itsi-scheduler 0.1.5 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 75599726844e215e80b59ae8a95549e23024e4e070d768ca3f085a8fbb2591a9
-  data.tar.gz: c84726c45c08562ad4b8ebd4a6c9eb4ebd1f50521afca027c1e6a69d8b2e4eb5
+  metadata.gz: 99068f8e1de5eaf0356cdca96b782057b00f5bb2897dead89c8002965b022ca5
+  data.tar.gz: 9ab053795e3729a6749e922a3c05e3d1a6a1ae12fc1a921621395145769254f8
 SHA512:
-  metadata.gz: 0a944a2d952111520bf473853ec7b363ed16a53ddf4b0ae252c0fab36d70b4dedb561d55feab827d34c21b0d468cb6b0e978dba22584bc873092cc3d9515a7af
-  data.tar.gz: 5e27924c41ebc8f6b84f8d1e507ff04d3d86d8326c2da21ca2cbe4b1fc703b7bd0026813cf8353775e126d562e25cae93ed8c03f714b07eb48c4d3e15b91fc94
+  metadata.gz: 8113fb04806ed96010b689545a9bafd291d04628bc796d4daaa0a5ad15e227505c4891e7e35acb6071574da095f9bfd6413977140414ebf0588156b1694a7b34
+  data.tar.gz: fb9c01e20b26ccdf80755d22c05c6fcd9423716a9bc37ade709e0a01039d0a3640342b01c754c8b6fc7ad5f54a2d68ce0670c82e6d1a2f1eb988c950674bda12

data/ext/itsi_server/src/server/serve_strategy/single_mode.rs

@@ -83,7 +83,7 @@ impl SingleMode {
         Ok(())
     }
 
-    #[instrument(parent=None, skip(self))]
+    #[instrument(parent=None, skip(self), fields(pid=format!("{}", Pid::this())))]
     pub fn run(self: Arc<Self>) -> Result<()> {
         let mut listener_task_set = JoinSet::new();
         let self_ref = Arc::new(self);

data/ext/itsi_server/src/server/tls/locked_dir_cache.rs

@@ -1,6 +1,8 @@
 use async_trait::async_trait;
-use fs2::FileExt; // for lock_exclusive, unlock
-use std::fs::OpenOptions;
+use fs2::FileExt;
+use parking_lot::Mutex;
+use std::env;
+use std::fs::{self, OpenOptions};
 use std::io::Error as IoError;
 use std::path::{Path, PathBuf};
 use tokio_rustls_acme::caches::DirCache;
@@ -10,25 +12,57 @@ use tokio_rustls_acme::{AccountCache, CertCache};
 pub struct LockedDirCache<P: AsRef<Path> + Send + Sync> {
     inner: DirCache<P>,
     lock_path: PathBuf,
+    current_lock: Mutex<Option<std::fs::File>>,
 }
 
 impl<P: AsRef<Path> + Send + Sync> LockedDirCache<P> {
     pub fn new(dir: P) -> Self {
         let dir_path = dir.as_ref().to_path_buf();
-        let lock_path = dir_path.join(".acme.lock");
+        std::fs::create_dir_all(&dir_path).unwrap();
+        let lock_path =
+            dir_path.join(env::var("ITSI_ACME_LOCK_FILE_NAME").unwrap_or(".acme.lock".to_string()));
+        Self::touch_file(&lock_path).expect("Failed to create lock file");
+
         Self {
             inner: DirCache::new(dir),
             lock_path,
+            current_lock: Mutex::new(None),
         }
     }
 
-    fn lock_exclusive(&self) -> Result<std::fs::File, IoError> {
+    fn touch_file(path: &PathBuf) -> std::io::Result<()> {
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent)?;
+        }
+        fs::OpenOptions::new()
+            .create(true)
+            .write(true)
+            .truncate(true)
+            .open(path)?;
+        Ok(())
+    }
+
+    fn lock_exclusive(&self) -> Result<(), IoError> {
+        if self.current_lock.lock().is_some() {
+            return Ok(());
+        }
+
+        if let Some(parent) = self.lock_path.parent() {
+            std::fs::create_dir_all(parent)?;
+        }
         let lockfile = OpenOptions::new()
+            .create(true)
             .write(true)
             .truncate(true)
             .open(&self.lock_path)?;
         lockfile.lock_exclusive()?;
-        Ok(lockfile)
+        *self.current_lock.lock() = Some(lockfile);
+        Ok(())
+    }
+
+    fn unlock(&self) -> Result<(), IoError> {
+        self.current_lock.lock().take();
+        Ok(())
     }
 }
 
@@ -41,8 +75,14 @@ impl<P: AsRef<Path> + Send + Sync> CertCache for LockedDirCache<P> {
         domains: &[String],
         directory_url: &str,
     ) -> Result<Option<Vec<u8>>, Self::EC> {
-        // Just delegate to the inner DirCache
-        self.inner.load_cert(domains, directory_url).await
+        self.lock_exclusive()?;
+        let result = self.inner.load_cert(domains, directory_url).await;
+
+        if let Ok(Some(_)) = result {
+            self.unlock()?;
+        }
+
+        result
     }
 
     async fn store_cert(
@@ -52,13 +92,14 @@ impl<P: AsRef<Path> + Send + Sync> CertCache for LockedDirCache<P> {
         cert: &[u8],
     ) -> Result<(), Self::EC> {
         // Acquire the lock before storing
-        let lockfile = self.lock_exclusive()?;
+        self.lock_exclusive()?;
 
         // Perform the store operation
         let result = self.inner.store_cert(domains, directory_url, cert).await;
 
-        // Unlock and return
-        let _ = fs2::FileExt::unlock(&lockfile);
+        if let Ok(()) = result {
+            self.unlock()?;
+        }
         result
     }
 }
@@ -72,6 +113,7 @@ impl<P: AsRef<Path> + Send + Sync> AccountCache for LockedDirCache<P> {
         contact: &[String],
         directory_url: &str,
     ) -> Result<Option<Vec<u8>>, Self::EA> {
+        self.lock_exclusive()?;
         self.inner.load_account(contact, directory_url).await
     }
 
@@ -81,14 +123,10 @@ impl<P: AsRef<Path> + Send + Sync> AccountCache for LockedDirCache<P> {
         directory_url: &str,
         account: &[u8],
     ) -> Result<(), Self::EA> {
-        let lockfile = self.lock_exclusive()?;
+        self.lock_exclusive()?;
 
-        let result = self
-            .inner
+        self.inner
             .store_account(contact, directory_url, account)
-            .await;
-
-        let _ = fs2::FileExt::unlock(&lockfile);
-        result
+            .await
     }
 }

data/ext/itsi_server/src/server/tls.rs

@@ -3,7 +3,10 @@ use itsi_error::Result;
 use itsi_tracing::info;
 use locked_dir_cache::LockedDirCache;
 use rcgen::{CertificateParams, DnType, KeyPair, SanType};
-use rustls::pki_types::{CertificateDer, PrivateKeyDer};
+use rustls::{
+    pki_types::{CertificateDer, PrivateKeyDer},
+    ClientConfig, RootCertStore,
+};
 use rustls_pemfile::{certs, pkcs8_private_keys};
 use std::{
     collections::HashMap,
@@ -49,10 +52,41 @@ pub fn configure_tls(
                 domains = format!("{:?}", domains),
                 directory_url, "Requesting acme cert"
             );
+
+            let mut root_cert_store = RootCertStore::empty();
+            if let Ok(ca_pem_path) = env::var("ITSI_ACME_CA_PEM_PATH") {
+                let ca_pem = fs::read(ca_pem_path).expect("failed to read CA pem file");
+                let mut ca_reader = BufReader::new(&ca_pem[..]);
+                let der_certs: Vec<CertificateDer> = certs(&mut ca_reader)
+                    .collect::<std::result::Result<Vec<CertificateDer>, _>>()
+                    .map_err(|e| {
+                        itsi_error::ItsiError::ArgumentError(format!(
+                            "Invalid ACME CA Pem path {:?}",
+                            e
+                        ))
+                    })?;
+                root_cert_store.add_parsable_certificates(der_certs);
+            }
+
+            let client_config = ClientConfig::builder()
+                .with_root_certificates(root_cert_store)
+                .with_no_client_auth();
+
+            let contact_email = env::var("ITSI_ACME_CONTACT_EMAIL").map_err(|_| {
+                itsi_error::ItsiError::ArgumentError(
+                    "ITSI_ACME_CONTACT_EMAIL must be set before you can auto-generate production certificates"
+                        .to_string(),
+                )
+            })?;
+
+            let cache_dir = env::var("ITSI_ACME_CACHE_DIR")
+                .unwrap_or_else(|_| "./.rustls_acme_cache".to_string());
+
             let acme_state = AcmeConfig::new(domains)
-                .contact(["mailto:wc@pico.net.nz"])
-                .cache(LockedDirCache::new("./rustls_acme_cache"))
+                .contact([format!("mailto:{}", contact_email)])
+                .cache(LockedDirCache::new(cache_dir))
                 .directory(directory_url)
+                .client_tls_config(Arc::new(client_config))
                 .state();
             let rustls_config = ServerConfig::builder()
                 .with_no_client_auth()

data/lib/itsi/scheduler/version.rb

@@ -2,6 +2,6 @@
 
 module Itsi
   class Scheduler
-    VERSION = "0.1.5"
+    VERSION = "0.1.6"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: itsi-scheduler
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.6
 platform: ruby
 authors:
 - Wouter Coppieters