Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow loopd autogenerated TLS cert validity override with a new flag #614

Merged
merged 2 commits into from
Jul 27, 2023
Merged

Allow loopd autogenerated TLS cert validity override with a new flag #614

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
123d531
Allow loopd autogenerated TLS cert validity override with a new loopd…
gcaracuel Jul 27, 2023
7b31f1f
Update loopd/config.go
gcaracuel Jul 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 17 additions & 11 deletions loopd/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,9 +99,8 @@ var (
)

// DefaultAutogenValidity is the default validity of a self-signed
// certificate. The value corresponds to 14 months
// (14 months * 30 days * 24 hours).
DefaultAutogenValidity = 14 * 30 * 24 * time.Hour
// certificate in number of days.
DefaultAutogenValidity = 365 * 24 * time.Hour
)

type lndConfig struct {
Expand Down Expand Up @@ -146,12 +145,13 @@ type Config struct {
Sqlite *loopdb.SqliteConfig `group:"sqlite" namespace:"sqlite"`
Postgres *loopdb.PostgresConfig `group:"postgres" namespace:"postgres"`

TLSCertPath string `long:"tlscertpath" description:"Path to write the TLS certificate for loop's RPC and REST services."`
TLSKeyPath string `long:"tlskeypath" description:"Path to write the TLS private key for loop's RPC and REST services."`
TLSExtraIPs []string `long:"tlsextraip" description:"Adds an extra IP to the generated certificate."`
TLSExtraDomains []string `long:"tlsextradomain" description:"Adds an extra domain to the generated certificate."`
TLSAutoRefresh bool `long:"tlsautorefresh" description:"Re-generate TLS certificate and key if the IPs or domains are changed."`
TLSDisableAutofill bool `long:"tlsdisableautofill" description:"Do not include the interface IPs or the system hostname in TLS certificate, use first --tlsextradomain as Common Name instead, if set."`
TLSCertPath string `long:"tlscertpath" description:"Path to write the TLS certificate for loop's RPC and REST services."`
TLSKeyPath string `long:"tlskeypath" description:"Path to write the TLS private key for loop's RPC and REST services."`
TLSExtraIPs []string `long:"tlsextraip" description:"Adds an extra IP to the generated certificate."`
TLSExtraDomains []string `long:"tlsextradomain" description:"Adds an extra domain to the generated certificate."`
TLSAutoRefresh bool `long:"tlsautorefresh" description:"Re-generate TLS certificate and key if the IPs or domains are changed."`
TLSDisableAutofill bool `long:"tlsdisableautofill" description:"Do not include the interface IPs or the system hostname in TLS certificate, use first --tlsextradomain as Common Name instead, if set."`
TLSValidity time.Duration `long:"tlsvalidity" description:"Loop's TLS certificate validity period in days. Defaults to 8760h (1 year)"`

MacaroonPath string `long:"macaroonpath" description:"Path to write the macaroon for loop's RPC and REST services if it doesn't exist."`

Expand Down Expand Up @@ -204,6 +204,7 @@ func DefaultConfig() Config {
DebugLevel: defaultLogLevel,
TLSCertPath: DefaultTLSCertPath,
TLSKeyPath: DefaultTLSKeyPath,
TLSValidity: DefaultAutogenValidity,
MacaroonPath: DefaultMacaroonPath,
MaxLSATCost: lsat.DefaultMaxCostSats,
MaxLSATFee: lsat.DefaultMaxRoutingFeeSats,
Expand Down Expand Up @@ -348,7 +349,12 @@ func Validate(cfg *Config) error {

// At least one retry.
if cfg.MaxPaymentRetries < 1 {
return fmt.Errorf("max payment retries must be positive")
return fmt.Errorf("max payment retries must be at least 1")
}

// TLS Validity period to be at least 24 hours
if cfg.TLSValidity < time.Hour*24 {
return fmt.Errorf("TLS certificate minimum validity period is 24h")
}

return nil
Expand Down Expand Up @@ -415,7 +421,7 @@ func loadCertWithCreate(cfg *Config) (tls.Certificate, *x509.Certificate,
certBytes, keyBytes, err := cert.GenCertPair(
defaultSelfSignedOrganization, cfg.TLSExtraIPs,
cfg.TLSExtraDomains, cfg.TLSDisableAutofill,
DefaultAutogenValidity,
cfg.TLSValidity,
)
if err != nil {
return tls.Certificate{}, nil, err
Expand Down
Loading