Only enable TLS if a key and cert are present.

temporalio · Dec 20, 2023 · 7820809 · 7820809
1 parent 55186b7
commit 7820809
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 12 deletions.
diff --git a/cmd/runner/main.go b/cmd/runner/main.go
@@ -52,9 +52,10 @@ func main() {
 	tlsKeyPath := os.Getenv("TEMPORAL_TLS_KEY")
 	tlsCertPath := os.Getenv("TEMPORAL_TLS_CERT")
 	tlsCaPath := os.Getenv("TEMPORAL_TLS_CA")
-	tlsConfig := tls.Config{}
 
 	if tlsKeyPath != "" && tlsCertPath != "" {
+		tlsConfig := tls.Config{}
+
 		cert, err := tls.LoadX509KeyPair(tlsCertPath, tlsKeyPath)
 		if err != nil {
 			log.Fatalln("Unable to create key pair for TLS", err)
@@ -73,13 +74,13 @@ func main() {
 
 		tlsConfig.Certificates = []tls.Certificate{cert}
 		tlsConfig.RootCAs = tlsCaPool
-	}
 
-	if os.Getenv("TEMPORAL_TLS_DISABLE_HOST_VERIFICATION") != "" {
-		tlsConfig.InsecureSkipVerify = true
-	}
+		if os.Getenv("TEMPORAL_TLS_DISABLE_HOST_VERIFICATION") != "" {
+			tlsConfig.InsecureSkipVerify = true
+		}
 
-	clientOptions.ConnectionOptions.TLS = &tlsConfig
+		clientOptions.ConnectionOptions.TLS = &tlsConfig
+	}
 
 	if os.Getenv("PROMETHEUS_ENDPOINT") != "" {
 		clientOptions.MetricsHandler = sdktally.NewMetricsHandler(newPrometheusScope(prometheus.Configuration{

diff --git a/cmd/worker/main.go b/cmd/worker/main.go
@@ -35,9 +35,10 @@ func main() {
 	tlsKeyPath := os.Getenv("TEMPORAL_TLS_KEY")
 	tlsCertPath := os.Getenv("TEMPORAL_TLS_CERT")
 	tlsCaPath := os.Getenv("TEMPORAL_TLS_CA")
-	tlsConfig := tls.Config{}
 
 	if tlsKeyPath != "" && tlsCertPath != "" {
+		tlsConfig := tls.Config{}
+
 		cert, err := tls.LoadX509KeyPair(tlsCertPath, tlsKeyPath)
 		if err != nil {
 			log.Fatalln("Unable to create key pair for TLS", err)
@@ -56,13 +57,13 @@ func main() {
 
 		tlsConfig.Certificates = []tls.Certificate{cert}
 		tlsConfig.RootCAs = tlsCaPool
-	}
 
-	if os.Getenv("TEMPORAL_TLS_DISABLE_HOST_VERIFICATION") != "" {
-		tlsConfig.InsecureSkipVerify = true
-	}
+		if os.Getenv("TEMPORAL_TLS_DISABLE_HOST_VERIFICATION") != "" {
+			tlsConfig.InsecureSkipVerify = true
+		}
 
-	clientOptions.ConnectionOptions.TLS = &tlsConfig
+		clientOptions.ConnectionOptions.TLS = &tlsConfig
+	}
 
 	if os.Getenv("PROMETHEUS_ENDPOINT") != "" {
 		clientOptions.MetricsHandler = sdktally.NewMetricsHandler(newPrometheusScope(prometheus.Configuration{