@@ -17,6 +17,7 @@ module Network.Wai.Handler.WarpTLS (
1717 , tlsCiphers
1818 , defaultTlsSettings
1919 , tlsSettings
20+ , tlsSettingsMemory
2021 , OnInsecure (..)
2122 -- * Runner
2223 , runTLS
@@ -29,6 +30,7 @@ import qualified Network.TLS as TLS
2930import Network.Wai.Handler.Warp
3031import Network.Wai (Application)
3132import Network.Socket (Socket, sClose, withSocketsDo, SockAddr)
33+import qualified Data.ByteString as S
3234import qualified Data.ByteString.Lazy as L
3335import Control.Exception (bracket, finally, handle, fromException, try, IOException)
3436import qualified Network.TLS.Extra as TLSExtra
@@ -53,6 +55,8 @@ data TLSSettings = TLSSettings {
5355 certFile :: FilePath
5456 -- ^ File containing the certificate.
5557 , keyFile :: FilePath
58+ , certMemory :: Maybe S.ByteString
59+ , keyMemory :: Maybe S.ByteString
5660 -- ^ File containing the key
5761 , onInsecure :: OnInsecure
5862 -- ^ Do we allow insecure connections with this server as well? Default
@@ -84,6 +88,8 @@ defaultTlsSettings :: TLSSettings
8488defaultTlsSettings = TLSSettings {
8589 certFile = "certificate.pem"
8690 , keyFile = "key.pem"
91+ , certMemory = Nothing
92+ , keyMemory = Nothing
8793 , onInsecure = DenyInsecure "This server only accepts secure HTTPS connections."
8894 , tlsLogging = def
8995 , tlsAllowedVersions = [TLS.SSL3,TLS.TLS10,TLS.TLS11,TLS.TLS12]
@@ -116,8 +122,22 @@ tlsSettings cert key = defaultTlsSettings {
116122 , keyFile = key
117123 }
118124
125+-- | A smart constructor for 'TLSSettings', but uses in-memory representations
126+-- of the certificate and key
127+--
128+-- Since 3.0.1
129+tlsSettingsMemory
130+ :: S.ByteString -- ^ Certificate bytes
131+ -> S.ByteString -- ^ Key bytes
132+ -> TLSSettings
133+tlsSettingsMemory cert key = defaultTlsSettings
134+ { certMemory = Just cert
135+ , keyMemory = Just key
136+ }
137+
119138----------------------------------------------------------------
120139
140+
121141-- | Running 'Application' with 'TLSSettings' and 'Settings'.
122142runTLS :: TLSSettings -> Settings -> Application -> IO ()
123143runTLS tset set app = withSocketsDo $
@@ -132,7 +152,12 @@ runTLS tset set app = withSocketsDo $
132152-- specified 'Socket'.
133153runTLSSocket :: TLSSettings -> Settings -> Socket -> Application -> IO ()
134154runTLSSocket tlsset@TLSSettings{..} set sock app = do
135− credential <- either error id <$> TLS.credentialLoadX509 certFile keyFile
155+ credential <- case (certMemory, keyMemory) of
156+ (Nothing, Nothing) -> either error id <$> TLS.credentialLoadX509 certFile keyFile
157+ (mcert, mkey) -> do
158+ cert <- maybe (S.readFile certFile) return mcert
159+ key <- maybe (S.readFile keyFile) return mkey
160+ either error return $ TLS.credentialLoadX509FromMemory cert key
136161 runTLSSocket' tlsset set credential sock app
137162
138163runTLSSocket' :: TLSSettings -> Settings -> TLS.Credential -> Socket -> Application -> IO ()