/
main.go
104 lines (83 loc) · 2.43 KB
/
main.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
package main
import (
"flag"
"log"
stdlibnet "net"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials"
"github.com/talos-systems/talos/internal/app/trustd/internal/reg"
"github.com/talos-systems/talos/pkg/config"
"github.com/talos-systems/talos/pkg/constants"
"github.com/talos-systems/talos/pkg/grpc/factory"
"github.com/talos-systems/talos/pkg/grpc/middleware/auth/basic"
"github.com/talos-systems/talos/pkg/grpc/tls"
"github.com/talos-systems/talos/pkg/net"
"github.com/talos-systems/talos/pkg/startup"
)
var configPath *string
func init() {
log.SetFlags(log.Lshortfile | log.Ldate | log.Lmicroseconds | log.Ltime)
configPath = flag.String("config", "", "the path to the config")
flag.Parse()
}
// nolint: gocyclo
func main() {
var err error
if err = startup.RandSeed(); err != nil {
log.Fatalf("startup: %s", err)
}
config, err := config.NewFromFile(*configPath)
if err != nil {
log.Fatalf("failed to create config from file: %v", err)
}
ips, err := net.IPAddrs()
if err != nil {
log.Fatal(err)
}
dnsNames, err := net.DNSNames()
if err != nil {
log.Fatal(err)
}
for _, san := range config.Machine().Security().CertSANs() {
if ip := stdlibnet.ParseIP(san); ip != nil {
ips = append(ips, ip)
} else {
dnsNames = append(dnsNames, san)
}
}
var provider tls.CertificateProvider
provider, err = tls.NewLocalRenewingFileCertificateProvider(config.Machine().Security().CA().Key, config.Machine().Security().CA().Crt, dnsNames, ips)
if err != nil {
log.Fatalln("failed to create local certificate provider:", err)
}
ca, err := provider.GetCA()
if err != nil {
log.Fatal(err)
}
tlsConfig, err := tls.New(
tls.WithClientAuthType(tls.ServerOnly),
tls.WithCACertPEM(ca),
tls.WithServerCertificateProvider(provider),
)
if err != nil {
log.Fatalf("failed to create TLS config: %v", err)
}
creds := basic.NewTokenCredentials(config.Machine().Security().Token())
err = factory.ListenAndServe(
®.Registrator{Config: config},
factory.Port(constants.TrustdPort),
factory.WithDefaultLog(),
factory.WithUnaryInterceptor(creds.UnaryInterceptor()),
factory.ServerOptions(
grpc.Creds(
credentials.NewTLS(tlsConfig),
),
),
)
if err != nil {
log.Fatalf("listen: %v", err)
}
}