hypermodeinc · karlmcguire · Feb 25, 2021 · Feb 16, 2021 · Feb 16, 2021 · Feb 16, 2021
diff --git a/compose/compose.go b/compose/compose.go
@@ -104,7 +104,6 @@ type options struct {
 	Ratel          bool
 	RatelPort      int
 	MemLimit       string
-	TlsDir         string
 	ExposePorts    bool
 	Encryption     bool
 	LudicrousMode  bool
@@ -215,7 +214,7 @@ func initService(basename string, idx, grpcPort int) service {
 	}
 	svc.Command += " " + basename
 	if opts.Jaeger {
-		svc.Command += " --jaeger.collector=http://jaeger:14268"
+		svc.Command += ` --trace "jaeger=http://jaeger:14268;"`
 	}
 	return svc
 }
@@ -308,24 +307,24 @@ func getAlpha(idx int, raft string) service {
 	svc.Command += fmt.Sprintf(" --zero=%s", zerosOpt)
 	svc.Command += fmt.Sprintf(" --logtostderr -v=%d", opts.Verbosity)
 	if opts.LudicrousMode {
-		svc.Command += " --ludicrous_mode=true"
+		svc.Command += ` --ludicrous "enabled=true;"`
 	}
 
 	if opts.SnapshotAfter != "" {
 		raft = fmt.Sprintf("%s; snapshot-after=%s", raft, opts.SnapshotAfter)
 	}
-	svc.Command += fmt.Sprintf(` --raft='%s'`, raft)
+	svc.Command += fmt.Sprintf(` --raft "%s"`, raft)
 
 	// Don't assign idx, let it auto-assign.
 	// svc.Command += fmt.Sprintf(" --raft='idx=%d'", idx)
 	if opts.Vmodule != "" {
 		svc.Command += fmt.Sprintf(" --vmodule=%s", opts.Vmodule)
 	}
 	if opts.WhiteList {
-		svc.Command += " --whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+		svc.Command += ` --security "whitelist=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16;"`
 	}
 	if opts.Acl {
-		svc.Command += " --acl_secret_file=/secret/hmac"
+		svc.Command += ` --acl "secret-file=/secret/hmac;"`
 		svc.Volumes = append(svc.Volumes, volume{
 			Type:     "bind",
 			Source:   "./acl-secret",
@@ -334,7 +333,7 @@ func getAlpha(idx int, raft string) service {
 		})
 	}
 	if opts.AclSecret != "" {
-		svc.Command += " --acl_secret_file=/secret/hmac"
+		svc.Command += ` --acl "secret-file=/secret/hmac;"`
 		svc.Volumes = append(svc.Volumes, volume{
 			Type:     "bind",
 			Source:   opts.AclSecret,
@@ -356,15 +355,6 @@ func getAlpha(idx int, raft string) service {
 			ReadOnly: true,
 		})
 	}
-	if opts.TlsDir != "" {
-		svc.Command += " --tls_dir=/secret/tls"
-		svc.Volumes = append(svc.Volumes, volume{
-			Type:     "bind",
-			Source:   opts.TlsDir,
-			Target:   "/secret/tls",
-			ReadOnly: true,
-		})
-	}
 	if len(opts.AlphaVolumes) > 0 {
 		for _, vol := range opts.AlphaVolumes {
 			svc.Volumes = append(svc.Volumes, getVolume(vol))
@@ -588,15 +578,13 @@ func main() {
 		"Port to expose Ratel service")
 	cmd.PersistentFlags().StringVarP(&opts.MemLimit, "mem", "", "32G",
 		"Limit memory provided to the docker containers, for example 8G.")
-	cmd.PersistentFlags().StringVar(&opts.TlsDir, "tls_dir", "",
-		"TLS Dir.")
 	cmd.PersistentFlags().BoolVar(&opts.ExposePorts, "expose_ports", true,
 		"expose host:container ports for each service")
 	cmd.PersistentFlags().StringVar(&opts.Vmodule, "vmodule", "",
 		"comma-separated list of pattern=N settings for file-filtered logging")
 	cmd.PersistentFlags().BoolVar(&opts.Encryption, "encryption", false,
 		"enable encryption-at-rest feature.")
-	cmd.PersistentFlags().BoolVar(&opts.LudicrousMode, "ludicrous_mode", false,
+	cmd.PersistentFlags().BoolVar(&opts.LudicrousMode, "ludicrous", false,
 		"enable zeros and alphas in ludicrous mode.")
 	cmd.PersistentFlags().StringVar(&opts.SnapshotAfter, "snapshot_after", "",
 		"create a new Raft snapshot after this many number of Raft entries.")

diff --git a/contrib/config/backups/azure/docker-compose.yml b/contrib/config/backups/azure/docker-compose.yml
@@ -7,7 +7,7 @@ services:
     ports:
       - 5080:5080
       - 6080:6080
-    command: dgraph zero --my=zero1:5080 --replicas 1 --raft="idx=1"
+    command: dgraph zero --my=zero1:5080 --replicas 1 --raft="idx=1;"
 
   alpha1:
     image: dgraph/dgraph:${DGRAPH_VERSION}
@@ -18,7 +18,8 @@ services:
     ports:
       - 8080:8080
       - 9080:9080
-    command: dgraph alpha --my=alpha1:7080 --zero=zero1:5080 --whitelist "10.0.0.0/8,172.0.0.0/8,192.168.0.0/16,127.0.0.1"
+    command: dgraph alpha --my=alpha1:7080 --zero=zero1:5080 
+      --security "whitelist=10.0.0.0/8,172.0.0.0/8,192.168.0.0/16,127.0.0.1;"
 
   ratel:
     image: dgraph/dgraph:${DGRAPH_VERSION}

diff --git a/contrib/config/backups/client/compose-setup.sh b/contrib/config/backups/client/compose-setup.sh
@@ -216,14 +216,13 @@ config_compose() {
 
   ## configure if user specifies
   [[ $ACL_ENABLED == "true" ]] && \
-    echo "acl_secret_file = '/dgraph/acl/hmac_secret_file'" >> "$CFGPATH/config.toml"
+    echo "--acl \"secret-file=/dgraph/acl/hmac_secret_file;\"" >> "$CFGPATH/config.toml"
   [[ $TOKEN_ENABLED == "true" ]] && \
     echo "auth_token = '$(cat ./data/token/auth_token_file)'" >> "$CFGPATH/config.toml"
   [[ $ENC_ENABLED == "true" ]] && \
     echo "encryption_key_file = '/dgraph/enc/enc_key_file'" >> "$CFGPATH/config.toml"
   [[ $TLS_ENABLED == "true" ]] &&
     cat <<-TLS_CONFIG >> $CFGPATH/config.toml
-tls_dir = '/dgraph/tls'
 tls_client_auth = '$TLS_CLIENT_AUTH'
 TLS_CONFIG
 

diff --git a/contrib/config/backups/gcp/docker-compose.yml b/contrib/config/backups/gcp/docker-compose.yml
@@ -7,7 +7,7 @@ services:
     ports:
       - 5080:5080
       - 6080:6080
-    command: dgraph zero --my=zero1:5080 --replicas 1 --raft="idx=1"
+    command: dgraph zero --my=zero1:5080 --replicas 1 --raft="idx=1;"
 
   alpha1:
     image: dgraph/dgraph:${DGRAPH_VERSION}
@@ -18,7 +18,8 @@ services:
     ports:
       - 8080:8080
       - 9080:9080
-    command: dgraph alpha --my=alpha1:7080 --zero=zero1:5080 --whitelist "10.0.0.0/8,172.0.0.0/8,192.168.0.0/16,127.0.0.1"
+    command: dgraph alpha --my=alpha1:7080 --zero=zero1:5080 
+      --security "whitelist=10.0.0.0/8,172.0.0.0/8,192.168.0.0/16,127.0.0.1;"
 
   ratel:
     image: dgraph/dgraph:${DGRAPH_VERSION}

diff --git a/contrib/config/backups/nfs/docker-compose.yml b/contrib/config/backups/nfs/docker-compose.yml
@@ -7,7 +7,7 @@ services:
     ports:
       - 5080:5080
       - 6080:6080
-    command: dgraph zero --my=zero1:5080 --replicas 1 --raft="idx=1"
+    command: dgraph zero --my=zero1:5080 --replicas 1 --raft="idx=1;"
 
   alpha1:
     image: dgraph/dgraph:${DGRAPH_VERSION}
@@ -16,7 +16,8 @@ services:
     ports:
       - 8080:8080
       - 9080:9080
-    command: dgraph alpha --my=alpha1:7080 --lru_mb=1024 --zero=zero1:5080 --whitelist "10.0.0.0/8,172.0.0.0/8,192.168.0.0/16,127.0.0.1"
+    command: dgraph alpha --my=alpha1:7080 --lru_mb=1024 --zero=zero1:5080 
+      --security "whitelist=10.0.0.0/8,172.0.0.0/8,192.168.0.0/16,127.0.0.1;"
     volumes:
       - type: volume
         source: nfsmount

diff --git a/contrib/config/backups/s3/docker-compose.yml b/contrib/config/backups/s3/docker-compose.yml
@@ -18,7 +18,8 @@ services:
     ports:
       - 8080:8080
       - 9080:9080
-    command: dgraph alpha --my=alpha1:7080 --zero=zero1:5080 --whitelist "10.0.0.0/8,172.0.0.0/8,192.168.0.0/16,127.0.0.1"
+    command: dgraph alpha --my=alpha1:7080 --zero=zero1:5080 
+      --security "whitelist=10.0.0.0/8,172.0.0.0/8,192.168.0.0/16,127.0.0.1;"
 
   ratel:
     image: dgraph/dgraph:${DGRAPH_VERSION}

diff --git a/contrib/config/datadog/docker-compose.yml b/contrib/config/datadog/docker-compose.yml
@@ -14,7 +14,8 @@ services:
       source: $GOPATH/bin
       target: /gobin
       read_only: true
-    command: /gobin/dgraph alpha -o 100 --my=alpha1:7180 --zero=zero1:5080 --logtostderr -v=2 --datadog.collector=datadog:8126 --jaeger.collector=http://jaeger:14268
+    command: /gobin/dgraph alpha -o 100 --my=alpha1:7180 --zero=zero1:5080 --logtostderr -v=2
+      --trace "jaeger=http://jaeger:14268; datadog=datadog:8126;"
   zero1:
     image: dgraph/dgraph:latest
     container_name: zero1
@@ -29,7 +30,8 @@ services:
       source: $GOPATH/bin
       target: /gobin
       read_only: true
-    command: /gobin/dgraph zero -o 0 --raft="idx=1" --my=zero1:5080 --replicas=3 --logtostderr --datadog.collector=datadog:8126 -v=2 --bindall --jaeger.collector=http://jaeger:14268
+    command: /gobin/dgraph zero -o 0 --raft "idx=1;" --my=zero1:5080 --replicas=3 --logtostderr -v=2 --bindall
+      --trace "jaeger=http://jaeger:14268; datadog=datadog:8126;"
   datadog:
     image: datadog/agent:latest
     container_name: datadog

diff --git a/contrib/embargo/embargo.yml b/contrib/embargo/embargo.yml
@@ -17,7 +17,7 @@ containers:
     expose:
       - 5080
       - 6080
-    command: /gobin/dgraph zero --my=zero1:5080 --replicas 3 --raft="idx=1" --bindall --expose_trace --logtostderr -v=3
+    command: /gobin/dgraph zero --my=zero1:5080 --replicas 3 --raft="idx=1;" --bindall --expose_trace --logtostderr -v=3
     volumes:
       # Note: Any environment variables must use the ${} syntax.
       # ${GOPATH} works, $GOPATH does not.
@@ -33,7 +33,7 @@ containers:
     expose:
       - 5082
       - 6082
-    command: /gobin/dgraph zero -o 2 --my=zero2:5082 --replicas 3 --peer=zero1:5080 --raft="idx=2" --bindall --expose_trace --logtostderr -v=3
+    command: /gobin/dgraph zero -o 2 --my=zero2:5082 --replicas 3 --peer=zero1:5080 --raft="idx=2;" --bindall --expose_trace --logtostderr -v=3
     volumes:
       "${GOPATH}/bin": "/gobin"
 
@@ -47,7 +47,7 @@ containers:
     expose:
       - 5083
       - 6083
-    command: /gobin/dgraph zero -o 3 --my=zero3:5083 --replicas 3 --peer=zero1:5080 --raft="idx=3" --bindall --expose_trace --logtostderr -v=3
+    command: /gobin/dgraph zero -o 3 --my=zero3:5083 --replicas 3 --peer=zero1:5080 --raft="idx=3;" --bindall --expose_trace --logtostderr -v=3
     volumes:
       "${GOPATH}/bin": "/gobin"
 
@@ -61,7 +61,8 @@ containers:
     expose:
       - 8180
       - 9180
-    command: /gobin/dgraph alpha --my=dg1:7180 --zero=zero1:5080,zero2:5082,zero3:5083 -o 100 --expose_trace  --trace 1.0 --logtostderr -v=3
+    command: /gobin/dgraph alpha --my=dg1:7180 --zero=zero1:5080,zero2:5082,zero3:5083 -o 100 --expose_trace --logtostderr -v=3
+      --trace "ratio=1.0;"
     volumes:
       "${GOPATH}/bin": "/gobin"
 
@@ -76,7 +77,8 @@ containers:
       - 8182
       - 9182
     start_delay: 8
-    command: /gobin/dgraph alpha --my=dg2:7182 --zero=zero1:5080,zero2:5082,zero3:5083 -o 102 --expose_trace  --trace 1.0 --logtostderr -v=3
+    command: /gobin/dgraph alpha --my=dg2:7182 --zero=zero1:5080,zero2:5082,zero3:5083 -o 102 --expose_trace --logtostderr -v=3
+      --trace "ratio=1.0;"
     volumes:
       "${GOPATH}/bin": "/gobin"
 
@@ -91,7 +93,8 @@ containers:
       - 8183
       - 9183
     start_delay: 16
-    command: /gobin/dgraph alpha --my=dg3:7183 --zero=zero1:5080,zero2:5082,zero3:5083 -o 103 --expose_trace  --trace 1.0 --logtostderr -v=3
+    command: /gobin/dgraph alpha --my=dg3:7183 --zero=zero1:5080,zero2:5082,zero3:5083 -o 103 --expose_trace --logtostderr -v=3
+      --trace "ratio=1.0;"
     volumes:
       "${GOPATH}/bin": "/gobin"
 

diff --git a/contrib/manual_tests/test.sh b/contrib/manual_tests/test.sh
@@ -296,7 +296,7 @@ function test::manual_start_acl() {
   local -r n_alphas=3
 
   dgraph::start_zeros "$n_zeros"
-  dgraph::start_alphas "$n_alphas" --acl_secret_file "$ACL_SECRET_PATH"
+  dgraph::start_alphas "$n_alphas" --acl "secret-file=$ACL_SECRET_PATH;"
 
   for i in $(seq "$n_zeros"); do
     dgraph::healthcheck_zero "$i"
@@ -326,7 +326,7 @@ function test::manual_start_tls() {
   local -r n_alphas=3
 
   dgraph::start_zeros "$n_zeros"
-  dgraph::start_alphas "$n_alphas" --tls_cacert "$TLS_PATH"/ca.crt --tls_node_cert "$TLS_PATH"/node.crt --tls_node_key "$TLS_PATH"/node.key
+  dgraph::start_alphas "$n_alphas" --tls "cacert=$TLS_PATH/ca.crt; node-cert=$TLS_PATH/node.crt; node-key=$TLS_PATH/node.key;"
 
   for i in $(seq "$n_zeros"); do
     dgraph::healthcheck_zero "$i"
@@ -340,7 +340,7 @@ function test::manual_start_tls() {
 
   local count
   for i in $(seq "$n_alphas"); do
-    count="$(dgraph::increment "$i" --tls_cacert "$TLS_PATH"/ca.crt)"
+    count="$(dgraph::increment "$i" --tls "cacert=$TLS_PATH/ca.crt;")"
     if [ "$i" -ne "$count" ]; then
       log::error "Expected increment: $i but got: $count"
       return 1
@@ -358,23 +358,13 @@ function test::manual_start_tls2() {
   for i in $(seq "$n_zeros"); do
     "$DGRAPH_BIN" cert --client "zero$i" --cwd "$DGRAPH_PATH"
     dgraph::start_zero "$i" \
-      --tls_cacert "$TLS_PATH"/ca.crt \
-      --tls_internal_port_enabled \
-      --tls_cert "$TLS_PATH/client.zero$i.crt" \
-      --tls_key "$TLS_PATH/client.zero$i.key" \
-      --tls_node_cert "$TLS_PATH"/node.crt \
-      --tls_node_key "$TLS_PATH"/node.key
+      --tls "cacert=$TLS_PATH/ca.crt; internal-port-enabled=true; cert=$TLS_PATH/client.zero$i.crt; key=$TLS_PATH/client.zero$i.key; node-cert=$TLS_PATH/node.crt; node-key=$TLS_PATH/node.key;"
   done
 
   for i in $(seq "$n_alphas"); do
     "$DGRAPH_BIN" cert --client "alpha$i" --cwd "$DGRAPH_PATH"
     dgraph::start_alpha "$i" \
-      --tls_cacert "$TLS_PATH"/ca.crt \
-      --tls_internal_port_enabled \
-      --tls_cert "$TLS_PATH/client.alpha$i.crt" \
-      --tls_key "$TLS_PATH/client.alpha$i.key" \
-      --tls_node_cert "$TLS_PATH"/node.crt \
-      --tls_node_key "$TLS_PATH"/node.key
+      --tls "cacert=$TLS_PATH/ca.crt; internal-port-enabled=true; cert=$TLS_PATH/client.alpha$i.crt; key=$TLS_PATH/client.alpha$i.key; node-cert=$TLS_PATH/node.crt; node-key=$TLS_PATH/node.key;"
   done
 
   for i in $(seq "$n_zeros"); do
@@ -389,7 +379,7 @@ function test::manual_start_tls2() {
 
   local count
   for i in $(seq "$n_alphas"); do
-    count="$(dgraph::increment "$i" --tls_cacert "$TLS_PATH"/ca.crt)"
+    count="$(dgraph::increment "$i" --tls "cacert=$TLS_PATH/ca.crt;")"
     if [ "$i" -ne "$count" ]; then
       log::error "Expected increment: $i but got: $count"
       return 1
@@ -407,9 +397,9 @@ function test::manual_start_encryption_acl_tls() {
 
   dgraph::start_zeros "$n_zeros"
   dgraph::start_alphas "$n_alphas" \
-    --acl_secret_file "$ACL_SECRET_PATH" \
+    --acl "secret-file=$ACL_SECRET_PATH;" \
     --encryption_key_file "$ENCRYPTION_KEY_PATH" \
-    --tls_cacert "$TLS_PATH"/ca.crt --tls_node_cert "$TLS_PATH"/node.crt --tls_node_key "$TLS_PATH"/node.key
+    --tls "cacert=$TLS_PATH/ca.crt; node-cert=$TLS_PATH/node.crt; node-key=$TLS_PATH/node.key;"
 
   for i in $(seq "$n_zeros"); do
     dgraph::healthcheck_zero "$i"
@@ -423,7 +413,7 @@ function test::manual_start_encryption_acl_tls() {
 
   local count
   for i in $(seq "$n_alphas"); do
-    count="$(dgraph::increment "$i" --tls_cacert "$TLS_PATH"/ca.crt --user groot --password password)"
+    count="$(dgraph::increment "$i" --tls "cacert=$TLS_PATH/ca.crt;" --user groot --password password)"
     if [ "$i" -ne "$count" ]; then
       log::error "Expected increment: $i but got: $count"
       return 1

diff --git a/contrib/tlstest/alpha_tls.sh b/contrib/tlstest/alpha_tls.sh
@@ -1,3 +1,4 @@
 #!/bin/bash
 set -e
-$DGRAPH_BIN alpha --tls_cacert $PWD/tls/ca.crt --tls_node_cert $PWD/tls/node.crt --tls_node_key $PWD/tls/node.key --zero 127.0.0.1:5081 &> alpha.log
+
+$DGRAPH_BIN alpha --tls "cacert=$PWD/tls/ca.crt; node-cert=$PWD/tls/node.crt; node-key=$PWD/tls/node.key;"  --zero 127.0.0.1:5081 &> alpha.log
diff --git a/contrib/tlstest/alpha_tls_auth.sh b/contrib/tlstest/alpha_tls_auth.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 set -e
-$DGRAPH_BIN alpha --tls_cacert $PWD/tls/ca.crt --tls_node_cert $PWD/tls/node.crt --tls_node_key $PWD/tls/node.key --tls_client_auth REQUIREANDVERIFY --zero 127.0.0.1:5081 &> alpha.log
+$DGRAPH_BIN alpha --tls "cacert=$PWD/tls/ca.crt; node-cert=$PWD/tls/node.crt; node-key=$PWD/tls/node.key; client-auth=REQUIREANDVERIFY;" --zero 127.0.0.1:5081 &> alpha.log
diff --git a/contrib/tlstest/live_tls.sh b/contrib/tlstest/live_tls.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 set -e
-$DGRAPH_BIN live -d localhost:9080 --tls_dir $PWD/tls -r data.rdf.gz -z 127.0.0.1:5081
+$DGRAPH_BIN live -d localhost:9080 -r data.rdf.gz -z 127.0.0.1:5081
diff --git a/contrib/tlstest/live_tls_auth.sh b/contrib/tlstest/live_tls_auth.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 set -e
-$DGRAPH_BIN live -d localhost:9080 --tls_dir $PWD/tls --tls_server_name localhost -r data.rdf.gz -z 127.0.0.1:5081
+$DGRAPH_BIN live -d localhost:9080 --tls "server-name=localhost;" -r data.rdf.gz -z 127.0.0.1:5081
diff --git a/contrib/tlstest/server_11.sh b/contrib/tlstest/server_11.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 
-../../dgraph/dgraph alpha --tls_on --tls_ca_certs ca.crt --tls_cert server.crt --tls_cert_key server.key --tls_max_version=TLS11 --zero 127.0.0.1:5080
+../../dgraph/dgraph alpha --tls "cacert=ca.crt; cert=server.crt; key=server.key;" --zero 127.0.0.1:5080
diff --git a/contrib/tlstest/server_nopass.sh b/contrib/tlstest/server_nopass.sh
@@ -1,4 +1,4 @@
 #!/bin/bash
 
-../../dgraph/dgraph alpha --tls_on --tls_ca_certs ca.crt --tls_cert server.crt --tls_cert_key server.key \
+../../dgraph/dgraph alpha --tls "cacert=ca.crt; cert=server.crt; key=server.key" \
 --zero 127.0.0.1:5081 &> dgraph.log
diff --git a/contrib/tlstest/server_nopass_client_auth.sh b/contrib/tlstest/server_nopass_client_auth.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 
-../../dgraph/dgraph alpha --tls_on --tls_ca_certs ca.crt --tls_cert server.crt --tls_cert_key server.key --tls_client_auth REQUIREANDVERIFY --zero 127.0.0.1:5081
+../../dgraph/dgraph alpha --tls "cacert=ca.crt; cert=server.crt; key=server.key; client-auth=REQUIREANDVERIFY;" --zero 127.0.0.1:5081
diff --git a/contrib/tlstest/server_pass.sh b/contrib/tlstest/server_pass.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 
-../../dgraph/dgraph alpha --tls_on --tls_ca_certs ca.crt --tls_cert server_pass.crt --tls_cert_key server_pass.key --tls_cert_key_passphrase secret --zero 127.0.0.1:5081 &> dgraph.log
+../../dgraph/dgraph alpha --tls "cacert=ca.crt; cert=server_pass.crt; key=server_pass.key;" --zero 127.0.0.1:5081 &> dgraph.log