search

weaveworks / common

Libraries used in multiple Weave projects
Other
129 stars 92 forks source link

Allow config of TLS cipher suites and min version #256

Closed bboreham closed 2 years ago

bboreham commented 2 years ago

Add a single parameter for each, not split across HTTP and gRPC.

Requires change upstream - https://github.com/prometheus/exporter-toolkit/pull/110. This PR is temporarily using a replace directive to use that code.

Downstream projects rely on CLI parameters to generate docstrings, so we add --server.tls-cipher-suites and --server.tls-min-version. Both CLI and yaml require comma-separated lists of cipher suites, which is different to the yaml array format supported by prometheus/exporter-toolkit.

The names accepted are from Go, listed here: https://pkg.go.dev/crypto/tls#pkg-constants

Fixes #248 (partial, but I haven't seen a justification to do the curves, max version, etc).

bboreham commented 2 years ago

Trying to fix the build at #258