curben
/
cloudflared-mirror
mirror of https://github.com/cloudflare/cloudflared.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

feat(tunnel): add TUNNEL_ORIGIN_CERT_CONTENT env 

This PR adds support for specifying the origin certificate content
as an environment variable.
This is useful when deploying cloudflared in environments where writing
a file is not possible, ex: Heroku

The cert must be base64 encoded.
This commit is contained in:
tim 2020-11-19 15:07:46 -08:00
parent 1805261263
commit 137fb515fb
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
cmd/cloudflared/tunnel/configuration.go
View File

@ -2,6 +2,7 @@ package tunnel
import ( import (
"crypto/tls" "crypto/tls"
"encoding/base64"
"fmt" "fmt"
"io/ioutil" "io/ioutil"
"os" "os"
@ -35,6 +36,11 @@ var (
argumentsUrl = developerPortal + "/reference/arguments/" argumentsUrl = developerPortal + "/reference/arguments/"
) )
const (
// name of the environment variable that contains the base64 encoded origin cert
encodedOriginCert = "TUNNEL_ORIGIN_CERT_CONTENT"
)
// returns the first path that contains a cert.pem file. If none of the DefaultConfigSearchDirectories // returns the first path that contains a cert.pem file. If none of the DefaultConfigSearchDirectories
// contains a cert.pem file, return empty string // contains a cert.pem file, return empty string
func findDefaultOriginCertPath() string { func findDefaultOriginCertPath() string {
@ -95,7 +101,7 @@ func dnsProxyStandAlone(c *cli.Context) bool {
func findOriginCert(c *cli.Context, logger logger.Service) (string, error) { func findOriginCert(c *cli.Context, logger logger.Service) (string, error) {
originCertPath := c.String("origincert") originCertPath := c.String("origincert")
if originCertPath == "" { if originCertPath == "" && os.Getenv(encodedOriginCert) == "" {
logger.Infof("Cannot determine default origin certificate path. No file %s in %v", config.DefaultCredentialFile, config.DefaultConfigSearchDirectories()) logger.Infof("Cannot determine default origin certificate path. No file %s in %v", config.DefaultCredentialFile, config.DefaultConfigSearchDirectories())
if isRunningFromTerminal() { if isRunningFromTerminal() {
logger.Errorf("You need to specify the origin certificate path with --origincert option, or set TUNNEL_ORIGIN_CERT environment variable. See %s for more information.", argumentsUrl) logger.Errorf("You need to specify the origin certificate path with --origincert option, or set TUNNEL_ORIGIN_CERT environment variable. See %s for more information.", argumentsUrl)
@ -146,6 +152,11 @@ func readOriginCert(originCertPath string, logger logger.Service) ([]byte, error
} }
func getOriginCert(c *cli.Context, logger logger.Service) ([]byte, error) { func getOriginCert(c *cli.Context, logger logger.Service) ([]byte, error) {
// check if cert is present as a base64 encoded ENV
certContent := os.Getenv(encodedOriginCert)
if certContent != "" {
return base64.StdEncoding.DecodeString(certContent)
}
if originCertPath, err := findOriginCert(c, logger); err != nil { if originCertPath, err := findOriginCert(c, logger); err != nil {
return nil, err return nil, err
} else { } else {