steve/restic-manager
1
0
Fork 0
Code Issues Pull Requests Actions Projects Releases 1 Wiki Activity

server: drop in-process TLS — HTTP-only behind reverse proxy

Browse Source 
Self-hosted deployments already terminate TLS at Caddy/Traefik/nginx;
making the server do TLS too means double cert config, dual ACME
plumbing, and an untested code path. Drop RM_TLS_CERT/RM_TLS_KEY,
remove TLSEnabled() and the ListenAndServeTLS branch.

Replace the cookie's "Secure if TLS-in-process" check with a new
RM_COOKIE_SECURE flag (default true). Local HTTP-only testing sets
RM_COOKIE_SECURE=false; production is always behind a TLS proxy and
the cookie stays Secure.

Default port :8443 → :8080. docker-compose binds 127.0.0.1 only and
populates RM_TRUSTED_PROXY. spec.md §4.1/§10.1 rewritten with a
Caddyfile snippet and a hard "do not expose RM_LISTEN publicly"
warning. enrollResponse keeps cert_pin_sha256 in the shape but the
server can't introspect a cert it doesn't terminate — operator
pastes the proxy's hash into -cert-pin at install time.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Steve Cliff
2026-05-01 11:20:41 +01:00
parent 80a57b3b84
commit 811157b4ce
8 changed files with 102 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/server/config/config.go
+20 -17
View File
@@ -16,14 +16,21 @@ import (
// Config holds runtime parameters resolved from env + (optionally) a
// YAML file. Env wins over YAML so operators can tweak a single var
// without rewriting the file.
//
// The server is HTTP-only by design: the expected deployment fronts it
// with a TLS-terminating reverse proxy (Caddy/Traefik/nginx). See
// spec.md §11 for the rationale.
type Config struct {
Listen string `yaml:"listen"`
DataDir string `yaml:"data_dir"`
BaseURL string `yaml:"base_url"`
TLSCert string `yaml:"tls_cert"`
TLSKey string `yaml:"tls_key"`
SecretKeyFile string `yaml:"secret_key_file"`
TrustedProxies []string `yaml:"trusted_proxies"`
// CookieSecure controls the Secure attribute on session cookies.
// Defaults to true. Set RM_COOKIE_SECURE=false only for local HTTP
// testing — production deployments are always behind a TLS proxy
// and the cookie must be Secure.
CookieSecure bool `yaml:"cookie_secure"`
}
// Load resolves config in this order:
@@ -35,8 +42,9 @@ type Config struct {
// safe to start.
func Load(yamlPath string) (Config, error) {
c := Config{
Listen: ":8443",
DataDir: "/data",
Listen: ":8080",
DataDir: "/data",
CookieSecure: true,
}
if yamlPath != "" {
@@ -60,15 +68,17 @@ func Load(yamlPath string) (Config, error) {
if v, ok := os.LookupEnv("RM_BASE_URL"); ok {
c.BaseURL = v
}
if v, ok := os.LookupEnv("RM_TLS_CERT"); ok {
c.TLSCert = v
}
if v, ok := os.LookupEnv("RM_TLS_KEY"); ok {
c.TLSKey = v
}
if v, ok := os.LookupEnv("RM_SECRET_KEY_FILE"); ok {
c.SecretKeyFile = v
}
if v, ok := os.LookupEnv("RM_COOKIE_SECURE"); ok {
// Anything other than "false"/"0" leaves the safe default.
if v == "false" || v == "0" {
c.CookieSecure = false
} else {
c.CookieSecure = true
}
}
if v, ok := os.LookupEnv("RM_TRUSTED_PROXY"); ok {
// Comma-separated CIDRs; allow whitespace for readability.
parts := strings.Split(v, ",")
@@ -103,12 +113,5 @@ func (c *Config) validate() error {
return fmt.Errorf("config: RM_TRUSTED_PROXY entry %q is not a valid CIDR: %w", cidr, err)
}
}
// TLS pair: either both set or both unset (HTTP-only mode for dev).
if (c.TLSCert == "") != (c.TLSKey == "") {
return fmt.Errorf("config: RM_TLS_CERT and RM_TLS_KEY must be set together (or both unset)")
}
return nil
}
// TLSEnabled is true when both cert and key are configured.
func (c Config) TLSEnabled() bool { return c.TLSCert != "" && c.TLSKey != "" }
internal/server/config/config_test.go
+21 -10
View File
@@ -6,14 +6,14 @@ import (
)
func TestDefaultsValid(t *testing.T) {
t.Setenv("RM_LISTEN", ":8443")
t.Setenv("RM_LISTEN", ":8080")
t.Setenv("RM_DATA_DIR", "/tmp/rm-test")
c, err := Load("")
if err != nil {
t.Fatalf("load: %v", err)
}
if c.Listen != ":8443" {
if c.Listen != ":8080" {
t.Errorf("listen: %q", c.Listen)
}
if c.SecretKeyFile != "/tmp/rm-test/secret.key" {
@@ -50,7 +50,7 @@ func TestEnvOverridesYAML(t *testing.T) {
}
func TestTrustedProxyParsing(t *testing.T) {
t.Setenv("RM_LISTEN", ":8443")
t.Setenv("RM_LISTEN", ":8080")
t.Setenv("RM_DATA_DIR", "/tmp/x")
t.Setenv("RM_TRUSTED_PROXY", "10.0.0.0/8, 192.168.1.0/24")
@@ -67,7 +67,7 @@ func TestTrustedProxyParsing(t *testing.T) {
}
func TestTrustedProxyRejectsGarbage(t *testing.T) {
t.Setenv("RM_LISTEN", ":8443")
t.Setenv("RM_LISTEN", ":8080")
t.Setenv("RM_DATA_DIR", "/tmp/x")
t.Setenv("RM_TRUSTED_PROXY", "not-a-cidr")
@@ -76,14 +76,25 @@ func TestTrustedProxyRejectsGarbage(t *testing.T) {
}
}
func TestTLSPairConsistency(t *testing.T) {
t.Setenv("RM_LISTEN", ":8443")
func TestCookieSecureDefaultAndOverride(t *testing.T) {
t.Setenv("RM_LISTEN", ":8080")
t.Setenv("RM_DATA_DIR", "/tmp/x")
t.Setenv("RM_TLS_CERT", "/some/cert.pem")
// key intentionally unset
if _, err := Load(""); err == nil {
t.Fatal("expected error: cert without key")
c, err := Load("")
if err != nil {
t.Fatalf("load: %v", err)
}
if !c.CookieSecure {
t.Errorf("CookieSecure should default to true")
}
t.Setenv("RM_COOKIE_SECURE", "false")
c, err = Load("")
if err != nil {
t.Fatalf("load: %v", err)
}
if c.CookieSecure {
t.Errorf("CookieSecure should be false when RM_COOKIE_SECURE=false")
}
}