Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add OCSP/CRL support #61

Merged
merged 56 commits into from
Mar 28, 2024
Merged

Add OCSP/CRL support #61

merged 56 commits into from
Mar 28, 2024

Conversation

rambo
Copy link
Contributor

@rambo rambo commented Nov 26, 2023 •
edited
Loading

@rambo rambo mentioned this pull request Nov 26, 2023
Closed
@rambo rambo marked this pull request as draft November 26, 2023 20:52
@rambo rambo changed the title DRAFT: Add OCSP support (from 1.0.0 main) DRAFT: Add OCSP/CRL support (from 1.0.0 main) Jan 29, 2024
@rambo rambo mentioned this pull request Feb 26, 2024
Closed
@rambo rambo changed the title DRAFT: Add OCSP/CRL support (from 1.0.0 main) Add OCSP/CRL support Mar 1, 2024
rambo added 22 commits March 1, 2024 14:12
@rambo
Start adding support for the new ocsp helper
a460a99
@rambo
trying to figure out actually working config for either OCSP or CRL
e3b5752
@rambo
update tags for cfssl and rmapi containers
fc1b750
@rambo
Try to put HAProxy with CRL watched in front of webtak and COT to pre…
2194e45 
…vent revoked users from connecting (reloading TAK itself is sloooow)
@rambo
add missing network to rmapi
d16d031
@rambo
call dump_crl also when calling ocsp refresh
c09cea2
@rambo
enable CRL checking
194b40b
@rambo
attempt to use caddy CRL refresh plugin
f3ed743
@rambo
fix typo, it does not do what we want though, TLS is terminated inste…
f815e8a 
…ad of passed through
@rambo
do not attempt to haproxy tak traffic
c0934ce
@rambo
build custom nginx with inotify watcher for CRL
55bafbe
@rambo
use the nginx we build ourself
4040e4a
@rambo
minor updates to productapi handling
a3ce13c
@rambo
production side does not need long JWT lifetimes, mTLS is used
1287c4a
@rambo
improvements to promoting and demoting users via takrmapi
29acef9
@rambo
we cannot both check mTLS cert validity and passthrough TLS at the sa…
c2af697 
…me time, also it seems TAKServer at least can auto-reload the CRL when the file changes
@rambo
update submodule pointers
4d3ac8f
@rambo
add healthcheck commands to rm api containers
2ca2a27
@rambo
Add healthcheck endpoint to nginxes
e8b44df
@rambo
healthcheck *MUST* exit with 1 (any nonzero code is not accepted) on …
3806a53 
…failure
@rambo
auto-restart unhealthy containers (that have the autoheal label)
417aa21
@rambo
make productapi nginx use the same shared resource style as the others
fecf513
rambo added 2 commits March 1, 2024 14:39
@rambo
Fix missed merge conflict
37c7574
@rambo
bump versions of the containers, sadly they do not match versioning i…
1c34e6f 
…n the components or git tags because we have not gotten our procedures mailed down
@rambo rambo marked this pull request as ready for review March 1, 2024 13:02
@rambo
add versioning to the tak and nginx tags as well so we do not acciden…
e58f64f 
…tally break production tags when building new containers of the same takserver/nginx version
@rambo rambo mentioned this pull request Mar 3, 2024
Closed
This was referenced Mar 22, 2024
Closed
Closed
@rambo rambo merged commit af3f0e8 into main Mar 28, 2024
5 checks passed
@rambo rambo deleted the ocsp_redux branch March 28, 2024 16:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Add heathchecks for FastAPI containers
1 participant
@rambo