use ssl cert of server for healthchecks

neuroforgede · Nov 12, 2023 · d239529 · d239529
1 parent d3a42cb
commit d239529
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 5 deletions.
diff --git a/deploy/stack.yml b/deploy/stack.yml
@@ -2,7 +2,7 @@ version: '3.8'
 
 services:
   app:
-    image: ghcr.io/s4ke/docker-swarm-multitenant-proxy:0.2.2
+    image: ghcr.io/s4ke/docker-swarm-multitenant-proxy:0.2.3
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
     environment:

diff --git a/docker-swarm-multitenant-proxy/healthcheck.ts b/docker-swarm-multitenant-proxy/healthcheck.ts
@@ -1,16 +1,24 @@
 // adapted from https://github.com/BretFisher/node-docker-good-defaults
 import http from 'http';
 import https from 'https';
+import fs from 'fs';
 
 const TLS_DISABLED = process.env.TLS_DISABLED === '1' || process.env.TLS_DISABLED === 'true';
 
 if (!TLS_DISABLED) {
-  (process.env as any)["NODE_TLS_REJECT_UNAUTHORIZED"] = 0;
-  var options = {
+  if(!process.env.TLS_KEY_FILE || !process.env.TLS_CERT_FILE || !process.env.TLS_CA_FILE) {
+    console.error('ERROR: TLS is enabled but one or more of the following environment variables are not set: TLS_KEY_FILE, TLS_CERT_FILE, TLS_CA_FILE');
+    process.exit(1);
+  }
+
+  let options = {
     timeout: 2000,
     host: 'localhost',
     port: process.env.PORT || 8080,
-    path: '/_healthz'
+    path: '/_healthz',
+    key: fs.readFileSync(process.env.TLS_KEY_FILE),
+    cert: fs.readFileSync(process.env.TLS_CERT_FILE),
+    ca: fs.readFileSync(process.env.TLS_CA_FILE),
   };
 
   var request = https.request(options, (res) => {
@@ -26,7 +34,7 @@ if (!TLS_DISABLED) {
 
   request.end();
 } else {
-  var options = {
+  let options = {
     timeout: 2000,
     host: 'localhost',
     port: process.env.PORT || 8080,