git.iko.soy/obelisk
on master help sign in
Merge pull request #560 from obsidiansystems/jg-tls-support-for-ob-run

Support https with ob run

commit33abe006336ef3a5d34f52a71014cc2129256f93 authorAli Abrar <aliabrar@gmail.com> dateSat 23 Nov 2019, 21:59 (7 years ago) parent98bd078f14ad01
4 files changed+43−1
compare with master
unifiedsplit
ChangeLog.md+1 README.md+7 lib/run/obelisk-run.cabal+4 lib/run/src/Obelisk/Run.hs+31−1
ChangeLog.md+1
@@ -13,6 +13,7 @@ This project's release branch is `master`. This log is written from the perspect
1313* Use a `--pure` nix shell in `ob run` for parity with `ob repl` and more resilience against "works on my machine".
1414* Use `--keep NIX_PATH` for all pure shells so references to `<nixpkgs>` continues to work.
1515* Backport ACMEv2 support in obelisk server to regain LetsEncrypt account creation.
16+* Enable https in `ob run`
1617
1718## v0.2.0.0 - 2019-8-17
1819
README.md+7
@@ -7,6 +7,7 @@ Obelisk provides an easy way to develop and deploy your [Reflex](https://github.
77 - [Hoogle](#hoogle)
88 - [Adding Packages](#adding-packages)
99 - [Adding Package Overrides](#adding-package-overrides)
10+ - [Running over https](#running-over-https)
1011- [Deploying](#deploying)
1112 - [Locally](#locally)
1213 - [EC2](#ec2)
@@ -149,6 +150,12 @@ project ./. ({ pkgs, ... }: {
149150
150151For further information see [the Haskell section](https://nixos.org/nixpkgs/manual/#users-guide-to-the-haskell-infrastructure) of nixpkgs Contributors Guide.
151152
153+### Running over https
154+
155+To run your app locally over https, update the protocol in `config/common/route` to `https`, and then use `ob run` as normal.
156+
157+Since Obelisk generates a self-signed certificate for running https, the browser will issue a warning about using an invalid certificate. On Chrome, you can go to `chrome://flags/#allow-insecure-localhost` to enable invalid certificates for localhost.
158+
152159## Deploying
153160
154161### Locally
lib/run/obelisk-run.cabal+4
@@ -15,6 +15,7 @@ library
1515 , dependent-sum
1616 , dependent-sum-template
1717 , ghcjs-dom
18+ , HsOpenSSL
1819 , http-client
1920 , http-reverse-proxy
2021 , http-types
@@ -36,10 +37,13 @@ library
3637 , snap-core
3738 , streaming-commons
3839 , text
40+ , time
3941 , universe
42+ , utf8-string
4043 , wai
4144 , wai-websockets
4245 , warp
46+ , warp-tls
4347 , websockets
4448 exposed-modules:
4549 Obelisk.Run
lib/run/src/Obelisk/Run.hs+31−1
@@ -23,6 +23,7 @@ import Data.ByteString (ByteString)
2323import qualified Data.ByteString as BS
2424import qualified Data.ByteString.Char8 as BSC
2525import qualified Data.ByteString.Lazy.Char8 as BSLC
26+import qualified Data.ByteString.UTF8 as BSUTF8
2627import Data.Functor.Identity
2728import Data.List (uncons)
2829import Data.Map (Map)
@@ -34,6 +35,7 @@ import Data.String (fromString)
3435import Data.Text (Text)
3536import qualified Data.Text as T
3637import qualified Data.Text.Encoding as T
38+import Data.Time.Clock (getCurrentTime, addUTCTime)
3739import Language.Javascript.JSaddle.Run (syncPoint)
3840import Language.Javascript.JSaddle.WebSockets
3941import Network.HTTP.Client (Manager, defaultManagerSettings, newManager)
@@ -43,6 +45,7 @@ import Network.Socket
4345import Network.Wai (Application)
4446import qualified Network.Wai as W
4547import Network.Wai.Handler.Warp
48+import Network.Wai.Handler.WarpTLS
4649import Network.Wai.Handler.Warp.Internal (settingsHost, settingsPort)
4750import Network.WebSockets (ConnectionOptions)
4851import Network.WebSockets.Connection (defaultConnectionOptions)
@@ -50,6 +53,10 @@ import qualified Obelisk.Asset.Serve.Snap as Snap
5053import Obelisk.Backend
5154import Obelisk.Frontend
5255import Obelisk.Route.Frontend
56+import qualified OpenSSL.PEM as PEM
57+import qualified OpenSSL.RSA as RSA
58+import qualified OpenSSL.X509 as X509
59+import qualified OpenSSL.X509.Request as X509Request
5360import Reflex.Dom.Core
5461import Snap.Core (Snap)
5562import System.Environment
@@ -113,13 +120,36 @@ runWidget conf configs frontend validFullEncoder = do
113120 beforeMainLoop = do
114121 putStrLn $ "Frontend running on " <> T.unpack (URI.render uri)
115122 settings = setBeforeMainLoop beforeMainLoop (setPort port (setTimeout 3600 defaultSettings))
123+ -- Providing TLS here will also incidentally provide it to proxied requests to the backend.
124+ prepareRunner = case (uri ^? uriScheme . _Just . unRText) of
125+ Just "https" -> do
126+ -- Generate a private key and self-signed certificate for TLS
127+ privateKey <- RSA.generateRSAKey' 2048 3
128+
129+ certRequest <- X509Request.newX509Req
130+ _ <- X509Request.setPublicKey certRequest privateKey
131+ _ <- X509Request.signX509Req certRequest privateKey Nothing
132+
133+ cert <- X509.newX509 >>= X509Request.makeX509FromReq certRequest
134+ _ <- X509.setPublicKey cert privateKey
135+ now <- getCurrentTime
136+ _ <- X509.setNotBefore cert $ addUTCTime (-1) now
137+ _ <- X509.setNotAfter cert $ addUTCTime (365 * 24 * 60 * 60) now
138+ _ <- X509.signX509 cert privateKey Nothing
139+
140+ certByteString <- BSUTF8.fromString <$> PEM.writeX509 cert
141+ privateKeyByteString <- BSUTF8.fromString <$> PEM.writePKCS8PrivateKey privateKey Nothing
142+
143+ return $ runTLSSocket (tlsSettingsMemory certByteString privateKeyByteString)
144+ _ -> return runSettingsSocket
145+ runner <- prepareRunner
116146 bracket
117147 (bindPortTCPRetry settings (logPortBindErr port) (_runConfig_retryTimeout conf))
118148 close
119149 (\skt -> do
120150 man <- newManager defaultManagerSettings
121151 app <- obeliskApp configs defaultConnectionOptions frontend validFullEncoder uri $ fallbackProxy redirectHost redirectPort man
122− runSettingsSocket settings skt app)
152+ runner settings skt app)
123153
124154obeliskApp
125155 :: forall frontendRoute backendRoute