@@ -11,6 +11,7 @@ import (
1111 "sync"
1212 "time"
1313
14+ "github.com/PowerDNS/go-tlsconfig"
1415 "github.com/aws/aws-sdk-go-v2/aws"
1516 awshttp "github.com/aws/aws-sdk-go-v2/aws/transport/http"
1617 s3config "github.com/aws/aws-sdk-go-v2/config"
@@ -51,6 +52,10 @@ type Options struct {
5152 // instead of AWS S3.
5253 EndpointURL string `yaml:"endpoint_url"`
5354
55+ // TLS allows customising the TLS configuration
56+ // See https://github.com/PowerDNS/go-tlsconfig for the available options
57+ TLS tlsconfig.Config `yaml:"tls"`
58+
5459 // InitTimeout is the time we allow for initialisation, like credential
5560 // checking and bucket creation. It defaults to DefaultInitTimeout, which
5661 // is currently 20s.
@@ -241,15 +246,39 @@ func New(ctx context.Context, opt Options) (*Backend, error) {
241246 return nil , err
242247 }
243248
244- // Some of the following calls require a context
249+ // Automatic TLS handling
250+ // This MUST receive a longer running context to be able to automatically
251+ // reload certificates, so we use the original ctx, not one with added
252+ // InitTimeout.
253+ tlsmgr , err := tlsconfig .NewManager (ctx , opt .TLS , tlsconfig.Options {
254+ IsClient : true ,
255+ // TODO: logging might be useful here, but we need to figure this
256+ // out for other parts of simpleblob first.
257+ Logr : nil ,
258+ })
259+ if err != nil {
260+ return nil , err
261+ }
262+ // Get an opinionated HTTP client that:
263+ // - Uses a custom tls.Config
264+ // - Sets proxies from the environment
265+ // - Sets reasonable timeouts on various operations
266+ // Check the implementation for details.
267+ hc , err := tlsmgr .HTTPClient ()
268+ if err != nil {
269+ return nil , err
270+ }
271+
272+ // Some of the following calls require a short running context
245273 ctx , cancel := context .WithTimeout (ctx , opt .InitTimeout )
246274 defer cancel ()
247275
248276 creds := credentials .NewStaticCredentialsProvider (opt .AccessKey , opt .SecretKey , "" )
249277 cfg , err := s3config .LoadDefaultConfig (
250278 ctx ,
251279 s3config .WithCredentialsProvider (creds ),
252- s3config .WithRegion (opt .Region ))
280+ s3config .WithRegion (opt .Region ),
281+ s3config .WithHTTPClient (hc ))
253282 if err != nil {
254283 return nil , err
255284 }
0 commit comments