Listen with TLS if configured

CHANGELOG.md

@@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 * Configuration file path can be selected with the `-config` flag. [#745](https://github.com/elastic/package-registry/pull/745)
 * Configuration flags can be provided using environment variables. [#745](https://github.com/elastic/package-registry/pull/745)
+* Add -tls-cert and -tls-key flags to configure HTTPS. [#711](https://github.com/elastic/package-registry/issues/711) [#746](https://github.com/elastic/package-registry/issues/746)
 
 ### Deprecated
 

Dockerfile

@@ -32,7 +32,7 @@ EXPOSE 8080
 ENTRYPOINT ["./package-registry"]
 
 # Make sure it's accessible from outside the container
-CMD ["--address=0.0.0.0:8080"]
+ENV EPR_ADDRESS=0.0.0.0:8080
 
 HEALTHCHECK --interval=1s --retries=30 CMD curl --silent --fail localhost:8080/health || exit 1
 

README.md

@@ -112,7 +112,18 @@ docker run -p 8080:8080 {image id from prior step}
 **Commands ready to cut-and-paste**
 ```
 docker build --rm -t docker.elastic.co/package-registry/package-registry:master .
-docker run -i -t -p 8080:8080 $(docker images -q docker.elastic.co/package-registry/package-registry:master)
+docker run -it -p 8080:8080 $(docker images -q docker.elastic.co/package-registry/package-registry:master)
+```
+
+**Listening on HTTPS**
+```
+docker run -it -p 8443:8443 \
+ -v /etc/ssl/package-registry.key:/etc/ssl/package-registry.key:ro \
+ -v /etc/ssl/package-registry.crt:/etc/ssl/package-registry.crt:ro \
+ -e EPR_ADDRESS=0.0.0.0:8443
+ -e EPR_TLS_KEY=/etc/ssl/package-registry.key \
+ -e EPR_TLS_CERT=/etc/ssl/package-registry.crt \
+ docker.elastic.co/package-registry/package-registry:master
 ```
 
 #### Docker images published

main.go

@@ -37,6 +37,9 @@ var (
  address string
  httpProfAddress string
 
+ tlsCertFile string
+ tlsKeyFile string
+
  dryRun bool
  configPath string
 
@@ -50,6 +53,8 @@ var (
 
 func init() {
  flag.StringVar(&address, "address", "localhost:8080", "Address of the package-registry service.")
+ flag.StringVar(&tlsCertFile, "tls-cert", "", "Path of the TLS certificate.")
+ flag.StringVar(&tlsKeyFile, "tls-key", "", "Path of the TLS key.")
  flag.StringVar(&configPath, "config", "config.yml", "Path to the configuration file.")
  flag.StringVar(&httpProfAddress, "httpprof", "", "Enable HTTP profiler listening on the given address.")
  // This flag is experimental and might be removed in the future or renamed
@@ -74,7 +79,7 @@ func main() {
 
  server := initServer()
  go func() {
- err := server.ListenAndServe()
+ err := runServer(server)
  if err != nil && err != http.ErrServerClosed {
  log.Fatalf("Error occurred while serving: %s", err)
  }
@@ -130,6 +135,13 @@ func initServer() *http.Server {
  return &http.Server{Addr: address, Handler: router}
 }
 
+func runServer(server *http.Server) error {
+ if tlsCertFile != "" && tlsKeyFile != "" {
+ return server.ListenAndServeTLS(tlsCertFile, tlsKeyFile)
+ }
+ return server.ListenAndServe()
+}
+
 func initAPMTracer() *apm.Tracer {
  apm.DefaultTracer.Close()
  if _, found := os.LookupEnv("ELASTIC_APM_SERVER_URL"); !found {