Add SSL support to astral api server

Dockerfile

@@ -55,4 +55,4 @@ USER rails:rails
 # Start the server by default, this can be overwritten at runtime
 EXPOSE 3000
 # Start the server
-CMD ["bin/rails", "server", "-b", "0.0.0.0"]
+CMD ["bin/http.sh"]

README.md

@@ -72,21 +72,37 @@ file.  Per-environment settings in the config file(development, test,
 production) will override the shared values for that type.
 
 ## mTLS connections
-Astral can connect to Vault with mTLS. Just
-set the following values in `config/astral.yml`:
+Astral can be run as an SSL service and can communicate with Vault via SSL.
+Just set the following values in `config/astral.yml` (or environment) to 
+encrypt Astral-to-Vault :
 ```
   vault_ssl_cert:
   vault_ssl_client_cert:
   vault_ssl_client_key:
 ```
-A self-signed server cert for Vault can be generated with the following 
-command:
+
+A self-signed server cert for Vault, Astral, and the OIDC provider can be 
+generated with the following command, and initial placeholder certs are already provided.
 ```
 rake configure:ssl
 ```
 
-To use SSL in the devcontainer, edit `.devcontainer/docker-compose.yml` so
-that the `app` service has `VAULT_ADDRESS` of `https://vault:8443`. 
+To use Vault SSL in the devcontainer, edit
+`.devcontainer/docker-compose.yml` so that the `app` service has
+`VAULT_ADDRESS` of `https://vault:8443`. Client certs can also be
+configured -- in which case Vault needs to be configured to verify
+with a CA cert.
+
+
+To use Astral with SSL in production, provide the necessary environment (SSL_CERT, SSL_KEY) to
+the container environment, and use the `bin/ssl.sh` startup command. Eg:
+```
+docker run -p 3000:3000 \
+-e SSL_CERT=/certs/cert.pem \
+-e SSL_KEY=/certs/key.key \
+-v certs:/certs:cached \
+astral:latest bin/ssl.sh
+```
 
 ## OIDC configuration
 The OIDC modules allow the assignment of a policy to an OIDC user, by
@@ -123,6 +139,8 @@ config/astral.yml).
 The rails test's configure the OIDC initial user, so if the tests pass,
 you can invoke the oidc login as follows:
 
+To use SSL in production, provide the necessary environment (SSL_CERT, SSL_KEY) to
+the container environment, and use the `bin/ssl.sh` startup command. Eg:
 ```
   export VAULT_ADDR=http://127.0.0.1:8200; vault login -method=oidc
 ```

bin/http.sh

@@ -0,0 +1,2 @@
+#! /bin/sh
+bin/rails s -b 0.0.0.0

bin/ssl.sh

@@ -0,0 +1,5 @@
+#! /bin/sh
+SSL_CERT="${SSL_CERT:-cert/astral.pem}"
+SSL_KEY="${SSL_KEY:-cert/astral.key}"
+
+bin/rails s -b "ssl://0.0.0.0:3000?key=${SSL_KEY}&cert=${SSL_CERT}"

lib/tasks/configure.rake

@@ -2,22 +2,35 @@ require "rake"
 
 # Rake tasks for making a vault cert
 namespace :configure do
+  desc "Make Vault, Astral, and OIDC provider certs"
+  task ssl: [ :vault_ssl, :astral_ssl, :oidc_provider_ssl ]
+
   desc "Make the server cert for vault"
-  task :ssl, [ :cert_name ] do |t, args|
-    cert_name = args[:cert_name]
-    cert_name = "vault" if cert_name.nil?
-    sanParam = "subjectAltName=DNS:#{cert_name}"
-    %x(
-     openssl req -new -newkey rsa:4096 -nodes \
-        -keyout cert/#{cert_name}.key -out cert/#{cert_name}.csr \
-        -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=#{cert_name}" \
-        -addext #{sanParam} \
+  task :vault_ssl do
+    keygen("vault")
+  end
+
+  desc "Make the server cert for astral"
+  task :astral_ssl do
+    keygen("astral")
+  end
 
-      echo #{sanParam} > /tmp/sanParam
-      openssl x509 -req -days 365 -in cert/#{cert_name}.csr \
-        -signkey cert/#{cert_name}.key \
-        -out cert/#{cert_name}.pem -extfile /tmp/sanParam
+  desc "Make the server cert for the oidc provider"
+  task :oidc_provider_ssl do
+    keygen("oidc_provider")
+  end
+
+  private
+
+  def keygen(name)
+    %x(
+      openssl req -new -newkey rsa:4096 -nodes \
+        -keyout cert/#{name}.key -out cert/#{name}.csr \
+        -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=#{name}"
+      openssl x509 -req -days 365 -in cert/#{name}.csr \
+        -signkey cert/#{name}.key \
+        -out cert/#{name}.pem
     )
-    puts "SSL key for #{cert_name} created"
+    puts "SSL key for #{name} created"
   end
 end