Listen with TLS if configured

CHANGELOG.md

@@ -16,6 +16,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 * Configuration file path can be selected with the `-config` flag. [#745](https://github.com/elastic/package-registry/pull/745)
 * Configuration flags can be provided using environment variables. [#745](https://github.com/elastic/package-registry/pull/745)
+* Add `-tls-cert` and `-tls-key` flags to configure HTTPS. [#711](https://github.com/elastic/package-registry/issues/711) [#746](https://github.com/elastic/package-registry/issues/746)
 
 ### Deprecated
 

Dockerfile

@@ -32,7 +32,7 @@ EXPOSE 8080
 ENTRYPOINT ["./package-registry"]
 
 # Make sure it's accessible from outside the container
-CMD ["--address=0.0.0.0:8080"]
+ENV EPR_ADDRESS=0.0.0.0:8080
 
 HEALTHCHECK --interval=1s --retries=30 CMD curl --silent --fail localhost:8080/health || exit 1
 

README.md

@@ -112,7 +112,18 @@ docker run -p 8080:8080 {image id from prior step}
 **Commands ready to cut-and-paste**
 ```
 docker build --rm -t docker.elastic.co/package-registry/package-registry:master .
-docker run -i -t -p 8080:8080 $(docker images -q docker.elastic.co/package-registry/package-registry:master)
+docker run -it -p 8080:8080 $(docker images -q docker.elastic.co/package-registry/package-registry:master)
+```
+
+**Listening on HTTPS**
+```
+docker run -it -p 8443:8443 \
+  -v /etc/ssl/package-registry.key:/etc/ssl/package-registry.key:ro \
+  -v /etc/ssl/package-registry.crt:/etc/ssl/package-registry.crt:ro \
+  -e EPR_ADDRESS=0.0.0.0:8443
+  -e EPR_TLS_KEY=/etc/ssl/package-registry.key \
+  -e EPR_TLS_CERT=/etc/ssl/package-registry.crt \
+  docker.elastic.co/package-registry/package-registry:master
 ```
 
 #### Docker images published

main.go

@@ -37,6 +37,9 @@ var (
 	address         string
 	httpProfAddress string
 
+	tlsCertFile string
+	tlsKeyFile  string
+
 	dryRun     bool
 	configPath string
 
@@ -50,6 +53,8 @@ var (
 
 func init() {
 	flag.StringVar(&address, "address", "localhost:8080", "Address of the package-registry service.")
+	flag.StringVar(&tlsCertFile, "tls-cert", "", "Path of the TLS certificate.")
+	flag.StringVar(&tlsKeyFile, "tls-key", "", "Path of the TLS key.")
 	flag.StringVar(&configPath, "config", "config.yml", "Path to the configuration file.")
 	flag.StringVar(&httpProfAddress, "httpprof", "", "Enable HTTP profiler listening on the given address.")
 	// This flag is experimental and might be removed in the future or renamed
@@ -74,7 +79,7 @@ func main() {
 
 	server := initServer()
 	go func() {
-		err := server.ListenAndServe()
+		err := runServer(server)
 		if err != nil && err != http.ErrServerClosed {
 			log.Fatalf("Error occurred while serving: %s", err)
 		}
@@ -130,6 +135,13 @@ func initServer() *http.Server {
 	return &http.Server{Addr: address, Handler: router}
 }
 
+func runServer(server *http.Server) error {
+	if tlsCertFile != "" && tlsKeyFile != "" {
+		return server.ListenAndServeTLS(tlsCertFile, tlsKeyFile)
+	}
+	return server.ListenAndServe()
+}
+
 func initAPMTracer() *apm.Tracer {
 	apm.DefaultTracer.Close()
 	if _, found := os.LookupEnv("ELASTIC_APM_SERVER_URL"); !found {