TLS support

[gocheese.git] / gocheese.go

diff --git a/gocheese.go b/gocheese.go
index 26c2c27ba74673cda10e03eb6b44e31ee924920f..2245d5cafc5743f6b1a6a73d9464497437c0c5cb 100644 (file)
--- a/gocheese.go
+++ b/gocheese.go
@@ -68,6 +68,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.`
 var (
        root             = flag.String("root", "./packages", "Path to packages directory")
        bind             = flag.String("bind", "[::]:8080", "Address to bind to")
+       tlsCert          = flag.String("tls-cert", "", "Path to TLS X.509 certificate")
+       tlsKey           = flag.String("tls-key", "", "Path to TLS X.509 private key")
        norefreshURLPath = flag.String("norefresh", "/norefresh/", "Non-refreshing URL path")
        refreshURLPath   = flag.String("refresh", "/simple/", "Auto-refreshing URL path")
        pypiURL          = flag.String("pypi", "https://pypi.org/simple/", "Upstream PyPI URL")
@@ -445,21 +447,27 @@ func main() {
                refreshPasswd()
                return
        }
+       if (*tlsCert != "" && *tlsKey == "") || (*tlsCert == "" && *tlsKey != "") {
+               log.Fatalln("Both -tls-cert and -tls-key are required")
+       }
        refreshPasswd()
        log.Println("root:", *root, "bind:", *bind)
-       needsRefreshPasswd := make(chan os.Signal, 0)
-       needsShutdown := make(chan os.Signal, 0)
-       killed := make(chan error, 0)
-       http.HandleFunc(*norefreshURLPath, handler)
-       http.HandleFunc(*refreshURLPath, handler)
+
        ln, err := net.Listen("tcp", *bind)
        if err != nil {
                log.Fatal(err)
        }
-       s := &http.Server{
+       ln = netutil.LimitListener(ln, *maxClients)
+       server := &http.Server{
                ReadTimeout:  time.Minute,
                WriteTimeout: time.Minute,
        }
+       http.HandleFunc(*norefreshURLPath, handler)
+       http.HandleFunc(*refreshURLPath, handler)
+
+       needsRefreshPasswd := make(chan os.Signal, 0)
+       needsShutdown := make(chan os.Signal, 0)
+       killed := make(chan error, 0)
        signal.Notify(needsRefreshPasswd, syscall.SIGHUP)
        signal.Notify(needsShutdown, syscall.SIGTERM, syscall.SIGINT)
        go func() {
@@ -474,8 +482,14 @@ func main() {
                ctx, cancel := context.WithTimeout(context.TODO(), time.Minute)
                killed <- s.Shutdown(ctx)
                cancel()
-       }(s)
-       if err := s.Serve(netutil.LimitListener(ln, *maxClients)); err != http.ErrServerClosed {
+       }(server)
+
+       if *tlsCert == "" {
+               err = server.Serve(ln)
+       } else {
+               err = server.ServeTLS(ln, *tlsCert, *tlsKey)
+       }
+       if err != http.ErrServerClosed {
                log.Fatal(err)
        }
        if err := <-killed; err != nil {