fix(autotls): store certificates at the location from the repo path (#10566)
* fix(autotls): store certificates at the location from the repo path * docs(autotls): cert storale and other caveats --------- Co-authored-by: Marcin Rataj <lidel@lidel.org>
Adin Schmahmann committed
Oct 30, 2024 at 18:23 UTC
1ca0ae0af696ad379a654ebadbb3a7c347702d14
3 files changed
+11
-8
core/node/groups.go
+1
-1
@@ -152,7 +152,7 @@ func LibP2P(bcfg *BuildCfg, cfg *config.Config, userResourceOverrides rcmgr.Part
152
153
// Services (resource management)
154
fx.Provide(libp2p.ResourceManager(bcfg.Repo.Path(), cfg.Swarm, userResourceOverrides)),
155
- maybeProvide(libp2p.P2PForgeCertMgr(cfg.AutoTLS), enableAutoTLS),
155
+ maybeProvide(libp2p.P2PForgeCertMgr(bcfg.Repo.Path(), cfg.AutoTLS), enableAutoTLS),
156
maybeInvoke(libp2p.StartP2PAutoTLS, enableAutoTLS),
157
fx.Provide(libp2p.AddrFilters(cfg.Swarm.AddrFilters)),
158
fx.Provide(libp2p.AddrsFactory(cfg.Addresses.Announce, cfg.Addresses.AppendAnnounce, cfg.Addresses.NoAnnounce)),
core/node/libp2p/addrs.go
+3
-5
@@ -4,6 +4,7 @@ import (
4
"context"
5
"fmt"
6
"os"
7
+ "path/filepath"
8
9
logging "github.com/ipfs/go-log"
10
version "github.com/ipfs/kubo"
@@ -132,12 +133,9 @@ func ListenOn(addresses []string) interface{} {
133
}
134
}
135
135
-func P2PForgeCertMgr(cfg config.AutoTLS) interface{} {
136
+func P2PForgeCertMgr(repoPath string, cfg config.AutoTLS) interface{} {
137
return func() (*p2pforge.P2PForgeCertMgr, error) {
137
- storagePath, err := config.Path("", "p2p-forge-certs")
138
- if err != nil {
139
- return nil, err
140
- }
138
+ storagePath := filepath.Join(repoPath, "p2p-forge-certs")
139
140
forgeLogger := logging.Logger("autotls").Desugar()
141
certStorage := &certmagic.FileStorage{Path: storagePath}
docs/config.md
+7
-2
@@ -512,7 +512,8 @@ Kubo will obtain and set up a trusted PKI TLS certificate for it, making it dial
512
> - Right now, this is NOT used for hosting a [Gateway](#gateway) over HTTPS (that use case still requires manual TLS setup on reverse proxy, and your own domain).
513
514
> [!TIP]
515
-> Debugging can be enabled by setting environment variable `GOLOG_LOG_LEVEL="error,autotls=debug,p2p-forge/client=debug"`
515
+> - Debugging can be enabled by setting environment variable `GOLOG_LOG_LEVEL="error,autotls=debug,p2p-forge/client=debug"`
516
+> - Certificates are stored in `$IPFS_PATH/p2p-forge-certs`. Removing directory and restarting daemon will trigger certificate rotation.
517
518
Default: `false`
519
@@ -530,7 +531,7 @@ Type: `optionalString`
531
### `AutoTLS.RegistrationEndpoint`
532
533
Optional override of [p2p-forge] HTTP registration API.
533
-Do not change this unless you self-host [p2p-forge].
534
+Do not change this unless you self-host [p2p-forge] under own domain.
535
536
> [!IMPORTANT]
537
> The default endpoint performs [libp2p Peer ID Authentication over HTTP](https://github.com/libp2p/specs/blob/master/http/peer-id-auth.md)
@@ -553,6 +554,10 @@ Type: `optionalString`
554
### `AutoTLS.CAEndpoint`
555
556
Optional override of CA ACME API used by [p2p-forge] system.
557
+Do not change this unless you self-host [p2p-forge] under own domain.
558
+
559
+> [!IMPORTANT]
560
+> CAA DNS record at `libp2p.direct` limits CA choice to Let's Encrypt. If you want to use a different CA, use your own domain.
561
562
Default: [certmagic.LetsEncryptProductionCA](https://pkg.go.dev/github.com/caddyserver/certmagic#pkg-constants) (see [community.letsencrypt.org discussion](https://community.letsencrypt.org/t/feedback-on-raising-certificates-per-registered-domain-to-enable-peer-to-peer-networking/223003))
563