Nick/neos 271 add configuration for tls certs for api

backend/charts/api/templates/api-env-vars.yaml

@@ -53,3 +53,19 @@ stringData:
     {{- if and .Values.temporal .Values.temporal.url }}
     TEMPORAL_URL: {{ .Values.temporal.url }}
     {{- end }}
+
+    {{- if and .Values.temporal .Values.temporal.certificate .Values.temporal.certificate.keyFilePath }}
+    TEMPORAL_CERT_KEY_PATH: {{ .Values.temporal.certificate.keyFilePath }}
+    {{- end }}
+
+    {{- if and .Values.temporal .Values.temporal.certificate .Values.temporal.certificate.certFilePath }}
+    TEMPORAL_CERT_PATH: {{ .Values.temporal.certificate.certFilePath }}
+    {{- end }}
+
+    {{- if and .Values.temporal .Values.temporal.certificate .Values.temporal.certificate.keyContents }}
+    TEMPORAL_CERT_KEY: {{ .Values.temporal.certificate.keyContents }}
+    {{- end }}
+
+    {{- if and .Values.temporal .Values.temporal.certificate .Values.temporal.certificate.certContents }}
+    TEMPORAL_CERT: {{ .Values.temporal.certificate.certContents }}
+    {{- end }}

backend/charts/api/templates/deployment.yaml

@@ -4,6 +4,7 @@ metadata:
   name: {{ template "neosync-api.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
+    {{- include "neosync-api.labels" . | nindent 4 }}
     {{- if eq .Values.datadog.enabled true }}
     tags.datadoghq.com/env: {{ .Values.nucleusEnv }}
     tags.datadoghq.com/service: {{ template "neosync-api.fullname" . }}
@@ -25,8 +26,8 @@ spec:
         {{- end }}
         rollme: {{ randAlphaNum 5 | quote }} # causes deployment to always roll on helm upgrade
       labels:
+        {{- include "neosync-api.labels" . | nindent 8 }}
         app: {{ template "neosync-api.fullname" . }}
-        version: v1
         {{- if eq .Values.istio.enabled true }}
         sidecar.istio.io/inject: "true"
         {{- end }}
@@ -55,6 +56,11 @@ spec:
             - secretRef:
                 name: {{ template "neosync-api.fullname" . }}-migration-evs
 
+      {{- with .Values.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+
       containers:
         - name: user-container
           image: '{{ .Values.image.repository | default "ghcr.io/nucleuscloud/neosync/backend" }}:{{ .Values.image.tag | default .Chart.AppVersion  }}'
@@ -79,6 +85,12 @@ spec:
             failureThreshold: 2
             successThreshold: 1
             initialDelaySeconds: 1
+
+          {{- with .Values.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+
           env:
             - name: HOST_IP
               valueFrom:

backend/charts/api/templates/service.yaml

@@ -4,6 +4,7 @@ metadata:
   name: {{ template "neosync-api.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
+    {{- include "neosync-api.labels" . | nindent 4 }}
     app: {{ template "neosync-api.fullname" . }}
 spec:
   ports:

backend/charts/api/values.yaml

@@ -59,3 +59,12 @@ auth:
 
 temporal:
   url:
+  certificate:
+    keyFilePath:
+    certFilePath:
+
+    keyContents:
+    certContents:
+
+volumes: []
+volumeMounts: []

backend/dev/helm/api/values.yaml

@@ -42,7 +42,7 @@ auth:
 temporal:
   url: temporal.temporal:7233
   namespace: default
-  taskQueue: 'sync-job'
+  taskQueue: "sync-job"
 
 ingress:
   enabled: false

backend/internal/cmds/mgmt/serve/connect/cmd.go

@@ -1,6 +1,7 @@
 package serve_connect
 
 import (
+	"crypto/tls"
 	"fmt"
 	"log/slog"
 	"net/http"
@@ -136,8 +137,13 @@ func serve() error {
 			stdInterceptorConnectOpt,
 		),
 	)
-
-	tfwfmgr := clientmanager.New(&clientmanager.Config{}, db.Q, db.Db)
+	authcerts, err := getTemporalAuthCertificate()
+	if err != nil {
+		return err
+	}
+	tfwfmgr := clientmanager.New(&clientmanager.Config{
+		AuthCertificates: authcerts,
+	}, db.Q, db.Db)
 
 	jobServiceConfig := &v1alpha1_jobservice.Config{
 		IsAuthEnabled: isAuthEnabled,
@@ -256,6 +262,30 @@ func getDbConfig() (*nucleusdb.ConnectConfig, error) {
 	}, nil
 }
 
+func getTemporalAuthCertificate() ([]tls.Certificate, error) {
+	keyPath := viper.GetString("TEMPORAL_CERT_KEY_PATH")
+	certPath := viper.GetString("TEMPORAL_CERT_PATH")
+
+	if keyPath != "" && certPath != "" {
+		cert, err := tls.LoadX509KeyPair(certPath, keyPath)
+		if err != nil {
+			return nil, err
+		}
+		return []tls.Certificate{cert}, nil
+	}
+
+	key := viper.GetString("TEMPORAL_CERT_KEY")
+	cert := viper.GetString("TEMPORAL_CERT")
+	if key != "" && cert != "" {
+		cert, err := tls.X509KeyPair([]byte(key), []byte(cert))
+		if err != nil {
+			return nil, err
+		}
+		return []tls.Certificate{cert}, nil
+	}
+	return []tls.Certificate{}, nil
+}
+
 func getDefaultTemporalConfig() *v1alpha1_useraccountservice.TemporalConfig {
 	return &v1alpha1_useraccountservice.TemporalConfig{
 		DefaultTemporalNamespace:        getDefaultTemporalNamespace(),

backend/internal/temporal/client-manager/manager-client.go

@@ -2,6 +2,7 @@ package clientmanager
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"log/slog"
 	"sync"
@@ -29,7 +30,9 @@ type DB interface {
 	GetTemporalConfigByAccount(ctx context.Context, db db_queries.DBTX, accountId pgtype.UUID) (*jsonmodels.TemporalConfig, error)
 }
 
-type Config struct{}
+type Config struct {
+	AuthCertificates []tls.Certificate
+}
 
 func New(
 	config *Config,
@@ -160,14 +163,7 @@ func (t *TemporalClientManager) getNewNSClientByAccount(
 		return nil, errors.New("neosync account does not have a configured temporal namespace")
 	}
 
-	return temporalclient.NewNamespaceClient(temporalclient.Options{
-		Logger: logger.With(
-			"temporal-client", "true",
-			"neosync-account-id", accountId,
-		),
-		HostPort:  tc.Url,
-		Namespace: tc.Namespace,
-	})
+	return temporalclient.NewNamespaceClient(*t.getClientOptions(accountId, tc, logger))
 }
 
 func (t *TemporalClientManager) getNewWFClientByAccount(
@@ -182,15 +178,7 @@ func (t *TemporalClientManager) getNewWFClientByAccount(
 	if tc.Namespace == "" {
 		return nil, errors.New("neosync account does not have a configured temporal namespace")
 	}
-
-	return temporalclient.NewLazyClient(temporalclient.Options{
-		Logger: logger.With(
-			"temporal-client", "true",
-			"neosync-account-id", accountId,
-		),
-		HostPort:  tc.Url,
-		Namespace: tc.Namespace,
-	})
+	return temporalclient.NewLazyClient(*t.getClientOptions(accountId, tc, logger))
 }
 
 func (t *TemporalClientManager) getTemporalConfigByAccount(
@@ -203,3 +191,35 @@ func (t *TemporalClientManager) getTemporalConfigByAccount(
 	}
 	return t.db.GetTemporalConfigByAccount(ctx, t.dbtx, accountUuid)
 }
+
+func (t *TemporalClientManager) getClientOptions(
+	accountId string,
+	tc *jsonmodels.TemporalConfig,
+	logger *slog.Logger,
+) *temporalclient.Options {
+	opts := temporalclient.Options{
+		Logger: logger.With(
+			"temporal-client", "true",
+			"neosync-account-id", accountId,
+		),
+		HostPort:  tc.Url,
+		Namespace: tc.Namespace,
+	}
+	connectOpts := t.getClientConnectionOptions()
+	if connectOpts != nil {
+		opts.ConnectionOptions = *connectOpts
+	}
+	return &opts
+}
+
+func (t *TemporalClientManager) getClientConnectionOptions() *temporalclient.ConnectionOptions {
+	if len(t.config.AuthCertificates) == 0 {
+		return nil
+	}
+	return &temporalclient.ConnectionOptions{
+		TLS: &tls.Config{
+			Certificates: t.config.AuthCertificates,
+			MinVersion:   tls.VersionTLS13,
+		},
+	}
+}

worker/charts/worker/templates/deployment.yaml

@@ -4,6 +4,7 @@ metadata:
   name: {{ template "neosync-worker.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
+      {{- include "neosync-worker.labels" . | nindent 4 }}
     {{- if eq .Values.datadog.enabled true }}
     tags.datadoghq.com/env: {{ .Values.nucleusEnv }}
     tags.datadoghq.com/service: {{ template "neosync-worker.fullname" . }}
@@ -25,8 +26,8 @@ spec:
         {{- end }}
         rollme: {{ randAlphaNum 5 | quote }} # causes deployment to always roll on helm upgrade
       labels:
+        {{- include "neosync-worker.labels" . | nindent 8 }}
         app: {{ template "neosync-worker.fullname" . }}
-        version: v1
         {{- if eq .Values.istio.enabled true }}
         sidecar.istio.io/inject: "true"
         {{- end }}
@@ -46,6 +47,11 @@ spec:
       {{- end }}
       terminationGracePeriod: {{ .Values.terminationGracePeriod }}
 
+      {{- with .Values.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+
       containers:
         - name: user-container
           image: '{{ .Values.image.repository | default "ghcr.io/nucleuscloud/neosync/worker" }}:{{ .Values.image.tag | default .Chart.AppVersion  }}'
@@ -67,6 +73,12 @@ spec:
             failureThreshold: 2
             successThreshold: 1
             initialDelaySeconds: 1
+
+          {{- with .Values.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+
           env:
             - name: HOST_IP
               valueFrom:

worker/charts/worker/templates/env-vars.yaml

@@ -33,4 +33,20 @@ stringData:
     TEMPORAL_TASK_QUEUE: {{ .Values.temporal.taskQueue }}
     {{- end }}
 
+    {{- if and .Values.temporal .Values.temporal.certificate .Values.temporal.certificate.keyFilePath }}
+    TEMPORAL_CERT_KEY_PATH: {{ .Values.temporal.certificate.keyFilePath }}
+    {{- end }}
+
+    {{- if and .Values.temporal .Values.temporal.certificate .Values.temporal.certificate.certFilePath }}
+    TEMPORAL_CERT_PATH: {{ .Values.temporal.certificate.certFilePath }}
+    {{- end }}
+
+    {{- if and .Values.temporal .Values.temporal.certificate .Values.temporal.certificate.keyContents }}
+    TEMPORAL_CERT_KEY: {{ .Values.temporal.certificate.keyContents }}
+    {{- end }}
+
+    {{- if and .Values.temporal .Values.temporal.certificate .Values.temporal.certificate.certContents }}
+    TEMPORAL_CERT: {{ .Values.temporal.certificate.certContents }}
+    {{- end }}
+
     NEOSYNC_URL: {{ .Values.neosync.url }}

worker/charts/worker/templates/service.yaml

@@ -4,6 +4,7 @@ metadata:
   name: {{ template "neosync-worker.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
+    {{- include "neosync-worker.labels" . | nindent 4 }}
     app: {{ template "neosync-worker.fullname" . }}
 spec:
   ports: