opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add configurable cipher suites for tls listening (#10505)

Browse Source 
* feat: add configurable cipher suites for tls listening
* tls.VersionName is go 1.21, copy the function
This commit is contained in:
Steven Masley
2023-11-07 14:55:39 +00:00
committed by GitHub
parent e36503afd2
commit 64398def48
13 changed files with 478 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cli/testdata/coder_server_--help.golden
Vendored
+9
View File
@@ -249,12 +249,21 @@ can safely ignore these settings.
--tls-address host:port, $CODER_TLS_ADDRESS (default: 127.0.0.1:3443)
HTTPS bind address of the server.
--tls-allow-insecure-ciphers bool, $CODER_TLS_ALLOW_INSECURE_CIPHERS (default: false)
By default, only ciphers marked as 'secure' are allowed to be used.
See
https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L82-L95.
--tls-cert-file string-array, $CODER_TLS_CERT_FILE
Path to each certificate for TLS. It requires a PEM-encoded file. To
configure the listener to use a CA certificate, concatenate the
primary certificate and the CA certificate together. The primary
certificate should appear first in the combined file.
--tls-ciphers string-array, $CODER_TLS_CIPHERS
Specify specific TLS ciphers that allowed to be used. See
https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L53-L75.
--tls-client-auth string, $CODER_TLS_CLIENT_AUTH (default: none)
Policy the server will follow for TLS Client Authentication. Accepted
values are "none", "request", "require-any", "verify-if-given", or
cli/testdata/server-config.yaml.golden
Vendored
+8
View File
@@ -83,6 +83,14 @@ networking:
# Path to key for client TLS authentication. It requires a PEM-encoded file.
# (default: <unset>, type: string)
clientKeyFile: ""
# Specify specific TLS ciphers that allowed to be used. See
# https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L53-L75.
# (default: <unset>, type: string-array)
tlsCiphers: []
# By default, only ciphers marked as 'secure' are allowed to be used. See
# https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L82-L95.
# (default: false, type: bool)
tlsAllowInsecureCiphers: false
# Controls if the 'Strict-Transport-Security' header is set on all static file
# responses. This header should only be set if the server is accessed via HTTPS.
# This value is the MaxAge in seconds of the header.