problem: outdated config examples

rel: #7
This commit is contained in:
Igor Artamonov
2020-05-27 15:23:46 -04:00
parent 0894b98081
commit ef32308868
3 changed files with 65 additions and 64 deletions

View File

@@ -3,11 +3,11 @@
=== Server authentication
Dshackle server supports both server and client certificate authentication, and it's strongly recommended to use TLS to
connect to Dshackle server. More to that, the server uses gRPC, which is based on HTTP/2, and most of 3rd party tools and
connect to Dshackle server.More to that, the server uses gRPC, which is based on HTTP/2, and most of 3rd party tools and
libraries expect it to be encrypted.
Please note that for most of use cases for Dshackle, which is designed to be an internal load balancer, a self-signed
Certificates would be enough. In the example below, a https://github.com/square/certstrap[certstrap] tool is used to
Certificates would be enough.In the example below, a https://github.com/square/certstrap[certstrap] tool is used to
generate certificates, but the traditional `openssl` tool can be used as well.
==== Setup Server certificate
@@ -90,7 +90,7 @@ openssl pkcs8 -topk8 -inform PEM -outform PEM -in out/$CLIENT_ID.key -out out/$C
In addition to files mentioned above you got few new files in `out` directory, including:
- `client-ca.myhost.dev.crt` a certificate to validate connecting clients, all their keys much be signed by that
certificate. Server don't need a private key for that certificate because it's used for verification only.
certificate.Server don't need a private key for that certificate because it's used for verification only.
- `client_1.crt` certificate for a client that will connect to the server
- `client_1.p8.key` private key for that certificate, needed by client
@@ -131,24 +131,25 @@ tls:
enabled: false
----
At this case we run another server on port 3449 in unsecure mode. But to connect to an upstream is still uses a TLS
At this case we run another server on port 3449 in unsecure mode.But to connect to an upstream is still uses a TLS
certificate as described below
[source,yaml]
----
version: v1
upstreams:
- id: ds
chain: auto
provider: dshackle
connection:
grpc:
host: 127.0.0.1
port: 2449
tls:
ca: ca.myhost.dev.crt
certificate: client_1.crt
key: client_1.p8.key
cluster:
upstreams:
- id: ds
chain: auto
provider: dshackle
connection:
grpc:
host: 127.0.0.1
port: 2449
tls:
ca: ca.myhost.dev.crt
certificate: client_1.crt
key: client_1.p8.key
----
Now if you run second server it will connect to first server ("upstream") running on port 2449, will verify upstream with certificate `ca.myhost.dev.crt` and authenticate itself by using pair of `client_1.crt` and `client_1.p8.key`