update signal gRpc, enable TLS and add keepalive params (#62)

* chore: update signal gRpc
* chore: add Signal keep alive params and policy
* feature: add signal TLS support
* refactor: move signal Dockerfile to the corresponding folder
Co-authored-by: braginini <m.bragin@wiretrustee.com>

cmd/root.go

@@ -1,11 +1,16 @@
 package cmd
 
 import (
+	"crypto/tls"
 	"fmt"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	"golang.org/x/crypto/acme/autocert"
+	"google.golang.org/grpc/credentials"
+	"net/http"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"runtime"
 )
 
@@ -74,3 +79,31 @@ func InitLog(logLevel string) {
 	}
 	log.SetLevel(level)
 }
+
+func enableLetsEncrypt(datadir string, letsencryptDomain string) credentials.TransportCredentials {
+	certDir := filepath.Join(datadir, "letsencrypt")
+
+	if _, err := os.Stat(certDir); os.IsNotExist(err) {
+		err = os.MkdirAll(certDir, os.ModeDir)
+		if err != nil {
+			log.Fatalf("failed creating Let's encrypt certdir: %s: %v", certDir, err)
+		}
+	}
+
+	log.Infof("running with Let's encrypt with domain %s. Cert will be stored in %s", letsencryptDomain, certDir)
+
+	certManager := autocert.Manager{
+		Prompt:     autocert.AcceptTOS,
+		Cache:      autocert.DirCache(certDir),
+		HostPolicy: autocert.HostWhitelist(letsencryptDomain),
+	}
+
+	// listener to handle Let's encrypt certificate challenge
+	go func() {
+		if err := http.Serve(certManager.Listener(), certManager.HTTPHandler(nil)); err != nil {
+			log.Fatalf("failed to serve letsencrypt handler: %v", err)
+		}
+	}()
+
+	return credentials.NewTLS(&tls.Config{GetCertificate: certManager.GetCertificate})
+}

cmd/signal.go

@@ -8,11 +8,28 @@ import (
 	sig "github.com/wiretrustee/wiretrustee/signal"
 	sigProto "github.com/wiretrustee/wiretrustee/signal/proto"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/keepalive"
 	"net"
+	"os"
+	"time"
 )
 
 var (
-	signalPort int
+	signalPort              int
+	signalLetsencryptDomain string
+	signalDataDir           string
+
+	signalKaep = grpc.KeepaliveEnforcementPolicy(keepalive.EnforcementPolicy{
+		MinTime:             5 * time.Second,
+		PermitWithoutStream: true,
+	})
+
+	signalKasp = grpc.KeepaliveParams(keepalive.ServerParameters{
+		MaxConnectionIdle:     15 * time.Second,
+		MaxConnectionAgeGrace: 5 * time.Second,
+		Time:                  5 * time.Second,
+		Timeout:               2 * time.Second,
+	})
 
 	signalCmd = &cobra.Command{
 		Use:   "signal",
@@ -20,6 +37,22 @@ var (
 		Run: func(cmd *cobra.Command, args []string) {
 			flag.Parse()
 
+			if _, err := os.Stat(signalDataDir); os.IsNotExist(err) {
+				err = os.MkdirAll(signalDataDir, os.ModeDir)
+				if err != nil {
+					log.Fatalf("failed creating datadir: %s: %v", signalDataDir, err)
+				}
+			}
+
+			var opts []grpc.ServerOption
+			if mgmtLetsencryptDomain != "" {
+				transportCredentials := enableLetsEncrypt(signalDataDir, signalLetsencryptDomain)
+				opts = append(opts, grpc.Creds(transportCredentials))
+			}
+
+			opts = append(opts, signalKaep, signalKasp)
+			grpcServer := grpc.NewServer(opts...)
+
 			lis, err := net.Listen("tcp", fmt.Sprintf(":%d", signalPort))
 			if err != nil {
 				log.Fatalf("failed to listen: %v", err)
@@ -28,8 +61,7 @@ var (
 			if err != nil {
 				log.Fatalf("failed to listen: %v", err)
 			}
-			var opts []grpc.ServerOption
-			grpcServer := grpc.NewServer(opts...)
+
 			sigProto.RegisterSignalExchangeServer(grpcServer, sig.NewServer())
 			log.Printf("started server: localhost:%v", signalPort)
 			if err := grpcServer.Serve(lis); err != nil {
@@ -37,11 +69,14 @@ var (
 			}
 
 			SetupCloseHandler()
-			select {}
+			<-stopCh
+			log.Println("Receive signal to stop running the Signal server")
 		},
 	}
 )
 
 func init() {
 	signalCmd.PersistentFlags().IntVar(&signalPort, "port", 10000, "Server port to listen on (e.g. 10000)")
+	signalCmd.Flags().StringVar(&signalDataDir, "datadir", "/var/lib/wiretrustee/", "server data directory location")
+	signalCmd.Flags().StringVar(&signalLetsencryptDomain, "letsencrypt-domain", "", "a domain to issue Let's Encrypt certificate for. Enables TLS using Let's Encrypt. Will fetch and renew certificate, and run the server with TLS")
 }