main.go

package main

import (
	"context"
	"flag"
	"fmt"
	"log"
	"net/http"
	"os"
	"os/signal"
	"syscall"
	"time"

	"github.com/furio/kes-hsm-go/auth"
	keshttp "github.com/furio/kes-hsm-go/http"
	"github.com/furio/kes-hsm-go/lib"
	"github.com/gin-gonic/gin"
	"github.com/joho/godotenv"
)

// Version from Makefile
var Version string

// Build from Makefile
var Build string

func main() {
	envFile := flag.String("env", "", "a path to a .env file")
	boolVersion := flag.Bool("v", false, "a bool")
	flag.Usage = func() {
		w := flag.CommandLine.Output()
		fmt.Fprintf(w, "KES-HSM \n")
		fmt.Fprintf(w, "Usage of %s: \n", os.Args[0])

		flag.PrintDefaults()
	}
	flag.Parse()

	// Version
	if *boolVersion {
		fmt.Fprintf(flag.CommandLine.Output(), "KES-HSM Version: %s, Build: %s \n", Version, Build)
		return
	}

	// Load env file
	err := godotenv.Load(*envFile)
	if err != nil {
		log.Fatal("Error loading .env file in argument -env : " + *envFile)
	}

	startKes()
}

func startKes() {
	// Start
	production := os.Getenv("KES_MODE") == "production"

	log.Printf("KES-HSM Version: %s, Production: %t\n\n", Version, production)

	// Configure AUTH middleware
	authMiddleware, err := auth.New(os.Getenv("KES_CONFIG_AUTH"))
	if err != nil {
		log.Fatal("Cannot configure Auth interface: ", err)
		return // log.Fatal quits with error
	}

	// Connect to HSM
	overrideHSMPin := ""
	if !production {
		overrideHSMPin = os.Getenv("KES_CONFIG_HSM_PIN")
	}
	hsm, err := lib.NewHSM(os.Getenv("KES_CONFIG_KEYS"), os.Getenv("KES_CONFIG_HSM"), overrideHSMPin)
	if err != nil {
		log.Fatal("Cannot configure HSM interface: ", err)
		return // log.Fatal quits with error
	}

	// Set Gin mode
	if production {
		gin.SetMode(gin.ReleaseMode)
	}

	// Secure server
	var srvHTTPS *http.Server = nil
	if os.Getenv("KES_HTTPS") != "" {
		routerConfig := keshttp.GenerateHTTPRoutes(keshttp.RouterConfig{
			Production:     production,
			EnableKESApi:   true,
			EnableAuth:     !(os.Getenv("KES_HTTPS_AUTH_DISABLED") == "on"),
			EnableMetrics:  os.Getenv("KES_METRICS") == "on",
			AuthMiddleware: authMiddleware,
			HsmHandle:      hsm,
			RouterVersion:  map[string]string{"version": Version, "build": Build},
		})

		srv, err := keshttp.CreateAndRunHTTPSServer(keshttp.SecureWebServerConfig{
			BindIP:          os.Getenv("KES_HTTPS"),
			CaPath:          os.Getenv("KES_HTTPS_CA"),
			ClientCaPath:    os.Getenv("KES_HTTPS_CA_CLIENTS"),
			PrivateKeyPath:  os.Getenv("KES_HTTPS_KEY"),
			CertificatePath: os.Getenv("KES_HTTPS_CERT"),

			Production:            production,
			EnableSelfSignedCerts: os.Getenv("KES_HTTPS_CA_SELFSIGNED") != "",
			FIPSmode:              os.Getenv("KES_HTTPS_FIPS_CYPHERS") == "on",
		}, routerConfig)

		if err != nil {
			log.Printf("Cannot start HTTPS server due to %s\n", err)
			return
		}

		srvHTTPS = srv
	}

	// Localhost HTTP (default 8080) server
	var srvHTTPLocal *http.Server = nil
	if os.Getenv("KES_HTTP_DISABLE") == "" {
		routerConfig := keshttp.GenerateHTTPRoutes(keshttp.RouterConfig{
			Production:     production,
			EnableKESApi:   !production,
			EnableAuth:     false,
			EnableMetrics:  os.Getenv("KES_METRICS") == "on",
			AuthMiddleware: authMiddleware,
			HsmHandle:      hsm,
			RouterVersion:  map[string]string{"version": Version, "build": Build},
		})

		srv, err := keshttp.CreateAndRunHTTPServer(keshttp.WebServerConfig{
			Port:       os.Getenv("KES_HTTP"),
			Production: production,
		}, routerConfig)

		if err != nil {
			log.Printf("Cannot start HTTP server due to %s\n", err)
			return
		}

		srvHTTPLocal = srv
	}

	// Wait for interrupt signal to gracefully shutdown the server with
	// a timeout of 5 seconds.
	quit := make(chan os.Signal)
	// kill (no param) default send syscall.SIGTERM
	// kill -2 is syscall.SIGINT
	// kill -9 is syscall.SIGKILL but can't be catch, so don't need add it
	signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)
	<-quit
	log.Println("Shutting down server...")

	// The context is used to inform the server it has 5 seconds to finish
	// the request it is currently handling
	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer cancel()

	fatal := false
	if srvHTTPLocal != nil {
		if err := srvHTTPLocal.Shutdown(ctx); err != nil {
			log.Println("Server (HTTP) forced to shutdown:", err)
			fatal = true
		}
	}

	if srvHTTPS != nil {
		if err := srvHTTPS.Shutdown(ctx); err != nil {
			log.Println("Server (HTTPS) forced to shutdown:", err)
			fatal = true
		}
	}

	log.Println("Server exiting")
	// Clear HSM at the end
	hsm.Close()

	// Exit fatally
	if fatal {
		os.Exit(1)
	}
}