diff --git a/deploy/docker-compose.yaml b/deploy/docker-compose.yaml index e2ea6be..db84e57 100644 --- a/deploy/docker-compose.yaml +++ b/deploy/docker-compose.yaml @@ -1,4 +1,3 @@ - services: node: image: ritualnetwork/infernet-node:1.4.0 @@ -8,6 +7,7 @@ services: - ./config.json:/app/config.json - node-logs:/logs - /var/run/docker.sock:/var/run/docker.sock + - /root/node/cert.pem:/usr/local/share/ca-certificates/grpcbalancer.crt:ro tty: true networks: - network diff --git a/grpc-balancer.py b/grpc-balancer.py index 796bdca..f0ee533 100644 --- a/grpc-balancer.py +++ b/grpc-balancer.py @@ -319,5 +319,10 @@ if __name__ == '__main__': upload_thread.start() from waitress import serve - logging.info(f"Starting server on port {PORT}") - serve(app, host='0.0.0.0', port=PORT, threads=MAX_WORKERS, connection_limit=1000) + import ssl + + ssl_context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH) + ssl_context.load_cert_chain('/root/node/cert.pem', '/root/node/key.pem') + + logging.info(f"Starting SSL server on port {PORT}") + serve(app, host='0.0.0.0', port=PORT, threads=MAX_WORKERS, connection_limit=1000, _ssl_context=ssl_context) diff --git a/playbook.yml b/playbook.yml index 71939ef..b58082c 100644 --- a/playbook.yml +++ b/playbook.yml @@ -203,6 +203,20 @@ - waitress extra_args: --break-system-packages + - name: Create SSL certificate for grpcbalancer + ansible.builtin.shell: | + mkdir -p /root/node + openssl req -x509 -newkey rsa:4096 -keyout /root/node/key.pem -out /root/node/cert.pem -days 365 -nodes -subj "/CN=localhost" + args: + creates: /root/node/cert.pem + + - name: Install SSL certificate to system store + ansible.builtin.shell: | + cp /root/node/cert.pem /usr/local/share/ca-certificates/grpcbalancer.crt + update-ca-certificates + args: + executable: /bin/bash + - name: Copy grpcbalancer service file ansible.builtin.copy: dest: /etc/systemd/system/grpcbalancer.service @@ -269,6 +283,11 @@ args: chdir: "{{ ansible_env.HOME }}/node" + - name: Update certificates in container + ansible.builtin.shell: docker exec infernet-node update-ca-certificates + args: + executable: /bin/bash + - name: Deploy contracts ansible.builtin.shell: project=hello-world make deploy-contracts 2>&1 register: contract_deploy_output