-
Notifications
You must be signed in to change notification settings - Fork 31
[WIP] Add TLS endpoint #69
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
894075c
to
e268de2
Compare
e268de2
to
8ef4dc3
Compare
|
||
collector_endpoints: | ||
- {type: tls, port: 11443, cert: "private/ssl-key-and-cert.pem"} | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It would be ideal if we could keep backward compatibility with old configuration files.
I am thinking that instead of having the endpoints be a list we could expand them to something like:
bouncer_tls_port: XXX
bouncer_tls_cert: XXX
bouncer_hsdir: XXX
collector_tls_port: XXX
collector_tls_cert: XXX
etc.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I kinda thought it was nicer to group all the needed things into an object. It'd be even nicer if I made that object the Twister ServerFromString or whatever.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ok, let's keep this as is for the moment. I noticed you also added backward compatible changes so I think it's ok for the moment.
Overall this looks good 👍 I made a bit of comments for things that should be changed before we can merge this. Good stuff. |
gen-ssl-key-cert.sh
Outdated
-keyout private/ssl-key.pem -out private/ssl-cert.pem \ | ||
-days 400 -nodes -subj '/CN=selfie' | ||
|
||
cat private/ssl-key.pem private/ssh-cert.pem > private/ssl-key-and-cert.pem |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am going to move this into the scripts directory when merging.
Other things to take into consideration:
|
…i-backend into feature/https_endpoint * 'feature/https_endpoint' of github.com:TheTorProject/ooni-backend: only assume HS endpoint when tor_hidden_service: true explain + bail out when inconsistent config
I created two tickets for the documentation/sysadmin tasks here:
I am going to to a final review of this branch and merge it. |
Now there is an issue with the fact that if you set
|
I fixed the outstanding bugs and merged into master. Thanks! |
Ok, I think this is all working.
Be careful to hit the endpoint with an explicit
https
, eg:https://localhost:whatever
as I wasted a bit of time on this :p