solution: allow TLS configuration for proxy
This commit is contained in:
Igor Artamonov
@@ -29,6 +29,31 @@ It configures following:
|
||||
- no JSON RPC is configured
|
||||
- upstreams configuration is configured in the file `upstreams.yaml`
|
||||
|
||||
.Configuration
|
||||
|===
|
||||
| Name | Example | Description
|
||||
|
||||
a| `version`
|
||||
|
|
||||
| Version of the format of the config
|
||||
|
||||
a| `port`
|
||||
a| `port: 12449`
|
||||
| Port to bind gRPC server. `2449` by default
|
||||
|
||||
a| `tls`
|
||||
|
|
||||
| TLS configuration for gRPC. See link:07-authentication.adoc[Authentication] for details
|
||||
|
||||
a| `proxy`
|
||||
|
|
||||
| Proxy configuration
|
||||
|
||||
a| `upstreams`
|
||||
|
|
||||
| Upstreams configuration
|
||||
|===
|
||||
|
||||
=== Enabling JSON RPC proxy
|
||||
|
||||
.Example proxy:
|
||||
@@ -51,4 +76,49 @@ upstreams:
|
||||
With that configuration Dshackle starts a JSON RPC proxy:
|
||||
|
||||
- JSON RPC server is listening on `0.0.0.0:8080`
|
||||
- `http://0.0.0.0:8080/eth` provides access to Ethereum API routed to an available upstream
|
||||
- `http://0.0.0.0:8080/eth` provides access to Ethereum API routed to an available upstream
|
||||
|
||||
.Full configuration:
|
||||
[source,yaml]
|
||||
----
|
||||
proxy:
|
||||
port: 8080
|
||||
tls:
|
||||
enabled: true
|
||||
server:
|
||||
certificate: server.crt
|
||||
key: server.p8.key
|
||||
client:
|
||||
require: true
|
||||
ca: ca.crt
|
||||
routes:
|
||||
- id: eth
|
||||
blockchain: ethereum
|
||||
- id: etc
|
||||
blockchain: ethereum_classic
|
||||
----
|
||||
|
||||
.Proxy configuration
|
||||
|===
|
||||
| Name | Example | Description
|
||||
|
||||
a| `host`
|
||||
a| `host: 0.0.0.0`
|
||||
| Host to bind proxy server. `127.0.0.1` by default
|
||||
|
||||
a| `port`
|
||||
a| `port: 8545`
|
||||
| Port to bind proxy server. `8080` by default
|
||||
|
||||
a| `enabled`
|
||||
a| `enabled: true`
|
||||
| Enable/disable proxy server
|
||||
|
||||
a| `tls`
|
||||
|
|
||||
| TLS configuration for proxy. See link:07-authentication.adoc[Authentication] for details
|
||||
|
||||
a| `routes`
|
||||
|
|
||||
| List of endpoints to proxy
|
||||
|===
|
||||
@@ -12,16 +12,22 @@ generate certificates, but the traditional `openssl` tool can be used as well.
|
||||
|
||||
==== Setup Server certificate
|
||||
|
||||
.Generate a server certificate
|
||||
.Generate a Certificate Authority
|
||||
[source,bash]
|
||||
----
|
||||
SERVER_CA="ca.myhost.dev"
|
||||
SERVER_IP="127.0.0.1"
|
||||
ORG="My Company"
|
||||
ORG_UNIT="Blockchain"
|
||||
export SERVER_CA="ca.myhost.dev"
|
||||
export ORG="My Company"
|
||||
export ORG_UNIT="Blockchain"
|
||||
|
||||
certstrap init --common-name "$SERVER_CA" --passphrase "" -o "$ORG" -ou "$ORG_UNIT CA"
|
||||
certstrap request-cert -ip $SERVER_IP --passphrase "" -o "$ORG" -ou "$ORG_UNIT Server"
|
||||
openssl pkcs8 -topk8 -inform PEM -outform PEM -in out/$SERVER_CA.key -out out/$SERVER_CA.p8.key -nocrypt
|
||||
----
|
||||
|
||||
.Generate a Server Certificate
|
||||
----
|
||||
export SERVER_IP="127.0.0.1"
|
||||
|
||||
certstrap request-cert -ip $SERVER_IP --common-name $SERVER_IP --passphrase "" -o "$ORG" -ou "$ORG_UNIT Server"
|
||||
certstrap sign $SERVER_IP --CA $SERVER_CA
|
||||
|
||||
openssl pkcs8 -topk8 -inform PEM -outform PEM -in out/$SERVER_IP.key -out out/$SERVER_IP.p8.key -nocrypt
|
||||
@@ -30,8 +36,9 @@ openssl pkcs8 -topk8 -inform PEM -outform PEM -in out/$SERVER_IP.key -out out/$S
|
||||
You are going to get following files now in `out` directory:
|
||||
|
||||
- `ca.myhost.dev.crt` your Certification Authority to sign or verify other certificates
|
||||
- `127.0.0.1.crt` server certificate, 127.0.0.1 is an IP address supposed to be used by that instance, and we use local
|
||||
host for demo purposes. For production use a real IP must be used.
|
||||
- `ca.myhost.dev.p8.key` is the private key for Certification Authority in PKSC 8 format
|
||||
- `127.0.0.1.crt` server certificate, 127.0.0.1 is an IP address supposed to be used by that instance, and we use local host for demo purposes.
|
||||
For production use a real IP must be used.
|
||||
- `127.0.0.1.p8.key` is private key for certificate in PKCS 8 format, it needed by Dshackle server to use certificate
|
||||
|
||||
Copy those files to directory with Dshackle and update configuration.
|
||||
@@ -144,5 +151,43 @@ upstreams:
|
||||
key: client_1.p8.key
|
||||
----
|
||||
|
||||
Now if you run second server it will connect to first server ("upstream") running on port 2449, will verify upstream
|
||||
with certificate `ca.myhost.dev.crt` and authenticate itself by using pair of `client_1.crt` and `client_1.p8.key`
|
||||
Now if you run second server it will connect to first server ("upstream") running on port 2449, will verify upstream with certificate `ca.myhost.dev.crt` and authenticate itself by using pair of `client_1.crt` and `client_1.p8.key`
|
||||
|
||||
=== Server TLS configuration
|
||||
|
||||
|===
|
||||
| Name | Example | Description
|
||||
|
||||
a| `enabled`
|
||||
a|
|
||||
[source,yaml]
|
||||
----
|
||||
tls:
|
||||
enabled: true
|
||||
----
|
||||
| Enabled or disable TLS. By default it checks if certificate is set, and then enables it. But if you enable the TLS
|
||||
but didn't specify the certificate or key, then the DShackle will fails to start with error.
|
||||
|
||||
a| `server.certificate`, `server.key`
|
||||
a|
|
||||
[source,yaml]
|
||||
----
|
||||
tls:
|
||||
server:
|
||||
certificate: server.com.crt
|
||||
key: server.com.p8.key
|
||||
----
|
||||
| Path to certificate and certificate private key
|
||||
|
||||
a| `client.ca`, `client.required`
|
||||
a|
|
||||
[source,yaml]
|
||||
----
|
||||
tls:
|
||||
client:
|
||||
ca: ca.crt
|
||||
required: true
|
||||
----
|
||||
a| Path to CA used to authenticate incoming connections, used if `required: true`
|
||||
|
||||
|===
|
||||
Reference in New Issue
Block a user