feat: tls termination handled by tonic server

Cargo.toml

@@ -27,7 +27,7 @@ strum = { version = "0.26.3", features = ["derive"] }
 thiserror = "1.0.64"
 time = "0.3"
 tokio = { version = "1.40.0", features = ["full"] }
-tonic = "0.12.2"
+tonic = { version = "0.12.2", features = ["tls"] }
 tonic-reflection = "0.12.2"
 tower = "0.5.1"
 tracing = "0.1.40"

src/config.rs

@@ -16,6 +16,10 @@ pub struct Config {
     pub jwt_secret: SecretString,
     /// The base URI for snapcraft.io
     pub snapcraft_io_uri: String,
+    /// The path to the tls keychain
+    pub tls_keychain_path: Option<String>,
+    /// The path to the tls private key
+    pub tls_key_path: Option<String>,
 }
 
 impl Config {

src/context.rs

@@ -10,6 +10,7 @@ pub struct Context {
     pub config: Config,
     pub jwt_encoder: JwtEncoder,
     pub http_client: reqwest::Client,
+
     /// In progress category updates that we need to block on
     pub category_updates: Mutex<HashMap<String, Arc<Notify>>>,
 }

src/grpc/mod.rs

@@ -1,6 +1,10 @@
 use crate::{db, jwt::JwtVerifier, middleware::AuthLayer, Context};
-use std::net::SocketAddr;
-use tonic::{transport::Server, Status};
+use std::{fs::read_to_string, net::SocketAddr};
+use tonic::{
+    transport::{Identity, Server, ServerTlsConfig},
+    Status,
+};
+use tracing::warn;
 
 mod app;
 mod charts;
@@ -20,7 +24,26 @@ pub async fn run_server(ctx: Context) -> Result<(), Box<dyn std::error::Error>>
     let verifier = JwtVerifier::from_secret(&ctx.config.jwt_secret)?;
     let addr: SocketAddr = ctx.config.socket().parse()?;
 
-    Server::builder()
+    let keychain_path = ctx.config.tls_keychain_path.clone();
+    let key_path = ctx.config.tls_key_path.clone();
+
+    let builder = match (keychain_path, key_path) {
+        (Some(keychain_path), Some(key_path)) => {
+            let keychain = read_to_string(keychain_path)?;
+            let key = read_to_string(key_path)?;
+            let identity = Identity::from_pem(keychain, key);
+            Server::builder().tls_config(ServerTlsConfig::new().identity(identity))?
+        }
+        (Some(_), None) | (None, Some(_)) => {
+            panic!("Both TLS keychain and private key must be provided, or neither.");
+        }
+        (None, None) => {
+            warn!("TLS is not configured as the environment variables are not set.");
+            Server::builder()
+        }
+    };
+
+    builder
         .layer(AuthLayer::new(verifier))
         .add_service(RatingService::new_server())
         .add_service(ChartService::new_server())