From 81d96bd93f6d812c6296898cb67ec45925f0022c Mon Sep 17 00:00:00 2001 From: Dmytro Shteflyuk Date: Tue, 24 Sep 2024 14:39:52 -0400 Subject: [PATCH 1/2] Added support for custom SSL certificate --- lib/kamal/configuration/docs/proxy.yml | 11 +++++++++++ lib/kamal/configuration/proxy.rb | 2 ++ lib/kamal/configuration/validator/proxy.rb | 8 ++++++++ test/commands/app_test.rb | 8 ++++++++ test/configuration/proxy_test.rb | 10 ++++++++++ 5 files changed, 39 insertions(+) diff --git a/lib/kamal/configuration/docs/proxy.yml b/lib/kamal/configuration/docs/proxy.yml index 76ec3e41d..977e9014b 100644 --- a/lib/kamal/configuration/docs/proxy.yml +++ b/lib/kamal/configuration/docs/proxy.yml @@ -49,6 +49,17 @@ proxy: # Defaults to `false`: ssl: true + # Custom SSL certificate + # + # In scenarios where Let's Encrypt is not an option, or you already have your own + # certificates from a different Certificate Authority, you can configure kamal-proxy + # to load the certificate and the corresponding private key from disk. + # + # The certificate must be in PEM format and contain the full chain. The private key + # must also be in PEM format. + ssl_certificate_path: /data/cert/foo.example.com/fullchain.pem + ssl_private_key_path: /data/cert/foo.example.com/privkey.pem + # Response timeout # # How long to wait for requests to complete before timing out, defaults to 30 seconds: diff --git a/lib/kamal/configuration/proxy.rb b/lib/kamal/configuration/proxy.rb index 6232c3e03..cc7ed3be7 100644 --- a/lib/kamal/configuration/proxy.rb +++ b/lib/kamal/configuration/proxy.rb @@ -30,6 +30,8 @@ def deploy_options { host: hosts, tls: proxy_config["ssl"].presence, + "tls-certificate-path": proxy_config["ssl_certificate_path"], + "tls-private-key-path": proxy_config["ssl_private_key_path"], "deploy-timeout": seconds_duration(config.deploy_timeout), "drain-timeout": seconds_duration(config.drain_timeout), "health-check-interval": seconds_duration(proxy_config.dig("healthcheck", "interval")), diff --git a/lib/kamal/configuration/validator/proxy.rb b/lib/kamal/configuration/validator/proxy.rb index b9e11cd99..5eb91a7af 100644 --- a/lib/kamal/configuration/validator/proxy.rb +++ b/lib/kamal/configuration/validator/proxy.rb @@ -10,6 +10,14 @@ def validate! if (config.keys & [ "host", "hosts" ]).size > 1 error "Specify one of 'host' or 'hosts', not both" end + + if config["ssl_certificate_path"].present? && config["ssl_private_key_path"].blank? + error "Must set a private key path to use a custom SSL certificate" + end + + if config["ssl_private_key_path"].present? && config["ssl_certificate_path"].blank? + error "Must set a certificate path to use a custom SSL private key" + end end end end diff --git a/test/commands/app_test.rb b/test/commands/app_test.rb index 0e5cad796..58986309b 100644 --- a/test/commands/app_test.rb +++ b/test/commands/app_test.rb @@ -143,6 +143,14 @@ class CommandsAppTest < ActiveSupport::TestCase new_command.deploy(target: "172.1.0.2").join(" ") end + test "deploy with custom SSL certificate" do + @config[:proxy] = { "ssl" => true, "host" => "example.com", "ssl_certificate_path" => "/path/to/cert.pem", "ssl_private_key_path" => "/path/to/key.pem" } + + assert_equal \ + "docker exec kamal-proxy kamal-proxy deploy app-web --target=\"172.1.0.2:80\" --host=\"example.com\" --tls --tls-certificate-path=\"/path/to/cert.pem\" --tls-private-key-path=\"/path/to/key.pem\" --deploy-timeout=\"30s\" --drain-timeout=\"30s\" --buffer-requests --buffer-responses --log-request-header=\"Cache-Control\" --log-request-header=\"Last-Modified\" --log-request-header=\"User-Agent\"", + new_command.deploy(target: "172.1.0.2").join(" ") + end + test "remove" do assert_equal \ "docker exec kamal-proxy kamal-proxy remove app-web", diff --git a/test/configuration/proxy_test.rb b/test/configuration/proxy_test.rb index 588e5a350..9ece1637c 100644 --- a/test/configuration/proxy_test.rb +++ b/test/configuration/proxy_test.rb @@ -38,6 +38,16 @@ class ConfigurationProxyTest < ActiveSupport::TestCase assert_not config.proxy.ssl? end + test "ssl with certificate path and no private key path" do + @deploy[:proxy] = { "ssl" => true, "ssl_certificate_path" => "/path/to/cert.pem" } + assert_raises(Kamal::ConfigurationError) { config.proxy.ssl? } + end + + test "ssl with private key path and no certificate path" do + @deploy[:proxy] = { "ssl" => true, "ssl_private_key_path" => "/path/to/key.pem" } + assert_raises(Kamal::ConfigurationError) { config.proxy.ssl? } + end + private def config Kamal::Configuration.new(@deploy) From ff32dcb0b9e6741a9d5dfbfbff44fd833f908108 Mon Sep 17 00:00:00 2001 From: Dmytro Shteflyuk Date: Mon, 14 Oct 2024 19:43:01 -0400 Subject: [PATCH 2/2] SSL is only supported on a single server or with custom SSL certificates --- lib/kamal/configuration/proxy.rb | 4 ++++ lib/kamal/configuration/role.rb | 4 ++-- test/configuration_test.rb | 11 ++++++++++- 3 files changed, 16 insertions(+), 3 deletions(-) diff --git a/lib/kamal/configuration/proxy.rb b/lib/kamal/configuration/proxy.rb index cc7ed3be7..5529ddf33 100644 --- a/lib/kamal/configuration/proxy.rb +++ b/lib/kamal/configuration/proxy.rb @@ -22,6 +22,10 @@ def ssl? proxy_config.fetch("ssl", false) end + def custom_ssl_certificate? + proxy_config["ssl_certificate_path"].present? + end + def hosts proxy_config["hosts"] || proxy_config["host"]&.split(",") || [] end diff --git a/lib/kamal/configuration/role.rb b/lib/kamal/configuration/role.rb index 708e77fc2..d5b923da2 100644 --- a/lib/kamal/configuration/role.rb +++ b/lib/kamal/configuration/role.rb @@ -150,8 +150,8 @@ def asset_volume_directory(version = config.version) end def ensure_one_host_for_ssl - if running_proxy? && proxy.ssl? && hosts.size > 1 - raise Kamal::ConfigurationError, "SSL is only supported on a single server, found #{hosts.size} servers for role #{name}" + if running_proxy? && proxy.ssl? && hosts.size > 1 && !proxy.custom_ssl_certificate? + raise Kamal::ConfigurationError, "SSL is only supported on a single server or with custom SSL certificates, found #{hosts.size} servers for role #{name}" end end diff --git a/test/configuration_test.rb b/test/configuration_test.rb index c1aaa6971..236e49cef 100644 --- a/test/configuration_test.rb +++ b/test/configuration_test.rb @@ -371,7 +371,16 @@ class ConfigurationTest < ActiveSupport::TestCase Kamal::Configuration.new(@deploy_with_roles) end - assert_equal "SSL is only supported on a single server, found 2 servers for role workers", exception.message + assert_equal "SSL is only supported on a single server or with custom SSL certificates, found 2 servers for role workers", exception.message + end + + test "proxy ssl roles with multiple servers and a custom SSL certificate" do + @deploy_with_roles[:servers]["workers"]["proxy"] = { "ssl" => true, "host" => "foo.example.com", "ssl_certificate_path" => "/path/to/cert.pem", "ssl_private_key_path" => "/path/to/key.pem" } + + config = Kamal::Configuration.new(@deploy_with_roles) + + assert config.role(:workers).running_proxy? + assert config.role(:workers).ssl? end test "two proxy ssl roles with same host" do