vicarian 0.3.3

Vicarian is a TLS-first reverse-proxy server with ACME support
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

mod certificates;
mod config;
mod errors;
mod metrics;
mod proxy;

use std::sync::Arc;
use std::thread;

use anyhow::Result;
use camino::Utf8PathBuf;
use nix::sys::resource::{Resource, getrlimit, setrlimit};
use tokio::sync::watch;
use tracing::level_filters::LevelFilter;
use tracing_log::log::info;

use crate::metrics::Metrics;
use crate::{
    certificates::CertificateRuntime,
    config::{Config, DEFAULT_CONFIG_FILE},
};

fn init_logging(level: u8) -> Result<()> {
    let log_level = match level {
        1 => LevelFilter::INFO,
        2 => LevelFilter::DEBUG,
        3 => LevelFilter::TRACE,
        _ => LevelFilter::WARN,
    };

    tracing_subscriber::fmt()
        .with_max_level(log_level)
        .init();

    info!("Logging initialised");
    Ok(())
}

#[derive(Debug)]
pub struct RunContext {
    pub config: Config,
    pub quit_rx: watch::Receiver<bool>,
    quit_tx: watch::Sender<bool>,
}

impl RunContext {
    pub fn new(config: Config) -> Self {
        let (quit_tx, quit_rx) = watch::channel(false);
        Self {
            config,
            quit_tx, quit_rx,
        }
    }

    pub fn quit(&self) -> Result<()> {
        info!("Sending quit signal to runtimes");
        self.quit_tx.send(true)?;
        Ok(())
    }
}

fn system_setup() -> Result<()> {
    let (_soft, hard) = getrlimit(Resource::RLIMIT_NOFILE)?;
    info!("Increasing NOFILE to {hard}");
    setrlimit(Resource::RLIMIT_NOFILE, hard, hard)?;

    rustls::crypto::aws_lc_rs::default_provider().install_default()
        .expect("Failed to install Rustls crypto provider");

    Ok(())
}

fn main() -> Result<()> {
    let cli = config::CliOptions::from_args();

    init_logging(cli.verbose)?;
    info!("Starting");

    system_setup()?;

    let config_file = cli.config
        .unwrap_or(Utf8PathBuf::from(DEFAULT_CONFIG_FILE));
    let config = Config::from_file(&config_file)?;

    let context = Arc::new(RunContext::new(config));

    // Runtime start

    let cert_runtime = Arc::new(CertificateRuntime::new(context.clone())?);
    let metrics = Metrics::install_global(context.clone())?;

    // Pingora starts its own tokio runtimes, so we create one here to
    // handle certificate and support tasks.
    let maint_handle = {
        let crt = cert_runtime.clone();

        thread::spawn(move || -> Result<()> {
            info!("Starting Certificate Management runtime");
            let trt = tokio::runtime::Builder::new_current_thread()
                .enable_time()
                .enable_io()
                .build()?;

            trt.spawn(async move {
                metrics.run().await
            });

            trt.block_on(
                crt.run_indefinitely()
            )?;

            Ok(())
        })
    };

    info!("Starting Vicarian");
    proxy::run_indefinitely(cert_runtime.clone(), context.clone())?;

    context.quit()?;
    maint_handle.join()
        .expect("Failed to finalise certificate management tasks")?;

    info!("Vicarian finished.");
    Ok(())
}