Enable https on proxys backend connection

scripts/start.sh.in

@@ -187,7 +187,7 @@ $UH_CLUSTER entrypoint &> $log_dir/entrypoint.log &
 pid_entrypoint=$!
 
 export OTEL_RESOURCE_ATTRIBUTES="service.name=proxy"
-$UH_CLUSTER --downstream-port 8080 --downstream-host localhost proxy &> $log_dir/proxy.log &
+$UH_CLUSTER --downstream-port 8080 --downstream-host localhost --downstream-insecure proxy &> $log_dir/proxy.log &
 pid_proxy=$!
 
 get_running_processes() {

src/common/utils/common.h

@@ -89,9 +89,12 @@ constexpr const char* ENV_CFG_ETCD_PASSWORD = "UH_ETCD_PASSWORD";
 constexpr const char* ENV_CFG_NO_DEDUPE = "UH_NO_DEDUPE";
 constexpr const char* ENV_CFG_STORAGE_SERVICE_ID = "UH_STORAGE_INSTANCE_ID";
 constexpr const char* ENV_CFG_STORAGE_GROUP_ID = "UH_STORAGE_GROUP_ID";
+constexpr const char* ENV_CFG_DOWNSTREAM_INSECURE = "UH_DOWNSTREAM_INSECURE";
+constexpr const char* ENV_CFG_DOWNSTREAM_CERT_FILE = "UH_DOWNSTREAM_CERT_FILE";
 constexpr const char* ENV_CFG_DOWNSTREAM_HOST = "UH_DOWNSTREAM_HOST";
 constexpr const char* ENV_CFG_DOWNSTREAM_PORT = "UH_DOWNSTREAM_PORT";
-constexpr const char* ENV_CFG_DOWNSTREAM_CONNECTIONS = "UH_DOWNSTREAM_CONNECTIONS";
+constexpr const char* ENV_CFG_DOWNSTREAM_CONNECTIONS =
+    "UH_DOWNSTREAM_CONNECTIONS";
 
 constexpr const char* RESERVED_BUCKET_NAME = "ultihash";
 

src/config/configuration.cpp

@@ -247,6 +247,12 @@ CLI::App* sub_coordinator(CLI::App& app, coordinator_config& cfg) {
 
 CLI::App* sub_proxy(CLI::App& app, proxy::config& cfg) {
     auto* rv = app.add_subcommand("proxy", "S3 proxy server");
+    app.add_flag("--downstream-insecure", cfg.downstream_insecure,
+                 "downstream uses http, instead of https")
+        ->envname(ENV_CFG_DOWNSTREAM_INSECURE);
+    app.add_option("--downstream-cert-file", cfg.downstream_cert_file,
+                   "downstream certification file path")
+        ->envname(ENV_CFG_DOWNSTREAM_CERT_FILE);
     app.add_option("--downstream-host", cfg.downstream_host, "downstream host")
         ->envname(ENV_CFG_DOWNSTREAM_HOST);
     app.add_option("--downstream-port", cfg.downstream_port, "downstream port")

src/proxy/CMakeLists.txt

@@ -1,2 +1,3 @@
-add_library(proxy service.cpp forward_stream.cpp request_factory.cpp handler.cpp)
-target_link_libraries(proxy types utils network entrypoint)
+find_package(OpenSSL REQUIRED)
+add_library(proxy service.cpp request_factory.cpp)
+target_link_libraries(proxy types utils network entrypoint OpenSSL::SSL OpenSSL::Crypto)

src/proxy/config.h

@@ -6,11 +6,10 @@
 namespace uh::cluster::proxy {
 
 struct config {
-    server_config server = {
-        .port = 8088,
-        .bind_address = "0.0.0.0"
-    };
+    server_config server = {.port = 8088, .bind_address = "0.0.0.0"};
 
+    bool downstream_insecure;
+    std::optional<std::string> downstream_cert_file;
     std::string downstream_host;
     uint16_t downstream_port;
     std::size_t connections = 16;

src/proxy/forward_stream.h

@@ -1,30 +1,40 @@
 #pragma once
 
+#include <common/telemetry/log.h>
 #include <entrypoint/http/stream.h>
 
 namespace uh::cluster::proxy {
 
 /**
  * Copy read data to additional socket.
  */
+template <typename OutgoingStream>
 class forward_stream : public ep::http::socket_stream {
 public:
     /**
      * Create a stream that reads incoming data from `s` and forwards
      * it to the configured downstream socket `to`.
      */
-    forward_stream(boost::asio::ip::tcp::socket& s,
-                   boost::asio::ip::tcp::socket& to,
-                   std::size_t buffer_size = 4 * MEBI_BYTE);
+    forward_stream(boost::asio::ip::tcp::socket& s, OutgoingStream& to,
+                   std::size_t buffer_size = 4 * MEBI_BYTE)
+        : socket_stream(s, buffer_size),
+          m_to(to) {}
 
-    coro<void> consume() override;
+    coro<void> consume() override {
+        if (m_mode == forwarding) {
+            co_await boost::asio::async_write(m_to,
+                                              boost::asio::buffer(buffer()));
+        }
+
+        co_await socket_stream::consume();
+    }
 
     enum mode { forwarding, deleting };
 
-    void set_mode(mode m);
+    void set_mode(mode m) { m_mode = m; }
 
 private:
-    boost::asio::ip::tcp::socket& m_to;
+    OutgoingStream& m_to;
     mode m_mode = deleting;
 };