16552: Rename ACME config options.

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>

diff --git a/lib/boot/cert.go b/lib/boot/cert.go
index 10fd0aa9f6bc90e0b014145e25bb68d1d496fe9a..175a35080373ae33b56e7b79be14aa7774e38167 100644 (file)
--- a/lib/boot/cert.go
+++ b/lib/boot/cert.go
@@ -36,7 +36,7 @@ func (createCertificates) String() string {
 }
 
 func (createCertificates) Run(ctx context.Context, fail func(error), super *Supervisor) error {
-       if super.cluster.TLS.Automatic {
+       if super.cluster.TLS.ACME.Server != "" {
                return bootAutoCert(ctx, fail, super)
        } else if super.cluster.TLS.Key == "" && super.cluster.TLS.Certificate == "" {
                return createSelfSignedCert(ctx, fail, super)
@@ -78,8 +78,15 @@ func bootAutoCert(ctx context.Context, fail func(error), super *Supervisor) erro
                        }
                },
        }
-       if super.cluster.TLS.Staging {
+       if srv := super.cluster.TLS.ACME.Server; srv == "LE" {
+               // Leaving mgr.Client == nil means use Let's Encrypt
+               // production environment
+       } else if srv == "LE-staging" {
                mgr.Client = &acme.Client{DirectoryURL: stagingDirectoryURL}
+       } else if strings.HasPrefix(srv, "https://") {
+               mgr.Client = &acme.Client{DirectoryURL: srv}
+       } else {
+               return fmt.Errorf("autocert setup: invalid directory URL in TLS.ACME.Server: %q", srv)
        }
        go func() {
                err := http.ListenAndServe(":80", mgr.HTTPHandler(nil))

diff --git a/lib/config/config.default.yml b/lib/config/config.default.yml
index c8c02cc6040b248bef2506ac11075767f2efa95e..8d5bbc258eb45ee7d05a023537c8685062a5a1c8 100644 (file)
--- a/lib/config/config.default.yml
+++ b/lib/config/config.default.yml
@@ -909,17 +909,21 @@ Clusters:
       # use this in production.
       Insecure: false
 
-      # Agree to Let's Encrypt terms of service and obtain
-      # certificates automatically for ExternalURL domains.
-      #
-      # Note: this feature is not yet implemented in released
-      # versions, only in the alpha/prerelease arvados-server-easy
-      # package.
-      Automatic: false
-
-      # Use Let's Encrypt staging environment instead of production
-      # environment.
-      Staging: false
+      ACME:
+        # Obtain certificates automatically for ExternalURL domains
+        # using an ACME server and http-01 validation.
+        #
+        # To use Let's Encrypt, specify "LE".  To use the Let's
+        # Encrypt staging environment, specify "LE-staging".  To use a
+        # different ACME server, specify the full directory URL
+        # ("https://...").
+        #
+        # Note: this feature is not yet implemented in released
+        # versions, only in the alpha/prerelease arvados-server-easy
+        # package.
+        #
+        # Implies agreement with the server's terms of service.
+        Server: ""
 
     Containers:
       # List of supported Docker Registry image formats that compute nodes

diff --git a/lib/install/init.go b/lib/install/init.go
index 792262b59a542565284ce336b37b1efe8ea30d59..a928f225296b44f2597cd353650af2a19d0e1a3b 100644 (file)
--- a/lib/install/init.go
+++ b/lib/install/init.go
@@ -72,7 +72,7 @@ func (initcmd *initCommand) RunCommand(prog string, args []string, stdin io.Read
        flags.StringVar(&initcmd.Domain, "domain", hostname, "cluster public DNS `name`, like x1234.arvadosapi.com")
        flags.StringVar(&initcmd.Login, "login", "", "login `backend`: test, pam, 'google {client-id} {client-secret}', or ''")
        flags.StringVar(&initcmd.AdminEmail, "admin-email", "", "give admin privileges to user with given `email`")
-       flags.StringVar(&initcmd.TLS, "tls", "none", "tls certificate `source`: acme, auto, insecure, or none")
+       flags.StringVar(&initcmd.TLS, "tls", "none", "tls certificate `source`: acme, acmetool, insecure, or none")
        flags.BoolVar(&initcmd.Start, "start", true, "start systemd service after creating config")
        if ok, code := cmd.ParseFlags(flags, prog, args, "", stderr); !ok {
                return code
@@ -214,9 +214,10 @@ func (initcmd *initCommand) RunCommand(prog string, args []string, stdin io.Read
     TLS:
       {{if eq .TLS "insecure"}}
       Insecure: true
-      {{else if eq .TLS "auto"}}
-      Automatic: true
       {{else if eq .TLS "acme"}}
+      ACME:
+        Server: LE
+      {{else if eq .TLS "acmetool"}}
       Certificate: {{printf "%q" (print "/var/lib/acme/live/" .Domain "/cert")}}
       Key: {{printf "%q" (print "/var/lib/acme/live/" .Domain "/privkey")}}
       {{else}}

diff --git a/lib/service/tls.go b/lib/service/tls.go
index 234ee5787855c53929af5885590fb1abdeaece80..88a2858beb13e2f5db216a7645423fd7d2c7c541 100644 (file)
--- a/lib/service/tls.go
+++ b/lib/service/tls.go
@@ -21,7 +21,7 @@ import (
 )
 
 func makeTLSConfig(cluster *arvados.Cluster, logger logrus.FieldLogger) (*tls.Config, error) {
-       if cluster.TLS.Automatic {
+       if cluster.TLS.ACME.Server != "" {
                return makeAutocertConfig(cluster, logger)
        } else {
                return makeFileLoaderConfig(cluster, logger)

diff --git a/sdk/go/arvados/config.go b/sdk/go/arvados/config.go
index d9aa92b65d0fbfe1c97da212f5b1661e92e381be..6d8f39dfb316fbaba1cf64f71ef5f5f778f91e8e 100644 (file)
--- a/sdk/go/arvados/config.go
+++ b/sdk/go/arvados/config.go
@@ -227,8 +227,9 @@ type Cluster struct {
                Certificate string
                Key         string
                Insecure    bool
-               Automatic   bool
-               Staging     bool
+               ACME        struct {
+                       Server string
+               }
        }
        Users struct {
                ActivatedUsersAreVisibleToOthers      bool