832468c1fe
The motive is to speed up tests, though it will also speed up production, though we have to check compatibility with the ACME provider we use with care. This speedup is on one test suite alone, which was among the most expensive in this regard: 3.8x Benchmark 1: bundle exec rspec ./spec/prog/vnet/cert_nexus_spec.rb Time (mean ± σ): 1.539 s ± 0.096 s [User: 1.183 s, System: 0.174 s] Range (min … max): 1.434 s … 1.748 s 10 runs Benchmark 1: bundle exec rspec ./spec/prog/vnet/cert_nexus_spec.rb Time (mean ± σ): 5.739 s ± 1.733 s [User: 5.396 s, System: 0.181 s] Range (min … max): 2.959 s … 8.888 s 10 runs But, it's somewhat bad to be using expensive entropy unnecessarily in tests: it likely be much faster still, with more work, by re-using key material.
59 lines
1.4 KiB
Ruby
59 lines
1.4 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
class Prog::Vnet::CertServer < Prog::Base
|
|
subject_is :load_balancer
|
|
|
|
def vm
|
|
@vm ||= Vm[frame.fetch("vm_id")]
|
|
end
|
|
|
|
def cert_folder
|
|
"/vm/#{vm.inhost_name}/cert"
|
|
end
|
|
|
|
def cert_path
|
|
"#{cert_folder}/cert.pem"
|
|
end
|
|
|
|
def key_path
|
|
"#{cert_folder}/key.pem"
|
|
end
|
|
|
|
label def before_run
|
|
pop "vm is destroyed" unless vm
|
|
end
|
|
|
|
label def reshare_certificate
|
|
put_cert_to_vm
|
|
|
|
pop "certificate is reshared"
|
|
end
|
|
|
|
label def put_certificate
|
|
nap 5 unless load_balancer.active_cert&.cert
|
|
|
|
put_cert_to_vm
|
|
hop_start_certificate_server
|
|
end
|
|
|
|
label def start_certificate_server
|
|
vm.vm_host.sshable.cmd("sudo host/bin/setup-cert-server setup #{vm.inhost_name}")
|
|
pop "certificate server is started"
|
|
end
|
|
|
|
label def remove_cert_server
|
|
vm.vm_host.sshable.cmd("sudo host/bin/setup-cert-server stop_and_remove #{vm.inhost_name}")
|
|
pop "certificate resources and server are removed"
|
|
end
|
|
|
|
def put_cert_to_vm
|
|
cert = load_balancer.active_cert
|
|
|
|
cert_payload = cert.cert
|
|
cert_key_payload = OpenSSL::PKey::EC.new(cert.csr_key).to_pem
|
|
vm.vm_host.sshable.cmd("sudo -u #{vm.inhost_name} mkdir -p #{cert_folder}")
|
|
vm.vm_host.sshable.cmd("sudo -u #{vm.inhost_name} tee #{cert_path}", stdin: cert_payload)
|
|
vm.vm_host.sshable.cmd("sudo -u #{vm.inhost_name} tee #{key_path}", stdin: cert_key_payload)
|
|
end
|
|
end
|