Add CA generation and mount it to /ca in containers #28
Conversation
|
Not sure if the outbound federation endpoint creation is the best place to create the CA cert. There is probably a better place, right before jumping into blueprints right? We should specify how the lifetime is for those certs. Can someone explain to me how the HS containers get executed? I will add documentation when we got those specifics figured out. |
Make sure that the certs are created at test start.
|
Some things changed while further testing this. Please reapprove, to be safe. |
This is necessary until homeserver containers can get access to the dummy CA that's used to create the certificate complement federation instances are using. Synapse can't trust those entities over federation until this happens, so disable verification for now. A proper fix should be possible after #28 or similar lands.
This is necessary until homeserver containers can get access to the dummy CA that's used to create the certificate complement federation instances are using. Synapse can't trust those entities over federation until this happens, so disable verification for now. A proper fix should be possible after #28 or similar lands.
This is necessary until homeserver containers can get access to the dummy CA that's used to create the certificate complement federation instances are using. Synapse can't trust those entities over federation until this happens, so disable verification for now. A proper fix should be possible after #28 or similar lands.
There was a problem hiding this comment.
I'd like to see this be gated behind something like COMPLEMENT_CA=1 because it adds a fair amount of extra complexity which isn't needed for most HSes which support disabling TLS validation. I'll run a few more tests with Dendrite and then see if there is a big perf hit or not.
Set COMPLEMENT_CA=true to enable Complement PKI
|
I assume that is enough to feature gate all of the PKI stuff. |
|
Fab, thanks! LGTM |
* 'master' of github.com:matrix-org/complement: Add request query parameter map to instruction struct (#37) Add CA generation and mount it to /ca in containers (#28) Federation: return Content-Type header of 'application/json' by default (#35) Up the default version check iterations from 50 to 100 (#34) Provide an empty json dict to /createRoom instead of no body (#36)
This PR adds support for CA generation in complement.
The Outbound Federation server will create a CA cert either in
$PWD/caor if run in CI in the Volume mounted to/ca.On container deploy, depending on CI or not, either
$PWD/cais bind mounted to/caor the/caVolume of complement is mounted to/cain homeserver containers.