properly setup TLS auth and example

docker-swarm-multitenant-proxy/bin/www

@@ -13,6 +13,8 @@ const PORT = process.env.PORT || 8080;
 let server;
 const TLS_DISABLED = process.env.TLS_DISABLED === '1' || process.env.TLS_DISABLED === 'true';
 if (!TLS_DISABLED) {
+  const fs = require('fs');
+  const https = require('https');
   console.log('TLS is enabled');
 
   if(!process.env.TLS_KEY_FILE || !process.env.TLS_CERT_FILE || !process.env.TLS_CA_FILE) {
@@ -26,6 +28,9 @@ if (!TLS_DISABLED) {
     rejectUnauthorized: true // Reject any connection not authorized with the CA certificate
   };
   server = https.createServer(options, app);
+  server.listen(PORT, function () {
+    console.log(`Docker Swarm Multitenant Proxy is ready and listening on port ${PORT}`);
+  });
 } else {
   console.warn('WARNING: TLS is disabled. Only use this in development.');
   server = app.listen(PORT, function () {

docker-swarm-multitenant-proxy/package.json

@@ -5,7 +5,8 @@
   "main": "index.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1",
-    "run-dev": "TLS_DISABLED=1 OWNER_LABEL_VALUE=${OWNER_LABEL_VALUE:-some-owner} ts-node bin/www"
+    "run-dev": "OWNER_LABEL_VALUE=${OWNER_LABEL_VALUE:-some-owner} ts-node bin/www",
+    "run-dev-without-tls": "TLS_DISABLED=1 OWNER_LABEL_VALUE=${OWNER_LABEL_VALUE:-some-owner} ts-node bin/www"
   },
   "keywords": [],
   "author": "",

test/.gitignore

@@ -0,0 +1,3 @@
+*.pem
+*.srl
+*.cnf

test/dockerWithTls.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+TLS_CERT_FILE="$(pwd)/client-cert.pem"
+TLS_KEY_FILE="$(pwd)/client-key.pem"
+TLS_CA_FILE="$(pwd)/ca-cert.pem"
+
+exec docker --tls --tlsverify --tlskey "$TLS_KEY_FILE" --tlscert "$TLS_CERT_FILE" --tlscacert "$TLS_CA_FILE"  -H localhost:8080 "$@"

test/generate_certs.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+
+# Define variables
+CA_KEY="ca-key.pem"
+CA_CERT="ca-cert.pem"
+SERVER_KEY="server-key.pem"
+SERVER_CSR="server-csr.pem"
+SERVER_CERT="server-cert.pem"
+SERVER_EXT="server-ext.cnf"
+CLIENT_KEY="client-key.pem"
+CLIENT_CSR="client-csr.pem"
+CLIENT_CERT="client-cert.pem"
+CLIENT_EXT="client-ext.cnf"
+
+# Generate CA key and certificate
+openssl genrsa -out $CA_KEY 4096
+openssl req -new -x509 -key $CA_KEY -sha256 -out $CA_CERT -days 365 -subj "/CN=MyCA"
+
+# Create server config file for SAN
+cat > $SERVER_EXT <<- "EOF"
+[req]
+distinguished_name = req_distinguished_name
+req_extensions = v3_req
+[req_distinguished_name]
+[ v3_req ]
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = localhost
+DNS.2 = example.com
+EOF
+
+# Generate server key and CSR
+openssl genrsa -out $SERVER_KEY 4096
+openssl req -new -key $SERVER_KEY -out $SERVER_CSR -subj "/CN=localhost" -config $SERVER_EXT
+
+# Sign the server CSR with the CA certificate to get the server certificate
+openssl x509 -req -in $SERVER_CSR -CA $CA_CERT -CAkey $CA_KEY -CAcreateserial -out $SERVER_CERT -days 365 -extensions v3_req -extfile $SERVER_EXT
+
+# Create client config file for SAN
+cat > $CLIENT_EXT <<- "EOF"
+[req]
+distinguished_name = req_distinguished_name
+req_extensions = v3_req
+[req_distinguished_name]
+[ v3_req ]
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = client.example.com
+EOF
+
+# Generate client key and CSR
+openssl genrsa -out $CLIENT_KEY 4096
+openssl req -new -key $CLIENT_KEY -out $CLIENT_CSR -subj "/CN=Client" -config $CLIENT_EXT
+
+# Sign the client CSR with the CA certificate to get the client certificate
+openssl x509 -req -in $CLIENT_CSR -CA $CA_CERT -CAkey $CA_KEY -CAcreateserial -out $CLIENT_CERT -days 365 -extensions v3_req -extfile $CLIENT_EXT
+
+echo "Certificates with SANs generated successfully."

test/runWithTls.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+export TLS_CERT_FILE="$(pwd)/server-cert.pem"
+export TLS_KEY_FILE="$(pwd)/server-key.pem"
+export TLS_CA_FILE="$(pwd)/ca-cert.pem"
+
+cd ../docker-swarm-multitenant-proxy
+exec npm run run-dev