@routr/pgdata 2.0.29 → 2.1.0

package/dist/envs.d.ts

@@ -1 +1,7 @@
+export declare const TLS_ON: boolean;
+export declare const VERIFY_CLIENT_CERT: boolean;
+export declare const CACERT: string;
+export declare const SERVER_CERT: string;
+export declare const SERVER_KEY: string;
 export declare const BIND_ADDR: string;
+export declare const EXTERNAL_SERVER_BIND_ADDR: string;

package/dist/envs.js

@@ -1,7 +1,7 @@
 "use strict";
-var _a;
+var _a, _b, _c, _d, _e;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BIND_ADDR = void 0;
+exports.EXTERNAL_SERVER_BIND_ADDR = exports.BIND_ADDR = exports.SERVER_KEY = exports.SERVER_CERT = exports.CACERT = exports.VERIFY_CLIENT_CERT = exports.TLS_ON = void 0;
 /*
  * Copyright (C) 2023 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster
@@ -22,4 +22,17 @@ exports.BIND_ADDR = void 0;
  */
 const common_1 = require("@routr/common");
 common_1.Assertions.assertEnvsAreSet(["DATABASE_URL"]);
-exports.BIND_ADDR = (_a = process.env.BIND_ADDR) !== null && _a !== void 0 ? _a : "0.0.0.0:51907";
+exports.TLS_ON = process.env.TLS_ON === "true";
+exports.VERIFY_CLIENT_CERT = process.env.VERIFY_CLIENT_CERT === "true";
+exports.CACERT = (_a = process.env.CACERT) !== null && _a !== void 0 ? _a : "/etc/routr/certs/ca.crt";
+exports.SERVER_CERT = (_b = process.env.SERVER_CERT) !== null && _b !== void 0 ? _b : "/etc/routr/certs/server.crt";
+exports.SERVER_KEY = (_c = process.env.SERVER_KEY) !== null && _c !== void 0 ? _c : "/etc/routr/certs/server.key";
+exports.BIND_ADDR = (_d = process.env.BIND_ADDR) !== null && _d !== void 0 ? _d : "0.0.0.0:51907";
+exports.EXTERNAL_SERVER_BIND_ADDR = (_e = process.env.EXTERNAL_SERVER_BIND_ADDR) !== null && _e !== void 0 ? _e : "0.0.0.0:51908";
+if (exports.TLS_ON) {
+    if (exports.VERIFY_CLIENT_CERT) {
+        common_1.Assertions.assertFileExist(exports.CACERT);
+    }
+    common_1.Assertions.assertFileExist(exports.SERVER_CERT);
+    common_1.Assertions.assertFileExist(exports.SERVER_KEY);
+}

package/dist/runner.js

@@ -29,7 +29,10 @@ const envs_1 = require("./envs");
 const service_1 = __importDefault(require("./service"));
 const logger = (0, logger_1.getLogger)({ service: "pgdata", filePath: __filename });
 try {
-    (0, service_1.default)({ bindAddr: envs_1.BIND_ADDR });
+    (0, service_1.default)({
+        bindAddr: envs_1.BIND_ADDR,
+        externalServerBindAddr: envs_1.EXTERNAL_SERVER_BIND_ADDR
+    });
 }
 catch (e) {
     logger.error(e);

package/dist/service.js

@@ -22,6 +22,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
     __setModuleDefault(result, mod);
     return result;
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 /*
  * Copyright (C) 2023 by Fonoster Inc (https://fonoster.com)
@@ -52,6 +55,8 @@ const delete_1 = require("./api/delete");
 const find_1 = require("./api/find");
 const list_1 = require("./api/list");
 const grpc_health_check_1 = require("@fonoster/grpc-health-check");
+const envs_1 = require("./envs");
+const fs_1 = __importDefault(require("fs"));
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const interceptor = require("grpc-interceptors");
 const prisma = new client_1.PrismaClient();
@@ -64,7 +69,8 @@ const logger = (0, logger_1.getLogger)({ service: "pgdata", filePath: __filename
 function pgDataService(config) {
     const { bindAddr } = config;
     logger.info("starting routr service", { bindAddr, name: "pgdata" });
-    const server = new grpc.Server();
+    const internalServer = new grpc.Server();
+    const externalServer = new grpc.Server();
     const kinds = [
         common_1.CommonConnect.Kind.AGENT,
         common_1.CommonConnect.Kind.CREDENTIALS,
@@ -77,19 +83,50 @@ function pgDataService(config) {
     kinds.forEach((kind) => {
         const k = kind.toLowerCase();
         const delegate = prisma[kind];
-        server.addService(common_1.CommonConnect.createConnectService(k), {
+        const funcs = {
             create: (0, create_1.create)(delegate.create, k),
             get: (0, get_1.get)(delegate.findUnique, k),
             findBy: (0, find_1.findBy)(delegate.findMany, k),
             delete: (0, delete_1.del)(delegate.delete),
             update: (0, update_1.update)(delegate.update, k),
             list: (0, list_1.list)(delegate.findMany, k)
-        });
+        };
+        internalServer.addService(common_1.CommonConnect.createConnectService(k), funcs);
+        externalServer.addService(common_1.CommonConnect.createConnectService(k), funcs);
     });
     const credentials = grpc.ServerCredentials.createInsecure();
-    const withHealthChecks = interceptor.serverProxy((0, grpc_health_check_1.useHealth)(server));
+    const withHealthChecks = interceptor.serverProxy((0, grpc_health_check_1.useHealth)(internalServer));
     withHealthChecks.bindAsync(config.bindAddr, credentials, () => {
+        logger.info("internal server started", { bindAddr: config.bindAddr });
         withHealthChecks.start();
     });
+    if (envs_1.TLS_ON) {
+        const cacert = envs_1.VERIFY_CLIENT_CERT ? fs_1.default.readFileSync(envs_1.CACERT) : null;
+        const cert = fs_1.default.readFileSync(envs_1.SERVER_CERT);
+        const key = fs_1.default.readFileSync(envs_1.SERVER_KEY);
+        const externalCredentials = grpc.ServerCredentials.createSsl(
+        // By default the server does not ask for the client's certificate.
+        cacert, [
+            {
+                cert_chain: cert,
+                private_key: key
+            }
+        ], envs_1.VERIFY_CLIENT_CERT);
+        externalServer.bindAsync(config.externalServerBindAddr, externalCredentials, () => {
+            logger.info("external server started", {
+                externalServerBindAddr: config.externalServerBindAddr
+            });
+            externalServer.start();
+        });
+    }
+    else {
+        externalServer.bindAsync(config.externalServerBindAddr, credentials, () => {
+            logger.info("secure connection disabled");
+            logger.info("external server started", {
+                externalServerBindAddr: config.externalServerBindAddr
+            });
+            externalServer.start();
+        });
+    }
 }
 exports.default = pgDataService;

package/dist/types.d.ts

@@ -2,6 +2,7 @@ import { CommonConnect as CC } from "@routr/common";
 import { JsonObject } from "pb-util/build";
 export interface PostgresDataConfig {
     bindAddr: string;
+    externalServerBindAddr: string;
 }
 export type DBDelegate = Exclude<Exclude<CC.Kind, CC.Kind.UNKNOWN>, CC.Kind.ACL> | "accessControlList";
 export type PrismaOperation = (request: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@routr/pgdata",
-  "version": "2.0.29",
+  "version": "2.1.0",
   "description": "Postgres API Server for Routr Connect",
   "author": "Pedro Sanders <psanders@fonoster.com>",
   "homepage": "https://github.com/fonoster/routr#readme",
@@ -31,8 +31,8 @@
     "@opentelemetry/sdk-trace-node": "^1.0.4",
     "@opentelemetry/semantic-conventions": "^1.0.4",
     "@prisma/client": "^4.8.0",
-    "@routr/common": "^2.0.20",
-    "@routr/processor": "^2.0.20",
+    "@routr/common": "^2.1.0",
+    "@routr/processor": "^2.1.0",
     "google-protobuf": "^3.9.2",
     "grpc-interceptors": "github:fonoster/node-grpc-interceptors",
     "pb-util": "^1.0.3",
@@ -57,5 +57,5 @@
     "@types/validator": "^13.7.10",
     "prisma": "^4.8.0"
   },
-  "gitHead": "59b95dfd079d17c604be42e8c4d2d428506a06a3"
+  "gitHead": "0e75c7950157dcb7701082655259a87da322c29d"
 }