions)
70-
cmd.FailOnError(err, "Couldn't read CAASERVFAILExceptions file")
71-
var resolver bdns.DNSResolver
72-
if !c.Common.DNSAllowLoopbackAddresses {
73-
r := bdns.NewDNSResolverImpl(
74-
dnsTimeout,
75-
[]string{c.Common.DNSResolver},
76-
caaSERVFAILExceptions,
77-
scoped,
78-
clk,
79-
dnsTries)
80-
r.LookupIPv6 = c.VA.LookupIPv6
81-
resolver = r
82-
} else {
83-
r := bdns.NewTestDNSResolverImpl(dnsTimeout, []string{c.Common.DNSResolver}, scoped, clk, dnsTries)
84-
r.LookupIPv6 = c.VA.LookupIPv6
85-
resolver = r
86-
}
87-
vai := va.NewValidationAuthorityImpl(
88-
pc,
89-
sbc,
90-
caaClient,
91-
cdrClient,
92-
resolver,
93-
c.VA.UserAgent,
94-
c.VA.IssuerDomain,
95-
stats,
96-
clk,
63+
configFile := flag.String("config", "", "File path to the configuration file for this service")
64+
flag.Parse()
65+
if *configFile == "" {
66+
flag.Usage()
67+
os.Exit(1)
68+
}
69+
70+
var c config
71+
err := cmd.ReadJSONFile(*configFile, &c)
72+
cmd.FailOnError(err, "Reading JSON config file into config structure")
73+
74+
go cmd.DebugServer(c.VA.DebugAddr)
75+
76+
stats, logger := cmd.StatsAndLogging(c.Statsd, c.Syslog)
77+
defer logger.AuditPanic()
78+
logger.Info(cmd.VersionString(clientName))
79+
80+
go cmd.ProfileCmd("VA", stats)
81+
82+
pc := &cmd.PortConfig{
83+
HTTPPort: 80,
84+
HTTPSPort: 443,
85+
TLSPort: 443,
86+
}
87+
if c.VA.PortConfig.HTTPPort != 0 {
88+
pc.HTTPPort = c.VA.PortConfig.HTTPPort
89+
}
90+
if c.VA.PortConfig.HTTPSPort != 0 {
91+
pc.HTTPSPort = c.VA.PortConfig.HTTPSPort
92+
}
93+
if c.VA.PortConfig.TLSPort != 0 {
94+
pc.TLSPort = c.VA.PortConfig.TLSPort
95+
}
96+
97+
var caaClient caaPB.CAACheckerClient
98+
if c.VA.CAAService != nil {
99+
conn, err := bgrpc.ClientSetup(c.VA.CAAService)
100+
cmd.FailOnError(err, "Failed to load credentials and create connection to service")
101+
caaClient = caaPB.NewCAACheckerClient(conn)
102+
}
103+
104+
scoped := metrics.NewStatsdScope(stats, "VA", "DNS")
105+
sbc := newGoogleSafeBrowsing(c.VA.GoogleSafeBrowsing)
106+
107+
var cdrClient *cdr.CAADistributedResolver
108+
if c.VA.CAADistributedResolver != nil {
109+
var err error
110+
cdrClient, err = cdr.New(
111+
scoped,
112+
c.VA.CAADistributedResolver.Timeout.Duration,
113+
c.VA.CAADistributedResolver.MaxFailures,
114+
c.VA.CAADistributedResolver.Proxies,
97115
logger)
116+
cmd.FailOnError(err, "Failed to create CAADistributedResolver")
117+
}
98118

99-
amqpConf := c.VA.AMQP
100-
101-
if c.VA.GRPC != nil {
102-
s, l, err := bgrpc.NewServer(c.VA.GRPC, metrics.NewStatsdScope(stats, "VA"))
103-
cmd.FailOnError(err, "Unable to setup VA gRPC server")
104-
err = bgrpc.RegisterValidationAuthorityGRPCServer(s, vai)
105-
cmd.FailOnError(err, "Unable to register VA gRPC server")
106-
go func() {
107-
err = s.Serve(l)
108-
cmd.FailOnError(err, "VA gRPC service failed")
109-
}()
110-
}
111-
112-
vas, err := rpc.NewAmqpRPCServer(amqpConf, c.VA.MaxConcurrentRPCServerRequests, stats, logger)
113-
cmd.FailOnError(err, "Unable to create VA RPC server")
114-
err = rpc.NewValidationAuthorityServer(vas, vai)
115-
cmd.FailOnError(err, "Unable to setup VA RPC server")
116-
117-
err = vas.Start(amqpConf)
118-
cmd.FailOnError(err, "Unable to run VA RPC server")
119+
dnsTimeout, err := time.ParseDuration(c.Common.DNSTimeout)
120+
cmd.FailOnError(err, "Couldn't parse DNS timeout")
121+
dnsTries := c.VA.DNSTries
122+
if dnsTries < 1 {
123+
dnsTries = 1
124+
}
125+
clk := clock.Default()
126+
caaSERVFAILExceptions, err := bdns.ReadHostList(c.VA.CAASERVFAILExceptions)
127+
cmd.FailOnError(err, "Couldn't read CAASERVFAILExceptions file")
128+
var resolver bdns.DNSResolver
129+
if !c.Common.DNSAllowLoopbackAddresses {
130+
r := bdns.NewDNSResolverImpl(
131+
dnsTimeout,
132+
[]string{c.Common.DNSResolver},
133+
caaSERVFAILExceptions,
134+
scoped,
135+
clk,
136+
dnsTries)
137+
r.LookupIPv6 = c.VA.LookupIPv6
138+
resolver = r
139+
} else {
140+
r := bdns.NewTestDNSResolverImpl(dnsTimeout, []string{c.Common.DNSResolver}, scoped, clk, dnsTries)
141+
r.LookupIPv6 = c.VA.LookupIPv6
142+
resolver = r
119143
}
120144

121-
app.Run()
145+
vai := va.NewValidationAuthorityImpl(
146+
pc,
147+
sbc,
148+
caaClient,
149+
cdrClient,
150+
resolver,
151+
c.VA.UserAgent,
152+
c.VA.IssuerDomain,
153+
stats,
154+
clk,
155+
logger)
156+
157+
amqpConf := c.VA.AMQP
158+
if c.VA.GRPC != nil {
159+
s, l, err := bgrpc.NewServer(c.VA.GRPC, metrics.NewStatsdScope(stats, "VA"))
160+
cmd.FailOnError(err, "Unable to setup VA gRPC server")
161+
err = bgrpc.RegisterValidationAuthorityGRPCServer(s, vai)
162+
cmd.FailOnError(err, "Unable to register VA gRPC server")
163+
go func() {
164+
err = s.Serve(l)
165+
cmd.FailOnError(err, "VA gRPC service failed")
166+
}()
167+
}
168+
169+
vas, err := rpc.NewAmqpRPCServer(amqpConf, c.VA.MaxConcurrentRPCServerRequests, stats, logger)
170+
cmd.FailOnError(err, "Unable to create VA RPC server")
171+
err = rpc.NewValidationAuthorityServer(vas, vai)
172+
cmd.FailOnError(err, "Unable to setup VA RPC server")
173+
174+
err = vas.Start(amqpConf)
175+
cmd.FailOnError(err, "Unable to run VA RPC server")
122176
}

‎cmd/config.go‎

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -25,34 +25,6 @@ type Config struct {
2525
// TODO(jsha): Delete this after a deploy.
2626
AMQP *AMQPConfig
2727

28-
VA struct {
29-
ServiceConfig
30-
31-
UserAgent string
32-
33-
IssuerDomain string
34-
35-
PortConfig PortConfig
36-
37-
MaxConcurrentRPCServerRequests int64
38-
39-
LookupIPv6 bool
40-
41-
GoogleSafeBrowsing *GoogleSafeBrowsingConfig
42-
43-
CAAService *GRPCClientConfig
44-
45-
CAADistributedResolver *CAADistributedResolverConfig
46-
47-
// The number of times to try a DNS query (that has a temporary error)
48-
// before giving up. May be short-circuited by deadlines. A zero value
49-
// will be turned into 1.
50-
DNSTries int
51-
52-
// Feature flag to enable enforcement of CAA SERVFAILs.
53-
CAASERVFAILExceptions string
54-
}
55-
5628
Statsd StatsdConfig
5729

5830
Syslog SyslogConfig

‎cmd/shell.go‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -94,12 +94,6 @@ func (as *AppShell) Run() {
9494
}
9595

9696
// Provide default values for each service's AMQP config section.
97-
if config.VA.AMQP == nil {
98-
config.VA.AMQP = config.AMQP
99-
if config.VA.AMQP != nil && config.AMQP.VA != nil {
100-
config.VA.AMQP.ServiceQueue = config.AMQP.VA.Server
101-
}
102-
}
10397
if config.Mailer.AMQP == nil {
10498
config.Mailer.AMQP = config.AMQP
10599
}

‎test/boulder-config-next.json‎

Lines changed: 0 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -17,48 +17,6 @@
1717
}
1818
},
1919

20-
"va": {
21-
"CAASERVFAILExceptions": "test/caa-servfail-exceptions.txt",
22-
"userAgent": "boulder",
23-
"debugAddr": "localhost:8004",
24-
"portConfig": {
25-
"httpPort": 5002,
26-
"httpsPort": 5001,
27-
"tlsPort": 5001
28-
},
29-
"lookupIPV6": true,
30-
"maxConcurrentRPCServerRequests": 16,
31-
"dnsTries": 3,
32-
"issuerDomain": "happy-hacker-ca.invalid",
33-
"caaService": {
34-
"serverAddresses": ["boulder:9090"],
35-
"serverIssuerPath": "test/grpc-creds/ca.pem",
36-
"clientCertificatePath": "test/grpc-creds/client.pem",
37-
"clientKeyPath": "test/grpc-creds/key.pem"
38-
},
39-
"caaPublicResolver": {
40-
"timeout": "10s",
41-
"keepalive": "30s",
42-
"maxFailures": 1,
43-
"proxies": []
44-
},
45-
"grpc": {
46-
"address": "boulder:9092",
47-
"serverCertificatePath": "test/grpc-creds/server.pem",
48-
"serverKeyPath": "test/grpc-creds/key.pem",
49-
"clientIssuerPath": "test/grpc-creds/ca.pem"
50-
},
51-
"amqp": {
52-
"serverURLFile": "test/secrets/amqp_url",
53-
"insecure": true,
54-
"serviceQueue": "VA.server",
55-
"RA": {
56-
"server": "RA.server",
57-
"rpcTimeout": "15s"
58-
}
59-
}
60-
},
61-
6220
"revoker": {
6321
"dbConnectFile": "test/secrets/revoker_dburl",
6422
"maxDBConns": 1,

‎test/boulder-config.json‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -18,28 +18,6 @@
1818
}
1919
},
2020

21-
"va": {
22-
"userAgent": "boulder",
23-
"debugAddr": "localhost:8004",
24-
"portConfig": {
25-
"httpPort": 5002,
26-
"httpsPort": 5001,
27-
"tlsPort": 5001
28-
},
29-
"maxConcurrentRPCServerRequests": 16,
30-
"dnsTries": 3,
31-
"issuerDomain": "happy-hacker-ca.invalid",
32-
"amqp": {
33-
"serverURLFile": "test/secrets/amqp_url",
34-
"insecure": true,
35-
"serviceQueue": "VA.server",
36-
"RA": {
37-
"server": "RA.server",
38-
"rpcTimeout": "15s"
39-
}
40-
}
41-
},
42-
4321
"revoker": {
4422
"dbConnectFile": "test/secrets/revoker_dburl",
4523
"maxDBConns": 1,

0 commit comments

Comments
 (0)