(listen, gatewayHost, upstreamHost, upstreamAddr, caOut, logOut, readyOut string)
| 72 | } |
| 73 | |
| 74 | func run(listen, gatewayHost, upstreamHost, upstreamAddr, caOut, logOut, readyOut string) error { |
| 75 | for name, value := range map[string]string{ |
| 76 | "-upstream-addr": upstreamAddr, |
| 77 | "-ca-out": caOut, |
| 78 | "-log": logOut, |
| 79 | } { |
| 80 | if value == "" { |
| 81 | return fmt.Errorf("%s is required", name) |
| 82 | } |
| 83 | } |
| 84 | |
| 85 | rec, err := newRecorder(logOut) |
| 86 | if err != nil { |
| 87 | return fmt.Errorf("opening log: %w", err) |
| 88 | } |
| 89 | defer rec.Close() |
| 90 | |
| 91 | proxy := newProxy(gatewayHost, &url.URL{Scheme: "https", Host: upstreamHost}, upstreamAddr, rec) |
| 92 | |
| 93 | // Bind before writing the CA out, so a gateway that cannot start does not |
| 94 | // replace the CA that a running one is serving with. |
| 95 | tcpListener, err := net.Listen("tcp", listen) |
| 96 | if err != nil { |
| 97 | return fmt.Errorf("listening on %s: %w", listen, err) |
| 98 | } |
| 99 | |
| 100 | caPEM, serverCert, err := generateCertificates(gatewayHost) |
| 101 | if err != nil { |
| 102 | return fmt.Errorf("generating certificates: %w", err) |
| 103 | } |
| 104 | if err := os.WriteFile(caOut, caPEM, 0o600); err != nil { |
| 105 | return fmt.Errorf("writing CA certificate: %w", err) |
| 106 | } |
| 107 | |
| 108 | tlsListener := tls.NewListener(tcpListener, &tls.Config{ |
| 109 | Certificates: []tls.Certificate{serverCert}, |
| 110 | MinVersion: tls.VersionTLS12, |
| 111 | }) |
| 112 | |
| 113 | if readyOut != "" { |
| 114 | if err := os.WriteFile(readyOut, []byte(listen), 0o600); err != nil { |
| 115 | return fmt.Errorf("writing ready file: %w", err) |
| 116 | } |
| 117 | } |
| 118 | |
| 119 | log.Printf("gateway listening on %s as %s, forwarding to %s at %s", listen, gatewayHost, upstreamHost, upstreamAddr) |
| 120 | |
| 121 | server := &http.Server{ |
| 122 | Handler: recordingHandler(proxy, rec), |
| 123 | ReadHeaderTimeout: 30 * time.Second, |
| 124 | } |
| 125 | return server.Serve(tlsListener) |
| 126 | } |
| 127 | |
| 128 | // recordingHandler attaches a record to the request context so the proxy can |
| 129 | // fill in the outcome, then writes exactly one line per request once the proxy |
no test coverage detected