jcoffey-dev
b6b092c912
End-to-end log pipeline for Linux hosts, per /docs/architecture.md: - proto: shared gRPC contract (agent <-> ingest), Go bindings checked in - agent: Rust, musl-targeted, journald/file sourcing, RFC5424 parser, mTLS gRPC client, no required config for the common case - ingest: Go, single binary with --mode server|consumer|all; gRPC front end forwards to Redpanda unchanged, consumer normalizes and batch-writes to ClickHouse with at-least-once delivery - storage: ClickHouse schema + a plain SQL-file migration runner - api: minimal SELECT-only query endpoint, plain REST (not gRPC+gateway yet -- see api/README.md) - web: SvelteKit static SPA, one query page - transport: Redpanda compose + topic provisioning - cli: sentryctl ping stub - hack/dev-certs: throwaway CA + cert generation for local mTLS - root docker-compose.yml + docs/phase-0-runbook.md tie it together Not yet run end-to-end against real Docker/ClickHouse/Redpanda -- see the runbook's caveats section before relying on this working as-is.
37 lines
1018 B
Go
37 lines
1018 B
Go
package grpcserver
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/sentry/sentry/ingest/internal/config"
|
|
)
|
|
|
|
// loadServerTLSConfig builds the mTLS server config: ingest's own
|
|
// certificate, plus the CA used to verify agent client certificates.
|
|
// Agents are never accepted without a client cert signed by this CA.
|
|
func loadServerTLSConfig(cfg config.TLSConfig) (*tls.Config, error) {
|
|
cert, err := tls.LoadX509KeyPair(cfg.CertFile, cfg.KeyFile)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("loading server cert/key: %w", err)
|
|
}
|
|
|
|
caPEM, err := os.ReadFile(cfg.ClientCAFile)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("reading client CA file: %w", err)
|
|
}
|
|
caPool := x509.NewCertPool()
|
|
if !caPool.AppendCertsFromPEM(caPEM) {
|
|
return nil, fmt.Errorf("no valid certificates found in client CA file %s", cfg.ClientCAFile)
|
|
}
|
|
|
|
return &tls.Config{
|
|
Certificates: []tls.Certificate{cert},
|
|
ClientAuth: tls.RequireAndVerifyClientCert,
|
|
ClientCAs: caPool,
|
|
MinVersion: tls.VersionTLS12,
|
|
}, nil
|
|
}
|