Provide X509 to containers

[systemcrash]

A restart of heplify-server seems to generate a new X509 local-cert.

Example:

# openssl s_client -connect 127.0.0.1:9060
CONNECTED(00000003)
depth=1 O = heplify-server, CN = heplify-server
verify error:num=19:self signed certificate in certificate chain
---
Certificate chain
 0 s:/O=3c29337bcfda/CN=3c29337bcfda
   i:/O=heplify-server/CN=heplify-server
 1 s:/O=heplify-server/CN=heplify-server
   i:/O=heplify-server/CN=heplify-server
---
...CERT1...

# docker-compose stop heplify-server
Stopping heplify-server ... done
# docker-compose start heplify-server
Starting heplify-server ... done

# openssl s_client -connect 127.0.0.1:9060
CONNECTED(00000003)
depth=1 O = heplify-server, CN = heplify-server
verify error:num=19:self signed certificate in certificate chain
---
Certificate chain
 0 s:/O=3c29337bcfda/CN=3c29337bcfda
   i:/O=heplify-server/CN=heplify-server
 1 s:/O=heplify-server/CN=heplify-server
   i:/O=heplify-server/CN=heplify-server
---
...CERT2...

Upgrading a heplify-server instance likely forces generation of a new CA.

Is there a way I can feed in a "seed" or my own CA.pem so future upgrades/restarts don't generate a new cert? This is so remote endpoints configured to use TLS don't need updating.

I see tls.go uses https://github.com/negbie/cert - but I don't see how we get this into the docker image via a docker-compose.yml param.

A volume mapping (more convenient) or environment variable would be useful here. Is it just a question of mapping a volume to a folder and putting in the necessary heplify-server-{cert|key}.pem ? If so, to which folder? And is this folder location stable?

https://github.com/sipcapture/heplify-serve/blob/42ac9e7bc2aaa234825d458c74b15cf40dad5fd4/server/tls.go#L29

[negbie]

They are placed into the same folder beside the binary. Did you try to map that folder as volume.

[systemcrash]

Yeah - it didn't work. A red ERROR message was immediately printed about the file heplify-server and the container did not start.

Mapped an empty local folder to /root and it did not like it.

[negbie]

Ok mby it's better to expose two config options for cert and key path.

[systemcrash]

It seems like the error comes from Docker:

ERROR: for heplify-server  Cannot start service heplify-server: OCI runtime create failed: container_linux.go:349: starting container process caused "exec: \"./heplify-server\": stat ./heplify-server: no such file or directory": unknown

ERROR: for heplify-server  Cannot start service heplify-server: OCI runtime create failed: container_linux.go:349: starting container process caused "exec: \"./heplify-server\": stat ./heplify-server: no such file or directory": unknown
ERROR: Encountered errors while bringing up the project.

[systemcrash]

I like the idea of exposing a folder/volume - makes getting certs in easier. Instead of squashing a cert into an environment variable.

[negbie]

Will look into it over the next days, weeks, months depending on my time budget. PR's are always welcome :)

[systemcrash]

I guess this is partially to do with the container, and how it's constructed. heplify-server runs as root, so it lands in the /root folder, it seems. If heplify-server looks in e.g. /root/certs/ - would this be an acceptable fix? Should be able to map this relatively easily.

[systemcrash]

So add to https://github.com/sipcapture/heplify-server/blob/master/docker/Dockerfile e.g.:

RUN mkdir -p /root/certs

[systemcrash]

Then in theory just update:

    ca, err := cert.NewCertificateAuthority("heplify-server")

to, I think,

    ca, err := cert.NewCertificateAuthority("certs/heplify-server")

Or?

[negbie]

Yeah something like this could be a possible way. Many possiblities.

[systemcrash]

For your review #399 - fairly simplez.

[systemcrash]

Was able to test and verify that heplify-server starts up correctly, and accepts an external X509 (basically how your https://github.com/negbie/cert/blob/master/cert.go works). The only potential problem now is for heplify-server not in containers - it logs this:

ERR  open certs/heplify-server-cert.pem: no such file or directory

With this error state, a connection is possible, but no TLS is established. Perhaps an os.MkDir is better placed in the library? Thoughts?

[systemcrash]

Fixed in #399