Build the plain (un-intercepted) gRPC channel. When the endpoint uses `https://`, mTLS is configured using these env vars: - `OPENSHELL_TLS_CA` -- path to the CA certificate - `OPENSHELL_TLS_CERT` -- path to the client certificate - `OPENSHELL_TLS_KEY` -- path to the client private key When the endpoint uses `http://`, a plaintext connection is used (for deployments where TLS is disabled, e.g. b
(endpoint: &str)
| 132 | /// When the endpoint uses `http://`, a plaintext connection is used (for |
| 133 | /// deployments where TLS is disabled, e.g. behind a Cloudflare Tunnel). |
| 134 | async fn build_plain_channel(endpoint: &str) -> Result<Channel> { |
| 135 | let mut ep = Endpoint::from_shared(endpoint.to_string()) |
| 136 | .into_diagnostic() |
| 137 | .wrap_err("invalid gRPC endpoint")? |
| 138 | .connect_timeout(Duration::from_secs(10)) |
| 139 | .http2_keep_alive_interval(Duration::from_secs(10)) |
| 140 | .keep_alive_while_idle(true) |
| 141 | .keep_alive_timeout(Duration::from_secs(20)) |
| 142 | // Match the gateway-side HTTP/2 flow control (see `multiplex.rs`). |
| 143 | // Adaptive sizing lets idle streams stay tiny while bulk |
| 144 | // RelayStream data flows get a BDP-sized window. |
| 145 | .http2_adaptive_window(true); |
| 146 | |
| 147 | let tls_enabled = endpoint.starts_with("https://"); |
| 148 | |
| 149 | if tls_enabled { |
| 150 | let ca_path = std::env::var(sandbox_env::TLS_CA) |
| 151 | .into_diagnostic() |
| 152 | .wrap_err("OPENSHELL_TLS_CA is required")?; |
| 153 | let cert_path = std::env::var(sandbox_env::TLS_CERT) |
| 154 | .into_diagnostic() |
| 155 | .wrap_err("OPENSHELL_TLS_CERT is required")?; |
| 156 | let key_path = std::env::var(sandbox_env::TLS_KEY) |
| 157 | .into_diagnostic() |
| 158 | .wrap_err("OPENSHELL_TLS_KEY is required")?; |
| 159 | |
| 160 | let ca_pem = std::fs::read(&ca_path) |
| 161 | .into_diagnostic() |
| 162 | .wrap_err_with(|| format!("failed to read CA cert from {ca_path}"))?; |
| 163 | let cert_pem = std::fs::read(&cert_path) |
| 164 | .into_diagnostic() |
| 165 | .wrap_err_with(|| format!("failed to read client cert from {cert_path}"))?; |
| 166 | let key_pem = std::fs::read(&key_path) |
| 167 | .into_diagnostic() |
| 168 | .wrap_err_with(|| format!("failed to read client key from {key_path}"))?; |
| 169 | |
| 170 | let tls_config = ClientTlsConfig::new() |
| 171 | .ca_certificate(Certificate::from_pem(ca_pem)) |
| 172 | .identity(Identity::from_pem(cert_pem, key_pem)); |
| 173 | |
| 174 | ep = ep |
| 175 | .tls_config(tls_config) |
| 176 | .into_diagnostic() |
| 177 | .wrap_err("failed to configure TLS")?; |
| 178 | } |
| 179 | |
| 180 | ep.connect() |
| 181 | .await |
| 182 | .into_diagnostic() |
| 183 | .wrap_err("failed to connect to OpenShell server") |
| 184 | } |
| 185 | |
| 186 | /// Build a Bearer-authenticated channel to the gateway. |
| 187 | /// |
no test coverage detected