FlorianUekermann / rustls-acme

Apache License 2.0
136 stars 27 forks source link

Tonic support #51

Open Ludea opened 10 months ago

Ludea commented 10 months ago

I see there is Warp and Axum support.

It would be awesome to get Tonic support too

FlorianUekermann commented 10 months ago

Any specific ideas on how to do that? I'm not quite sure what would be useful here.

Maybe the best way to integrate would be contributing (to tonic) a feature gated method to its high-level server builder, which takes an AcmeConfig, instead of the fixed certificate config they have at the moment.

AshleySchaeffer commented 10 months ago

Just came across this myself. I've not tried this yet, but after looking at this tonic TLS server example I'm wondering whether you could use a AcmeAcceptor here and be good to go:

https://github.com/hyperium/tonic/blob/b3fca19104bf001d3a3dac74221b7c9bede13cf1/examples/src/tls_rustls/server.rs#L56C5-L56C5

@FlorianUekermann do you think that will work? I'm yet to try it but will do as soon as I can find time.

I appreciate this doesn't mean that this crate gets a more convenient tonic integration but assuming it's possible to do the above, I feel like it wouldn't be a stretch to add it, or at least an example.

EDIT: I think you'd also have to change the ServerConfig here to use the ACME resolver of this crate:

https://github.com/hyperium/tonic/blob/b3fca19104bf001d3a3dac74221b7c9bede13cf1/examples/src/tls_rustls/server.rs#L40C19-L40C31

Or it may even be possible to use the tokio integration (https://docs.rs/rustls-acme/latest/rustls_acme/tokio/struct.TokioIncoming.html) like this:

https://github.com/FlorianUekermann/rustls-acme/blob/main/examples/high_level_tokio.rs

And pass incoming TLS connections straight to serve_connection:

https://github.com/hyperium/tonic/blob/b3fca19104bf001d3a3dac74221b7c9bede13cf1/examples/src/tls_rustls/server.rs#L89

FlorianUekermann commented 10 months ago

Yes, both options look very promising.

The convenience aspect is more about tower than tonic I guess. You might even be able to use the high-level API then. Given how popular tower is, I think offering helpers for it may be a good idea anyway.