Skip to content

Commit 40cc0e2

Browse files
shrimalmadhurshrimalmadhur
committed
add code to configure env
1 parent b7829d5 commit 40cc0e2

File tree

5 files changed

+256
-122
lines changed

5 files changed

+256
-122
lines changed

‎cmd/cerberus/flags.go

-86
This file was deleted.

‎cmd/cerberus/main.go

+111-6
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,94 @@ import (
1313

1414
var (
1515
version = "development"
16+
17+
keystoreDirFlag = &cli.StringFlag{
18+
Name: "keystore-dir",
19+
Usage: "Directory where the keystore files are stored",
20+
Value: "./data/keystore",
21+
EnvVars: []string{"KEYSTORE_DIR"},
22+
}
23+
24+
grpcPortFlag = &cli.StringFlag{
25+
Name: "grpc-port",
26+
Usage: "Port for the gRPC server",
27+
Value: "50051",
28+
EnvVars: []string{"GRPC_PORT"},
29+
}
30+
31+
metricsPortFlag = &cli.StringFlag{
32+
Name: "metrics-port",
33+
Usage: "Port for the metrics server",
34+
Value: "9091",
35+
EnvVars: []string{"METRICS_PORT"},
36+
}
37+
38+
logLevelFlag = &cli.StringFlag{
39+
Name: "log-level",
40+
Usage: "Log level - supported levels: debug, info, warn, error",
41+
Value: "info",
42+
EnvVars: []string{"LOG_LEVEL"},
43+
}
44+
45+
logFormatFlag = &cli.StringFlag{
46+
Name: "log-format",
47+
Usage: "Log format - supported formats: text, json",
48+
Value: "text",
49+
EnvVars: []string{"LOG_FORMAT"},
50+
}
51+
52+
// TLS flags to set up secure gRPC server, optional
53+
tlsCaCertFlag = &cli.StringFlag{
54+
Name: "tls-ca-cert",
55+
Usage: "TLS CA certificate",
56+
EnvVars: []string{"TLS_CA_CERT"},
57+
}
58+
59+
tlsServerKeyFlag = &cli.StringFlag{
60+
Name: "tls-server-key",
61+
Usage: "TLS server key",
62+
EnvVars: []string{"TLS_SERVER_KEY"},
63+
}
64+
65+
storageTypeFlag = &cli.StringFlag{
66+
Name: "storage-type",
67+
Usage: "Storage type - supported types: filesystem, aws-secret-manager",
68+
Value: "filesystem",
69+
EnvVars: []string{"STORAGE_TYPE"},
70+
}
71+
72+
awsRegionFlag = &cli.StringFlag{
73+
Name: "aws-region",
74+
Usage: "AWS region",
75+
Value: "us-east-2",
76+
EnvVars: []string{"AWS_REGION"},
77+
}
78+
79+
awsProfileFlag = &cli.StringFlag{
80+
Name: "aws-profile",
81+
Usage: "AWS profile",
82+
Value: "default",
83+
EnvVars: []string{"AWS_PROFILE"},
84+
}
85+
86+
awsAuthenticationModeFlag = &cli.StringFlag{
87+
Name: "aws-authentication-mode",
88+
Usage: "AWS authentication mode - supported modes: environment, specified",
89+
Value: "environment",
90+
EnvVars: []string{"AWS_AUTHENTICATION_MODE"},
91+
}
92+
93+
awsAccessKeyIDFlag = &cli.StringFlag{
94+
Name: "aws-access-key-id",
95+
Usage: "AWS access key ID",
96+
EnvVars: []string{"AWS_ACCESS_KEY_ID"},
97+
}
98+
99+
awsSecretAccessKeyFlag = &cli.StringFlag{
100+
Name: "aws-secret-access-key",
101+
Usage: "AWS secret access key",
102+
EnvVars: []string{"AWS_SECRET_ACCESS_KEY"},
103+
}
16104
)
17105

18106
func main() {
@@ -43,6 +131,7 @@ func main() {
43131
tlsServerKeyFlag,
44132
storageTypeFlag,
45133
awsRegionFlag,
134+
awsProfileFlag,
46135
awsAuthenticationModeFlag,
47136
awsAccessKeyIDFlag,
48137
awsSecretAccessKeyFlag,
@@ -67,13 +156,29 @@ func start(c *cli.Context) error {
67156
logFormat := c.String(logFormatFlag.Name)
68157
tlsCaCert := c.String(tlsCaCertFlag.Name)
69158
tlsServerKey := c.String(tlsServerKeyFlag.Name)
159+
storageType := c.String(storageTypeFlag.Name)
160+
awsRegion := c.String(awsRegionFlag.Name)
161+
awsProfile := c.String(awsProfileFlag.Name)
162+
awsAuthenticationMode := c.String(awsAuthenticationModeFlag.Name)
163+
awsAccessKeyID := c.String(awsAccessKeyIDFlag.Name)
164+
awsSecretAccessKey := c.String(awsSecretAccessKeyFlag.Name)
70165

71166
cfg := &configuration.Configuration{
72-
KeystoreDir: keystoreDir,
73-
GrpcPort: grpcPort,
74-
MetricsPort: metricsPort,
75-
TLSCACert: tlsCaCert,
76-
TLSServerKey: tlsServerKey,
167+
KeystoreDir: keystoreDir,
168+
GrpcPort: grpcPort,
169+
MetricsPort: metricsPort,
170+
TLSCACert: tlsCaCert,
171+
TLSServerKey: tlsServerKey,
172+
StorageType: storageType,
173+
AWSRegion: awsRegion,
174+
AWSProfile: awsProfile,
175+
AWSAuthenticationMode: awsAuthenticationMode,
176+
AWSAccessKeyID: awsAccessKeyID,
177+
AWSSecretAccessKey: awsSecretAccessKey,
178+
}
179+
180+
if err := cfg.Validate(); err != nil {
181+
return fmt.Errorf("invalid configuration: %v", err)
77182
}
78183

79184
sLogLevel := levelToLogLevel(logLevel)
@@ -86,7 +191,7 @@ func start(c *cli.Context) error {
86191
handler := slog.NewTextHandler(os.Stdout, &slogOptions)
87192
logger = slog.New(handler)
88193
}
89-
194+
logger.Info("using configuration", "config", cfg)
90195
logger.Info(fmt.Sprintf("Starting cerberus server version: %s", version))
91196
server.Start(cfg, logger)
92197
return nil

‎internal/configuration/configuration.go

+58
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,69 @@
11
package configuration
22

3+
import "fmt"
4+
35
type Configuration struct {
6+
StorageType string
7+
8+
// FileSystem storage parameters
49
KeystoreDir string
510

11+
// AWS Secrets Manager storage parameters
12+
AWSRegion string
13+
AWSProfile string
14+
AWSAuthenticationMode string
15+
AWSAccessKeyID string
16+
AWSSecretAccessKey string
17+
618
GrpcPort string
719
MetricsPort string
820

921
TLSCACert string
1022
TLSServerKey string
1123
}
24+
25+
func (s *Configuration) Validate() error {
26+
if s.StorageType == "" {
27+
return fmt.Errorf("storage type is required")
28+
}
29+
30+
switch s.StorageType {
31+
case "filesystem":
32+
if s.KeystoreDir == "" {
33+
return fmt.Errorf("keystore directory is required")
34+
}
35+
case "aws-secrets-manager":
36+
if s.AWSRegion == "" {
37+
return fmt.Errorf("AWS region is required")
38+
}
39+
40+
if s.AWSAuthenticationMode == "specified" {
41+
if s.AWSAccessKeyID == "" {
42+
return fmt.Errorf("AWS access key ID is required")
43+
}
44+
if s.AWSSecretAccessKey == "" {
45+
return fmt.Errorf("AWS secret access key is required")
46+
}
47+
}
48+
default:
49+
return fmt.Errorf("unsupported storage type: %s", s.StorageType)
50+
}
51+
52+
if s.GrpcPort == "" {
53+
return fmt.Errorf("gRPC port is required")
54+
}
55+
56+
if s.MetricsPort == "" {
57+
return fmt.Errorf("metrics port is required")
58+
}
59+
60+
if s.TLSCACert != "" && s.TLSServerKey == "" {
61+
return fmt.Errorf("TLS server key is required when TLS CA certificate is provided")
62+
}
63+
64+
if s.TLSServerKey != "" && s.TLSCACert == "" {
65+
return fmt.Errorf("TLS CA certificate is required when TLS server key is provided")
66+
}
67+
68+
return nil
69+
}

‎internal/server/server.go

+37-1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ import (
88
"net/http"
99
"os"
1010

11+
"github.com/Layr-Labs/cerberus/internal/store"
12+
"github.com/Layr-Labs/cerberus/internal/store/awssecretmanager"
13+
1114
"github.com/prometheus/client_golang/prometheus"
1215
"github.com/prometheus/client_golang/prometheus/collectors"
1316
"github.com/prometheus/client_golang/prometheus/promhttp"
@@ -40,7 +43,40 @@ func Start(config *configuration.Configuration, logger *slog.Logger) {
4043

4144
go startMetricsServer(registry, config.MetricsPort, logger)
4245

43-
keystore := filesystem.NewStore(config.KeystoreDir, logger)
46+
var keystore store.Store
47+
switch config.StorageType {
48+
case "filesystem":
49+
keystore = filesystem.NewStore(config.KeystoreDir, logger)
50+
case "aws-secrets-manager":
51+
switch config.AWSAuthenticationMode {
52+
case "environment":
53+
keystore, err = awssecretmanager.NewStoreWithEnv(
54+
config.AWSRegion,
55+
config.AWSProfile,
56+
logger,
57+
)
58+
if err != nil {
59+
logger.Error(fmt.Sprintf("Failed to create AWS Secret Manager store: %v", err))
60+
os.Exit(1)
61+
}
62+
logger.Info("Using environment credentials for AWS Secret Manager")
63+
case "specified":
64+
keystore, err = awssecretmanager.NewStoreWithSpecifiedCredentials(
65+
config.AWSRegion,
66+
config.AWSAccessKeyID,
67+
config.AWSSecretAccessKey,
68+
logger,
69+
)
70+
if err != nil {
71+
logger.Error(fmt.Sprintf("Failed to create AWS Secret Manager store: %v", err))
72+
os.Exit(1)
73+
}
74+
logger.Info("Using specified credentials for AWS Secret Manager")
75+
}
76+
default:
77+
logger.Error(fmt.Sprintf("Unsupported storage type: %s", config.StorageType))
78+
os.Exit(1)
79+
}
4480

4581
var opts []grpc.ServerOption
4682
if config.TLSCACert != "" && config.TLSServerKey != "" {

0 commit comments

Comments
 (0)