refactor keyless codes
Kim committed
Mar 6, 2026 at 13:56 UTC
8327a4ad97d8423cc416ccfca08fb88d1ede09ca
6 files changed
+18
-16
cmd/demo-app/main.go
+1
-1
@@ -43,7 +43,7 @@ func main() {
43
log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stdout, TimeFormat: time.RFC3339})
44
logger := log.With().Str("component", "demo-app").Logger()
45
46
- flag.StringVar(&flagServerURL, "server-url", "https://gosunuts.xyz", "relay API URL (https only)")
46
+ flag.StringVar(&flagServerURL, "server-url", "https://localhost:4017", "relay API URL (https only)")
47
flag.IntVar(&flagPort, "port", 8092, "local demo HTTP port")
48
flag.StringVar(&flagName, "name", "demo-app", "backend display name")
49
flag.StringVar(&flagDesc, "description", "Portal demo connectivity app", "lease description")
cmd/relay-server/serve.go
+1
-1
@@ -63,7 +63,7 @@ func runServer(cfg relayServerConfig) error {
63
}
64
return signer.Handler()
65
}(),
66
- APITLS: portal.TLSMaterialConfig{
66
+ APITLS: keyless.TLSMaterialConfig{
67
CertPEM: mustRead(certFile),
68
KeyPEM: mustRead(keyFile),
69
},
portal/keyless/client.go
+3
-3
@@ -12,7 +12,7 @@ import (
12
"strings"
13
"time"
14
15
- keylesslib "github.com/gosuda/keyless_tls/keyless"
15
+ keylesstls "github.com/gosuda/keyless_tls/keyless"
16
)
17
18
func BuildClientTLSConfig(relayURL string, domains []string) (*tls.Config, ioCloser, error) {
@@ -40,7 +40,7 @@ func BuildClientTLSConfig(relayURL string, domains []string) (*tls.Config, ioClo
40
}
41
}
42
43
- remoteSigner, err := keylesslib.NewRemoteSigner(keylesslib.RemoteSignerConfig{
43
+ remoteSigner, err := keylesstls.NewRemoteSigner(keylesstls.RemoteSignerConfig{
44
Endpoint: relayURL,
45
ServerName: serverName,
46
KeyID: RelayKeyID,
@@ -50,7 +50,7 @@ func BuildClientTLSConfig(relayURL string, domains []string) (*tls.Config, ioClo
50
return nil, nil, fmt.Errorf("create keyless remote signer: %w", err)
51
}
52
53
- tlsConfig, err := keylesslib.NewServerTLSConfig(keylesslib.ServerTLSConfig{
53
+ tlsConfig, err := keylesstls.NewServerTLSConfig(keylesstls.ServerTLSConfig{
54
CertPEM: certPEM,
55
Signer: remoteSigner,
56
NextProtos: []string{"http/1.1"},
portal/keyless/tls.go
renamed
+5
-5
@@ -1,4 +1,4 @@
1
-package portal
1
+package keyless
2
3
import (
4
"crypto/tls"
@@ -7,7 +7,7 @@ import (
7
"io"
8
"net/http"
9
10
- keylesslib "github.com/gosuda/keyless_tls/keyless"
10
+ keylesstls "github.com/gosuda/keyless_tls/keyless"
11
)
12
13
type TLSMaterialConfig struct {
@@ -25,14 +25,14 @@ type RemoteSignerConfig struct {
25
RootCAPEM []byte
26
}
27
28
-func attachAPITLS(server *http.Server, cfg TLSMaterialConfig) (io.Closer, error) {
28
+func AttachToHTTPServer(server *http.Server, cfg TLSMaterialConfig) (io.Closer, error) {
29
if server == nil {
30
return nil, errors.New("http server is required")
31
}
32
if cfg.Keyless != nil {
33
- remoteSigner, err := keylesslib.AttachToHTTPServer(server, keylesslib.HTTPServerAttachConfig{
33
+ remoteSigner, err := keylesstls.AttachToHTTPServer(server, keylesstls.HTTPServerAttachConfig{
34
CertPEM: cfg.CertPEM,
35
- RemoteSigner: keylesslib.RemoteSignerConfig{
35
+ RemoteSigner: keylesstls.RemoteSignerConfig{
36
Endpoint: cfg.Keyless.Endpoint,
37
ServerName: cfg.Keyless.ServerName,
38
KeyID: cfg.Keyless.KeyID,
portal/server.go
+4
-2
@@ -17,6 +17,8 @@ import (
17
"golang.org/x/sync/errgroup"
18
19
"github.com/gosuda/keyless_tls/relay/l4"
20
+
21
+ "gosuda.org/portal/portal/keyless"
22
)
23
24
type ServerConfig struct {
@@ -27,7 +29,7 @@ type ServerConfig struct {
29
SNIListenAddr string
30
RootHost string
31
RootFallbackAddr string
30
- APITLS TLSMaterialConfig
32
+ APITLS keyless.TLSMaterialConfig
33
LeaseTTL time.Duration
34
ClaimTimeout time.Duration
35
IdleKeepaliveInterval time.Duration
@@ -129,7 +131,7 @@ func (s *Server) Start(ctx context.Context) error {
131
ReadHeaderTimeout: 10 * time.Second,
132
TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler)),
133
}
132
- apiCloser, err := attachAPITLS(apiServer, s.cfg.APITLS)
134
+ apiCloser, err := keyless.AttachToHTTPServer(apiServer, s.cfg.APITLS)
135
if err != nil {
136
_ = apiListener.Close()
137
_ = sniListener.Close()
sdk/listener_test.go
+4
-4
@@ -22,7 +22,7 @@ import (
22
"time"
23
24
"gosuda.org/portal/portal"
25
- portalkeyless "gosuda.org/portal/portal/keyless"
25
+ "gosuda.org/portal/portal/keyless"
26
)
27
28
func selfSignedCertPEM(hosts ...string) (certPEM, keyPEM []byte, err error) {
@@ -87,7 +87,7 @@ func TestListenerEndToEndTLSHTTP(t *testing.T) {
87
RootHost: "portal.test",
88
RootFallbackAddr: "127.0.0.1:1",
89
KeylessSignerHandler: newTestSignerHandler(t, apiKeyPEM),
90
- APITLS: portal.TLSMaterialConfig{
90
+ APITLS: keyless.TLSMaterialConfig{
91
CertPEM: apiCertPEM,
92
KeyPEM: apiKeyPEM,
93
},
@@ -207,7 +207,7 @@ func TestListenerEndToEndTLSHTTP_AutoKeyless(t *testing.T) {
207
RootHost: "portal.test",
208
RootFallbackAddr: "127.0.0.1:1",
209
KeylessSignerHandler: newTestSignerHandler(t, apiKeyPEM),
210
- APITLS: portal.TLSMaterialConfig{
210
+ APITLS: keyless.TLSMaterialConfig{
211
CertPEM: apiCertPEM,
212
KeyPEM: apiKeyPEM,
213
},
@@ -325,7 +325,7 @@ func newTestSignerHandler(t *testing.T, keyPEM []byte) http.Handler {
325
if err := os.WriteFile(keyFile, keyPEM, 0o600); err != nil {
326
t.Fatalf("WriteFile(key) error = %v", err)
327
}
328
- signer, err := portalkeyless.NewSigner(keyFile)
328
+ signer, err := keyless.NewSigner(keyFile)
329
if err != nil {
330
t.Fatalf("NewSigner() error = %v", err)
331
}