Merge pull request #248 from nullstyle/tls

Add TLS, HTTP/2 support

.gitignore

@@ -6,7 +6,11 @@ docs/public
 /dist
 /vendor/pkg
 /vendor/bin
+/vendor/src
 *.bts
 *.swp
 
 /test.go
+/tls/*.crt
+/tls/*.key
+/tls/*.csr

.travis.yml

@@ -1,10 +1,10 @@
 language: go
 go:
-- '1.5'
 - '1.6'
 - tip
 install:
  - go get github.com/constabulary/gb/...
+ - gb vendor restore
 before_script:
 - psql -c 'create database "horizon_test";' -U postgres
 - psql -c 'create database "stellar-core_test";' -U postgres
@@ -35,4 +35,4 @@ deploy:
  on:
  repo: stellar/horizon
  tags: true
- go: '1.5'
+ go: '1.6'

CHANGELOG.md

@@ -11,6 +11,12 @@ bumps. A breaking change will get clearly notified in this log.
 ### Added
 
 - Add `horizon db migrate [up|down|redo]` commands, used for installing schema migrations. This work is in service of porting the horizon-importer project directly to horizon.
+- Add support for TLS: specify `--tls-cert` and `--tls-key` to enable.
+- Add support for HTTP/2. To enable, use TLS.
+
+### Removed
+
+- BREAKING CHANGE: Removed support for building on go versions lower than 1.6
 
 ## [v0.3.0] - 2016-01-29
 

LICENSE.txt

@@ -262,4 +262,39 @@ COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
 IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
+---
+
+Portions of code take from goauteneg (https://bitbucket.org/ww/goautoneg)
+Licensed as
+
+Copyright (c) 2011, Open Knowledge Foundation Ltd.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
 
+ Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+
+ Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in
+ the documentation and/or other materials provided with the
+ distribution.
+
+ Neither the name of the Open Knowledge Foundation Ltd. nor the
+ names of its contributors may be used to endorse or promote
+ products derived from this software without specific prior written
+ permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

README.md

@@ -20,14 +20,15 @@ Given you have a running golang installation, you can install this with:
 go get -u github.com/constabulary/gb/...
 ```
 
-From within the project directory, simply run `gb build`. After successful
+Next, you must download the source for packages that horizon depends upon. From within the project directory, run:
+
+```bash
+gb vendor restore
+```
+
+Then, simply run `gb build`. After successful
 completion, you should find `bin/horizon` is present in the project directory.
 
 ## Developing Horizon
 
 See [the development guide](docs/developing.md).
-
-
-
-
-

docs/developing.md

@@ -102,5 +102,8 @@ log.WithField("init_name", i.Name).Info("running initializer")
 With the "bad" form of the logging example above, an operator can filter on both the message as well as the initializer name independently. This gets more powerful when multiple fields are combined, allowing for all sorts of slicing and dicing.
 
 
+## <a name="TLS"></a> Enabling TLS on your local workstation
 
+Horizon support HTTP/2 when served using TLS. To enable TLS on your local workstation, you must generate a certificate and configure horizon to use it. We've written a helper script at `tls/regen.sh` to make this simple. Run the script from your terminal, and simply choose all the default options. This will create two files: `tls/server.crt` and `tls/server.key`. 
 
+Now you must configure horizon to use them: You can simply add `--tls-cert tls/server.crt --tls-key tls/server.key` to your command line invocations of horizon, or you may specify `TLS_CERT` and `TLS_KEY` environment variables.

src/github.com/stellar/horizon/app.go

@@ -6,6 +6,7 @@ import (
  "io/ioutil"
  "net/http"
  "runtime"
+ "time"
 
  "github.com/garyburd/redigo/redis"
  "github.com/jmoiron/sqlx"
@@ -18,9 +19,9 @@ import (
  "github.com/stellar/horizon/pump"
  "github.com/stellar/horizon/render/sse"
  "github.com/stellar/horizon/txsub"
- "github.com/zenazn/goji/bind"
- "github.com/zenazn/goji/graceful"
  "golang.org/x/net/context"
+ "golang.org/x/net/http2"
+ "gopkg.in/tylerb/graceful.v1"
 )
 
 var appContextKey = 0
@@ -89,29 +90,40 @@ func (a *App) Serve() {
  a.web.router.Compile()
  http.Handle("/", a.web.router)
 
- listenStr := fmt.Sprintf(":%d", a.config.Port)
- listener := bind.Socket(listenStr)
- log.Infof("Starting horizon on %s", listener.Addr())
+ addr := fmt.Sprintf(":%d", a.config.Port)
 
- graceful.HandleSignals()
- bind.Ready()
- graceful.PreHook(func() {
- log.Info("received signal, gracefully stopping")
- a.Close()
- })
- graceful.PostHook(func() {
- log.Info("stopped")
- })
+ srv := &graceful.Server{
+ Timeout: 10 * time.Second,
+
+ Server: &http.Server{
+ Addr: addr,
+ Handler: http.DefaultServeMux,
+ },
+
+ ShutdownInitiated: func() {
+ log.Info("received signal, gracefully stopping")
+ a.Close()
+ },
+ }
+
+ http2.ConfigureServer(srv.Server, nil)
 
  sse.SetPump(a.pump.Subscribe())
 
- err := graceful.Serve(listener, http.DefaultServeMux)
+ log.Infof("Starting horizon on %s", addr)
+
+ var err error
+ if a.config.TLSCert != "" {
+ err = srv.ListenAndServeTLS(a.config.TLSCert, a.config.TLSKey)
+ } else {
+ err = srv.ListenAndServe()
+ }
 
  if err != nil {
  log.Panic(err)
  }
 
- graceful.Wait()
+ log.Info("stopped")
 }
 
 // Close cancels the app and forces the closure of db connections

src/github.com/stellar/horizon/cmd/horizon/main.go

@@ -43,6 +43,8 @@ func init() {
  viper.BindEnv("sentry-dsn", "SENTRY_DSN")
  viper.BindEnv("loggly-token", "LOGGLY_TOKEN")
  viper.BindEnv("loggly-host", "LOGGLY_HOST")
+ viper.BindEnv("tls-cert", "TLS_CERT")
+ viper.BindEnv("tls-key", "TLS_KEY")
 
  rootCmd = &cobra.Command{
  Use: "horizon",
@@ -132,6 +134,18 @@ func init() {
  "Secret seed for friendbot functionality. When empty, friendbot will be disabled",
  )
 
+ rootCmd.Flags().String(
+ "tls-cert",
+ "",
+ "The TLS certificate file to use for securing connections to horizon",
+ )
+
+ rootCmd.Flags().String(
+ "tls-key",
+ "",
+ "The TLS private key file to use for securing connections to horizon",
+ )
+
  rootCmd.AddCommand(dbCmd)
 
  viper.BindPFlags(rootCmd.Flags())
@@ -158,6 +172,15 @@ func initApp(cmd *cobra.Command, args []string) {
 
  hlog.DefaultLogger.Level = ll
 
+ cert, key := viper.GetString("tls-cert"), viper.GetString("tls-key")
+
+ switch {
+ case cert != "" && key == "":
+ log.Fatal("Invalid TLS config: key not configured")
+ case cert == "" && key != "":
+ log.Fatal("Invalid TLS config: cert not configured")
+ }
+
  config := horizon.Config{
  DatabaseUrl: viper.GetString("db-url"),
  StellarCoreDatabaseUrl: viper.GetString("stellar-core-db-url"),
@@ -172,6 +195,8 @@ func initApp(cmd *cobra.Command, args []string) {
  LogglyToken: viper.GetString("loggly-token"),
  LogglyHost: viper.GetString("loggly-host"),
  FriendbotSecret: viper.GetString("friendbot-secret"),
+ TLSCert: cert,
+ TLSKey: key,
  }
 
  app, err = horizon.NewApp(config)

src/github.com/stellar/horizon/config.go

@@ -21,4 +21,8 @@ type Config struct {
  LogglyHost string
  LogglyToken string
  FriendbotSecret string
+ // TLSCert is a path to a certificate file to use for horizon's TLS config
+ TLSCert string
+ // TLSKey is the path to a private key file to use for horizon's TLS config
+ TLSKey string
 }

tls/localhost.conf

@@ -0,0 +1,17 @@
+[ req ]
+distinguished_name = req_distinguished_name
+
+[ req_distinguished_name ]
+C = US
+C_default = US
+ST = California
+ST_default = California
+L = San Francisco
+L_default = San Francisco
+O = Stellar Development Foundation
+O_default = Stellar Development Foundation
+OU = Engineering
+OU_default = Engineering
+CN = localhost:8000
+CN_default = localhost:8000
+emailAddress_default =

tls/regen.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -e
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+pushd $DIR
+
+openssl genrsa -des3 -passout pass:x -out new.pass.key 2048
+openssl rsa -passin pass:x -in new.pass.key -out new.key
+rm new.pass.key
+openssl req -new -key new.key -out new.csr -config localhost.conf
+openssl x509 -req -days 365 -in new.csr -signkey new.key -out new.crt
+
+mv new.csr server.csr
+mv new.crt server.crt
+mv new.key server.key

vendor/manifest

@@ -25,6 +25,12 @@
  "revision": "278e1ec8e8a6e017cd07577924d6766039146ced",
  "branch": "master"
  },
+ {
+ "importpath": "github.com/codegangsta/negroni",
+ "repository": "https://github.com/codegangsta/negroni",
+ "revision": "c7477ad8e330bef55bf1ebe300cf8aa67c492d1b",
+ "branch": "master"
+ },
  {
  "importpath": "github.com/garyburd/redigo/internal",
  "repository": "https://github.com/garyburd/redigo",
@@ -241,6 +247,12 @@
  "revision": "c8f1db727dfab151b053812d5bbdb584bf56e4af",
  "branch": "master"
  },
+ {
+ "importpath": "github.com/tylerb/graceful",
+ "repository": "https://github.com/tylerb/graceful",
+ "revision": "7116c7a8115899e80197cd9e0b97998c0f97ed8e",
+ "branch": "master"
+ },
  {
  "importpath": "github.com/visionmedia/go-debug",
  "repository": "https://github.com/visionmedia/go-debug",
@@ -250,48 +262,75 @@
  {
  "importpath": "github.com/zenazn/goji",
  "repository": "https://github.com/zenazn/goji",
- "revision": "09c4160eb01c64b5a7d3b8dfd93712828143c4ce",
+ "revision": "bf843a174a08e846246b8945f8a9a853d84a256a",
  "branch": "master"
  },
  {
  "importpath": "github.com/zenazn/goji/bind",
  "repository": "https://github.com/zenazn/goji",
- "revision": "09c4160eb01c64b5a7d3b8dfd93712828143c4ce",
+ "revision": "bf843a174a08e846246b8945f8a9a853d84a256a",
  "branch": "master",
  "path": "/bind"
  },
  {
  "importpath": "github.com/zenazn/goji/graceful",
  "repository": "https://github.com/zenazn/goji",
- "revision": "09c4160eb01c64b5a7d3b8dfd93712828143c4ce",
+ "revision": "bf843a174a08e846246b8945f8a9a853d84a256a",
  "branch": "master",
  "path": "/graceful"
  },
  {
  "importpath": "github.com/zenazn/goji/web",
  "repository": "https://github.com/zenazn/goji",
- "revision": "09c4160eb01c64b5a7d3b8dfd93712828143c4ce",
+ "revision": "bf843a174a08e846246b8945f8a9a853d84a256a",
  "branch": "master",
  "path": "/web"
  },
+ {
+ "importpath": "golang.org/x/crypto/ssh/terminal",
+ "repository": "https://go.googlesource.com/crypto",
+ "revision": "1f22c0103821b9390939b6776727195525381532",
+ "branch": "master",
+ "path": "/ssh/terminal"
+ },
  {
  "importpath": "golang.org/x/net/context",
  "repository": "https://go.googlesource.com/net",
  "revision": "34ff4cd5e6de00702100a0ab3bb73de8de5ab35d",
  "branch": "master",
  "path": "/context"
  },
+ {
+ "importpath": "golang.org/x/net/http2",
+ "repository": "https://go.googlesource.com/net",
+ "revision": "b6d7b1396ec874c3b00f6c84cd4301a17c56c8ed",
+ "branch": "master",
+ "path": "/http2"
+ },
+ {
+ "importpath": "golang.org/x/net/netutil",
+ "repository": "https://go.googlesource.com/net",
+ "revision": "b6d7b1396ec874c3b00f6c84cd4301a17c56c8ed",
+ "branch": "master",
+ "path": "/netutil"
+ },
  {
  "importpath": "gopkg.in/gorp.v1",
  "repository": "https://gopkg.in/gorp.v1",
  "revision": "c87af80f3cc5036b55b83d77171e156791085e2e",
  "branch": "master"
  },
+ {
+ "importpath": "gopkg.in/tylerb/graceful.v1",
+ "repository": "https://gopkg.in/tylerb/graceful.v1",
+ "revision": "119c58e176bce26fd40698146d9a106c8f1723a5",
+ "branch": "master"
+ },
  {
  "importpath": "gopkg.in/yaml.v2",
  "repository": "https://gopkg.in/yaml.v2",
  "revision": "7ad95dd0798a40da1ccdff6dff35fd177b5edf40",
  "branch": "master"
  }
  ]
-}
+}