Add CLI params for TLS cert and key - serves over HTTPS

[mattdodge]

This adds support for serving the web UI over HTTPS. This shouldn't be the default behavior probably but if you have a cert I think you should be able to use it. Especially if basic auth is enabled.

This was first attempted and closed several years ago in #282. I'm hoping that it can be readdressed today though. Most of the web is moving to HTTPS and I believe anything that ships a web server should also come with the ability to run it securely - especially with a package as widely used as Locust is.

Comments/feedback/suggestions welcome, happy to iterate and make this work however we can! I love the Locust project and am happy to help improve it.

[codecov]

Codecov Report

Merging #1354 into master will increase coverage by 0.01%.
The diff coverage is 76.92%.

@@            Coverage Diff             @@
##           master    #1354      +/-   ##
==========================================
+ Coverage   80.67%   80.69%   +0.01%     
==========================================
  Files          24       24              
  Lines        2251     2258       +7     
  Branches      345      346       +1     
==========================================
+ Hits         1816     1822       +6     
- Misses        343      344       +1     
  Partials       92       92              

Impacted Files	Coverage Δ
locust/main.py	20.00% <0.00%> (-0.11%)	⬇️
locust/argument_parser.py	74.31% <100.00%> (+0.48%)	⬆️
locust/env.py	95.55% <100.00%> (ø)
locust/web.py	91.20% <100.00%> (+0.19%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 07d4d95...eb19c57. Read the comment docs.

[heyman]

Could you add docstrings for the tls_cert and tls_cert params to the create_web_ui() method? (Since this method is part of the public API, and included in the API docs)

[mattdodge]

Whoops yeah sure thing, missed this one.

[heyman]

This looks good!

Do we need to say something about the expected format of the cert and key, or is that standardised nowadays?

[mattdodge]

I'm certainly no expert but I think most cert types are handled fine out of the box. I tested with an existing LetsEncrypt cert I had, a new cert using mkcert, and also the self-signed certs from the unit test. It seems like gevent is using ssl.wrap_socket under the hood which should be pretty flexible.

[heyman]

Ok, great! Thanks!