fix(cli): support persistent insecure TLS in client config
- commit
- 8b57a60230677084ca720adff35def7304090586
- author
- brice · · 2026-02-06 19:41 UTC
- committer
- brice · · 2026-02-06 19:41 UTC
- parent
- 2bcb8f1
- signature
- unsigned
6 files · +145 -24
M docs/cli/index.md +3 -0
| @@ -120,6 +120,8 @@ when you want to bypass your saved configuration. | |||
| 120 | 120 | **Important:** The remote URL must be the `gordon_domain` configured on the remote Gordon instance. This is the domain that serves both the container registry and the Admin API. | |
| 121 | 121 | ||
| 122 | 122 | Use `--insecure` when the remote endpoint uses a self-signed or otherwise untrusted TLS certificate. | |
| 123 | + | You can make this persistent with `insecure_tls = true` in `[client]` of `~/.config/gordon/gordon.toml` | |
| 124 | + | or in a specific entry in `~/.config/gordon/remotes.toml`. | |
| 123 | 125 | ||
| 124 | 126 | ```bash | |
| 125 | 127 | # Using flags (use the gordon_domain from remote Gordon config) | |
| @@ -131,6 +133,7 @@ gordon --remote https://gordon.mydomain.com --token $TOKEN --insecure status | |||
| 131 | 133 | # Using environment variables | |
| 132 | 134 | export GORDON_REMOTE=https://gordon.mydomain.com | |
| 133 | 135 | export GORDON_TOKEN=$TOKEN | |
| 136 | + | export GORDON_INSECURE=true | |
| 134 | 137 | gordon routes list | |
| 135 | 138 | ``` | |
| 136 | 139 | ||
| @@ -120,6 +120,8 @@ when you want to bypass your saved configuration. | |||||
| 120 | **Important:** The remote URL must be the `gordon_domain` configured on the remote Gordon instance. This is the domain that serves both the container registry and the Admin API. | 120 | **Important:** The remote URL must be the `gordon_domain` configured on the remote Gordon instance. This is the domain that serves both the container registry and the Admin API. | ||
| 121 | 121 | ||||
| 122 | Use `--insecure` when the remote endpoint uses a self-signed or otherwise untrusted TLS certificate. | 122 | Use `--insecure` when the remote endpoint uses a self-signed or otherwise untrusted TLS certificate. | ||
| 123 | + | You can make this persistent with `insecure_tls = true` in `[client]` of `~/.config/gordon/gordon.toml` | |||
| 124 | + | or in a specific entry in `~/.config/gordon/remotes.toml`. | |||
| 123 | 125 | ||||
| 124 | ```bash | 126 | ```bash | ||
| 125 | # Using flags (use the gordon_domain from remote Gordon config) | 127 | # Using flags (use the gordon_domain from remote Gordon config) | ||
| @@ -131,6 +133,7 @@ gordon --remote https://gordon.mydomain.com --token $TOKEN --insecure status | |||||
| 131 | # Using environment variables | 133 | # Using environment variables | ||
| 132 | export GORDON_REMOTE=https://gordon.mydomain.com | 134 | export GORDON_REMOTE=https://gordon.mydomain.com | ||
| 133 | export GORDON_TOKEN=$TOKEN | 135 | export GORDON_TOKEN=$TOKEN | ||
| 136 | + | export GORDON_INSECURE=true | |||
| 134 | gordon routes list | 137 | gordon routes list | ||
| 135 | ``` | 138 | ``` | ||
| 136 | 139 | ||||
M docs/cli/remotes.md +7 -0
| @@ -222,6 +222,7 @@ active = "prod" | |||
| 222 | 222 | [remotes.prod] | |
| 223 | 223 | url = "https://gordon.mydomain.com" | |
| 224 | 224 | token_env = "PROD_TOKEN" | |
| 225 | + | insecure_tls = true | |
| 225 | 226 | ||
| 226 | 227 | [remotes.staging] | |
| 227 | 228 | url = "https://staging.mydomain.com" | |
| @@ -242,6 +243,12 @@ When multiple sources specify remote or token, the CLI uses this priority: | |||
| 242 | 243 | 2. `GORDON_TOKEN` environment variable | |
| 243 | 244 | 3. Token from active remote in `remotes.toml` | |
| 244 | 245 | ||
| 246 | + | **Insecure TLS:** | |
| 247 | + | 1. `--insecure` flag | |
| 248 | + | 2. `GORDON_INSECURE` environment variable (`true`/`false`) | |
| 249 | + | 3. `[client] insecure_tls` in `gordon.toml` | |
| 250 | + | 4. `insecure_tls` from the selected remote in `remotes.toml` | |
| 251 | + | ||
| 245 | 252 | This allows overriding specific values while keeping defaults: | |
| 246 | 253 | ||
| 247 | 254 | ```bash | |
| @@ -222,6 +222,7 @@ active = "prod" | |||||
| 222 | [remotes.prod] | 222 | [remotes.prod] | ||
| 223 | url = "https://gordon.mydomain.com" | 223 | url = "https://gordon.mydomain.com" | ||
| 224 | token_env = "PROD_TOKEN" | 224 | token_env = "PROD_TOKEN" | ||
| 225 | + | insecure_tls = true | |||
| 225 | 226 | ||||
| 226 | [remotes.staging] | 227 | [remotes.staging] | ||
| 227 | url = "https://staging.mydomain.com" | 228 | url = "https://staging.mydomain.com" | ||
| @@ -242,6 +243,12 @@ When multiple sources specify remote or token, the CLI uses this priority: | |||||
| 242 | 2. `GORDON_TOKEN` environment variable | 243 | 2. `GORDON_TOKEN` environment variable | ||
| 243 | 3. Token from active remote in `remotes.toml` | 244 | 3. Token from active remote in `remotes.toml` | ||
| 244 | 245 | ||||
| 246 | + | **Insecure TLS:** | |||
| 247 | + | 1. `--insecure` flag | |||
| 248 | + | 2. `GORDON_INSECURE` environment variable (`true`/`false`) | |||
| 249 | + | 3. `[client] insecure_tls` in `gordon.toml` | |||
| 250 | + | 4. `insecure_tls` from the selected remote in `remotes.toml` | |||
| 251 | + | ||||
| 245 | This allows overriding specific values while keeping defaults: | 252 | This allows overriding specific values while keeping defaults: | ||
| 246 | 253 | ||||
| 247 | ```bash | 254 | ```bash | ||
M internal/adapters/in/cli/auth.go +6 -3
| @@ -297,7 +297,8 @@ func runAuthLogin(remoteName, username, password string) error { | |||
| 297 | 297 | } | |
| 298 | 298 | ||
| 299 | 299 | // Create remote client | |
| 300 | - | client := remote.NewClient(remoteConfig.URL, remoteClientOptions("")...) | |
| 300 | + | insecureTLS := remote.ResolveInsecureTLSForRemote(insecureTLSFlag, resolvedName) | |
| 301 | + | client := remote.NewClient(remoteConfig.URL, remoteClientOptions("", insecureTLS)...) | |
| 301 | 302 | ||
| 302 | 303 | // Authenticate | |
| 303 | 304 | ctx := context.Background() | |
| @@ -332,7 +333,8 @@ func runAuthLoginWithToken(remoteName, token string) error { | |||
| 332 | 333 | return err | |
| 333 | 334 | } | |
| 334 | 335 | ||
| 335 | - | client := remote.NewClient(remoteConfig.URL, remoteClientOptions(token)...) | |
| 336 | + | insecureTLS := remote.ResolveInsecureTLSForRemote(insecureTLSFlag, resolvedName) | |
| 337 | + | client := remote.NewClient(remoteConfig.URL, remoteClientOptions(token, insecureTLS)...) | |
| 336 | 338 | ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) | |
| 337 | 339 | defer cancel() | |
| 338 | 340 | verified := true | |
| @@ -758,7 +760,8 @@ func runAuthStatus(remoteNameArg string) error { | |||
| 758 | 760 | } | |
| 759 | 761 | ||
| 760 | 762 | // Create client | |
| 761 | - | client := remote.NewClient(remoteConfig.URL, remoteClientOptions(remoteConfig.Token)...) | |
| 763 | + | insecureTLS := remote.ResolveInsecureTLSForRemote(insecureTLSFlag, remoteName) | |
| 764 | + | client := remote.NewClient(remoteConfig.URL, remoteClientOptions(remoteConfig.Token, insecureTLS)...) | |
| 762 | 765 | ||
| 763 | 766 | // Verify auth | |
| 764 | 767 | ctx := context.Background() | |
| @@ -297,7 +297,8 @@ func runAuthLogin(remoteName, username, password string) error { | |||||
| 297 | } | 297 | } | ||
| 298 | 298 | ||||
| 299 | // Create remote client | 299 | // Create remote client | ||
| 300 | - | client := remote.NewClient(remoteConfig.URL, remoteClientOptions("")...) | 300 | + | insecureTLS := remote.ResolveInsecureTLSForRemote(insecureTLSFlag, resolvedName) |
| 301 | + | client := remote.NewClient(remoteConfig.URL, remoteClientOptions("", insecureTLS)...) | |||
| 301 | 302 | ||||
| 302 | // Authenticate | 303 | // Authenticate | ||
| 303 | ctx := context.Background() | 304 | ctx := context.Background() | ||
| @@ -332,7 +333,8 @@ func runAuthLoginWithToken(remoteName, token string) error { | |||||
| 332 | return err | 333 | return err | ||
| 333 | } | 334 | } | ||
| 334 | 335 | ||||
| 335 | - | client := remote.NewClient(remoteConfig.URL, remoteClientOptions(token)...) | 336 | + | insecureTLS := remote.ResolveInsecureTLSForRemote(insecureTLSFlag, resolvedName) |
| 337 | + | client := remote.NewClient(remoteConfig.URL, remoteClientOptions(token, insecureTLS)...) | |||
| 336 | ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) | 338 | ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) | ||
| 337 | defer cancel() | 339 | defer cancel() | ||
| 338 | verified := true | 340 | verified := true | ||
| @@ -758,7 +760,8 @@ func runAuthStatus(remoteNameArg string) error { | |||||
| 758 | } | 760 | } | ||
| 759 | 761 | ||||
| 760 | // Create client | 762 | // Create client | ||
| 761 | - | client := remote.NewClient(remoteConfig.URL, remoteClientOptions(remoteConfig.Token)...) | 763 | + | insecureTLS := remote.ResolveInsecureTLSForRemote(insecureTLSFlag, remoteName) |
| 764 | + | client := remote.NewClient(remoteConfig.URL, remoteClientOptions(remoteConfig.Token, insecureTLS)...) | |||
| 762 | 765 | ||||
| 763 | // Verify auth | 766 | // Verify auth | ||
| 764 | ctx := context.Background() | 767 | ctx := context.Background() | ||
M internal/adapters/in/cli/remote/config.go +52 -16
| @@ -4,6 +4,7 @@ import ( | |||
| 4 | 4 | "fmt" | |
| 5 | 5 | "os" | |
| 6 | 6 | "path/filepath" | |
| 7 | + | "strconv" | |
| 7 | 8 | ||
| 8 | 9 | "github.com/pelletier/go-toml/v2" | |
| 9 | 10 | ) | |
| @@ -17,17 +18,19 @@ type ClientConfig struct { | |||
| 17 | 18 | ||
| 18 | 19 | // ClientSettings represents the [client] section. | |
| 19 | 20 | type ClientSettings struct { | |
| 20 | - | Mode string `toml:"mode"` // "local" (default) or "remote" | |
| 21 | - | Remote string `toml:"remote"` // Remote Gordon URL | |
| 22 | - | Token string `toml:"token"` // Auth token | |
| 23 | - | TokenEnv string `toml:"token_env"` // Env var name for token | |
| 21 | + | Mode string `toml:"mode"` // "local" (default) or "remote" | |
| 22 | + | Remote string `toml:"remote"` // Remote Gordon URL | |
| 23 | + | Token string `toml:"token"` // Auth token | |
| 24 | + | TokenEnv string `toml:"token_env"` // Env var name for token | |
| 25 | + | InsecureTLS bool `toml:"insecure_tls"` // Skip TLS verification for remote admin API | |
| 24 | 26 | } | |
| 25 | 27 | ||
| 26 | 28 | // RemoteEntry represents a saved remote in [remotes.*]. | |
| 27 | 29 | type RemoteEntry struct { | |
| 28 | - | URL string `toml:"url"` | |
| 29 | - | Token string `toml:"token,omitempty"` | |
| 30 | - | TokenEnv string `toml:"token_env,omitempty"` | |
| 30 | + | URL string `toml:"url"` | |
| 31 | + | Token string `toml:"token,omitempty"` | |
| 32 | + | TokenEnv string `toml:"token_env,omitempty"` | |
| 33 | + | InsecureTLS bool `toml:"insecure_tls,omitempty"` | |
| 31 | 34 | } | |
| 32 | 35 | ||
| 33 | 36 | // DefaultClientConfigPath returns the default client config path. | |
| @@ -134,43 +137,44 @@ func SaveRemotes(path string, config *ClientConfig) error { | |||
| 134 | 137 | ||
| 135 | 138 | // ResolveRemote resolves the remote URL and token from configuration. | |
| 136 | 139 | // Precedence: flag > env > config > active remote | |
| 137 | - | func ResolveRemote(flagRemote, flagToken string) (url, token string, isRemote bool) { | |
| 140 | + | func ResolveRemote(flagRemote, flagToken string, flagInsecure bool) (url, token string, insecureTLS, isRemote bool) { | |
| 138 | 141 | config, _ := LoadClientConfig("") | |
| 139 | 142 | remotes, _ := LoadRemotes("") | |
| 140 | 143 | ||
| 141 | - | url, isRemote = resolveRemoteURL(flagRemote, config, remotes) | |
| 144 | + | url, remoteName, isRemote := resolveRemoteURL(flagRemote, config, remotes) | |
| 142 | 145 | if isRemote { | |
| 143 | 146 | token = resolveToken(flagToken, config, remotes) | |
| 147 | + | insecureTLS = resolveInsecureTLS(flagInsecure, config, remotes, remoteName) | |
| 144 | 148 | } | |
| 145 | 149 | ||
| 146 | - | return url, token, isRemote | |
| 150 | + | return url, token, insecureTLS, isRemote | |
| 147 | 151 | } | |
| 148 | 152 | ||
| 149 | 153 | // resolveRemoteURL resolves the remote URL from various sources. | |
| 150 | - | func resolveRemoteURL(flagRemote string, config *ClientConfig, remotes *ClientConfig) (string, bool) { | |
| 154 | + | func resolveRemoteURL(flagRemote string, config *ClientConfig, remotes *ClientConfig) (url, remoteName string, isRemote bool) { | |
| 151 | 155 | // 1. Check flag | |
| 152 | 156 | if flagRemote != "" { | |
| 153 | - | return flagRemote, true | |
| 157 | + | return flagRemote, "", true | |
| 154 | 158 | } | |
| 155 | 159 | ||
| 156 | 160 | // 2. Check environment variable | |
| 157 | 161 | if envRemote := os.Getenv("GORDON_REMOTE"); envRemote != "" { | |
| 158 | - | return envRemote, true | |
| 162 | + | return envRemote, "", true | |
| 159 | 163 | } | |
| 160 | 164 | ||
| 161 | 165 | // 3. Check client config | |
| 162 | 166 | if config != nil && config.Client.Mode == "remote" && config.Client.Remote != "" { | |
| 163 | - | return config.Client.Remote, true | |
| 167 | + | return config.Client.Remote, "", true | |
| 164 | 168 | } | |
| 165 | 169 | ||
| 166 | 170 | // 4. Check active remote | |
| 167 | 171 | if remotes != nil && remotes.Active != "" { | |
| 168 | 172 | if remote, ok := remotes.Remotes[remotes.Active]; ok { | |
| 169 | - | return remote.URL, true | |
| 173 | + | return remote.URL, remotes.Active, true | |
| 170 | 174 | } | |
| 171 | 175 | } | |
| 172 | 176 | ||
| 173 | - | return "", false | |
| 177 | + | return "", "", false | |
| 174 | 178 | } | |
| 175 | 179 | ||
| 176 | 180 | // resolveToken resolves the authentication token from various sources. | |
| @@ -210,6 +214,38 @@ func resolveToken(flagToken string, config *ClientConfig, remotes *ClientConfig) | |||
| 210 | 214 | return "" | |
| 211 | 215 | } | |
| 212 | 216 | ||
| 217 | + | // ResolveInsecureTLSForRemote resolves insecure TLS behavior for a named remote. | |
| 218 | + | // Precedence: flag > env > client config > specific remote config. | |
| 219 | + | func ResolveInsecureTLSForRemote(flagInsecure bool, remoteName string) bool { | |
| 220 | + | config, _ := LoadClientConfig("") | |
| 221 | + | remotes, _ := LoadRemotes("") | |
| 222 | + | return resolveInsecureTLS(flagInsecure, config, remotes, remoteName) | |
| 223 | + | } | |
| 224 | + | ||
| 225 | + | func resolveInsecureTLS(flagInsecure bool, config *ClientConfig, remotes *ClientConfig, remoteName string) bool { | |
| 226 | + | if flagInsecure { | |
| 227 | + | return true | |
| 228 | + | } | |
| 229 | + | ||
| 230 | + | if env := os.Getenv("GORDON_INSECURE"); env != "" { | |
| 231 | + | if value, err := strconv.ParseBool(env); err == nil { | |
| 232 | + | return value | |
| 233 | + | } | |
| 234 | + | } | |
| 235 | + | ||
| 236 | + | if config != nil && config.Client.InsecureTLS { | |
| 237 | + | return true | |
| 238 | + | } | |
| 239 | + | ||
| 240 | + | if remoteName != "" && remotes != nil { | |
| 241 | + | if remote, ok := remotes.Remotes[remoteName]; ok && remote.InsecureTLS { | |
| 242 | + | return true | |
| 243 | + | } | |
| 244 | + | } | |
| 245 | + | ||
| 246 | + | return false | |
| 247 | + | } | |
| 248 | + | ||
| 213 | 249 | // AddRemote adds a new remote to the remotes configuration. | |
| 214 | 250 | func AddRemote(name, url, token string) error { | |
| 215 | 251 | config, err := LoadRemotes("") | |
| @@ -4,6 +4,7 @@ import ( | |||||
| 4 | "fmt" | 4 | "fmt" | ||
| 5 | "os" | 5 | "os" | ||
| 6 | "path/filepath" | 6 | "path/filepath" | ||
| 7 | + | "strconv" | |||
| 7 | 8 | ||||
| 8 | "github.com/pelletier/go-toml/v2" | 9 | "github.com/pelletier/go-toml/v2" | ||
| 9 | ) | 10 | ) | ||
| @@ -17,17 +18,19 @@ type ClientConfig struct { | |||||
| 17 | 18 | ||||
| 18 | // ClientSettings represents the [client] section. | 19 | // ClientSettings represents the [client] section. | ||
| 19 | type ClientSettings struct { | 20 | type ClientSettings struct { | ||
| 20 | - | Mode string `toml:"mode"` // "local" (default) or "remote" | 21 | + | Mode string `toml:"mode"` // "local" (default) or "remote" |
| 21 | - | Remote string `toml:"remote"` // Remote Gordon URL | 22 | + | Remote string `toml:"remote"` // Remote Gordon URL |
| 22 | - | Token string `toml:"token"` // Auth token | 23 | + | Token string `toml:"token"` // Auth token |
| 23 | - | TokenEnv string `toml:"token_env"` // Env var name for token | 24 | + | TokenEnv string `toml:"token_env"` // Env var name for token |
| 25 | + | InsecureTLS bool `toml:"insecure_tls"` // Skip TLS verification for remote admin API | |||
| 24 | } | 26 | } | ||
| 25 | 27 | ||||
| 26 | // RemoteEntry represents a saved remote in [remotes.*]. | 28 | // RemoteEntry represents a saved remote in [remotes.*]. | ||
| 27 | type RemoteEntry struct { | 29 | type RemoteEntry struct { | ||
| 28 | - | URL string `toml:"url"` | 30 | + | URL string `toml:"url"` |
| 29 | - | Token string `toml:"token,omitempty"` | 31 | + | Token string `toml:"token,omitempty"` |
| 30 | - | TokenEnv string `toml:"token_env,omitempty"` | 32 | + | TokenEnv string `toml:"token_env,omitempty"` |
| 33 | + | InsecureTLS bool `toml:"insecure_tls,omitempty"` | |||
| 31 | } | 34 | } | ||
| 32 | 35 | ||||
| 33 | // DefaultClientConfigPath returns the default client config path. | 36 | // DefaultClientConfigPath returns the default client config path. | ||
| @@ -134,43 +137,44 @@ func SaveRemotes(path string, config *ClientConfig) error { | |||||
| 134 | 137 | ||||
| 135 | // ResolveRemote resolves the remote URL and token from configuration. | 138 | // ResolveRemote resolves the remote URL and token from configuration. | ||
| 136 | // Precedence: flag > env > config > active remote | 139 | // Precedence: flag > env > config > active remote | ||
| 137 | - | func ResolveRemote(flagRemote, flagToken string) (url, token string, isRemote bool) { | 140 | + | func ResolveRemote(flagRemote, flagToken string, flagInsecure bool) (url, token string, insecureTLS, isRemote bool) { |
| 138 | config, _ := LoadClientConfig("") | 141 | config, _ := LoadClientConfig("") | ||
| 139 | remotes, _ := LoadRemotes("") | 142 | remotes, _ := LoadRemotes("") | ||
| 140 | 143 | ||||
| 141 | - | url, isRemote = resolveRemoteURL(flagRemote, config, remotes) | 144 | + | url, remoteName, isRemote := resolveRemoteURL(flagRemote, config, remotes) |
| 142 | if isRemote { | 145 | if isRemote { | ||
| 143 | token = resolveToken(flagToken, config, remotes) | 146 | token = resolveToken(flagToken, config, remotes) | ||
| 147 | + | insecureTLS = resolveInsecureTLS(flagInsecure, config, remotes, remoteName) | |||
| 144 | } | 148 | } | ||
| 145 | 149 | ||||
| 146 | - | return url, token, isRemote | 150 | + | return url, token, insecureTLS, isRemote |
| 147 | } | 151 | } | ||
| 148 | 152 | ||||
| 149 | // resolveRemoteURL resolves the remote URL from various sources. | 153 | // resolveRemoteURL resolves the remote URL from various sources. | ||
| 150 | - | func resolveRemoteURL(flagRemote string, config *ClientConfig, remotes *ClientConfig) (string, bool) { | 154 | + | func resolveRemoteURL(flagRemote string, config *ClientConfig, remotes *ClientConfig) (url, remoteName string, isRemote bool) { |
| 151 | // 1. Check flag | 155 | // 1. Check flag | ||
| 152 | if flagRemote != "" { | 156 | if flagRemote != "" { | ||
| 153 | - | return flagRemote, true | 157 | + | return flagRemote, "", true |
| 154 | } | 158 | } | ||
| 155 | 159 | ||||
| 156 | // 2. Check environment variable | 160 | // 2. Check environment variable | ||
| 157 | if envRemote := os.Getenv("GORDON_REMOTE"); envRemote != "" { | 161 | if envRemote := os.Getenv("GORDON_REMOTE"); envRemote != "" { | ||
| 158 | - | return envRemote, true | 162 | + | return envRemote, "", true |
| 159 | } | 163 | } | ||
| 160 | 164 | ||||
| 161 | // 3. Check client config | 165 | // 3. Check client config | ||
| 162 | if config != nil && config.Client.Mode == "remote" && config.Client.Remote != "" { | 166 | if config != nil && config.Client.Mode == "remote" && config.Client.Remote != "" { | ||
| 163 | - | return config.Client.Remote, true | 167 | + | return config.Client.Remote, "", true |
| 164 | } | 168 | } | ||
| 165 | 169 | ||||
| 166 | // 4. Check active remote | 170 | // 4. Check active remote | ||
| 167 | if remotes != nil && remotes.Active != "" { | 171 | if remotes != nil && remotes.Active != "" { | ||
| 168 | if remote, ok := remotes.Remotes[remotes.Active]; ok { | 172 | if remote, ok := remotes.Remotes[remotes.Active]; ok { | ||
| 169 | - | return remote.URL, true | 173 | + | return remote.URL, remotes.Active, true |
| 170 | } | 174 | } | ||
| 171 | } | 175 | } | ||
| 172 | 176 | ||||
| 173 | - | return "", false | 177 | + | return "", "", false |
| 174 | } | 178 | } | ||
| 175 | 179 | ||||
| 176 | // resolveToken resolves the authentication token from various sources. | 180 | // resolveToken resolves the authentication token from various sources. | ||
| @@ -210,6 +214,38 @@ func resolveToken(flagToken string, config *ClientConfig, remotes *ClientConfig) | |||||
| 210 | return "" | 214 | return "" | ||
| 211 | } | 215 | } | ||
| 212 | 216 | ||||
| 217 | + | // ResolveInsecureTLSForRemote resolves insecure TLS behavior for a named remote. | |||
| 218 | + | // Precedence: flag > env > client config > specific remote config. | |||
| 219 | + | func ResolveInsecureTLSForRemote(flagInsecure bool, remoteName string) bool { | |||
| 220 | + | config, _ := LoadClientConfig("") | |||
| 221 | + | remotes, _ := LoadRemotes("") | |||
| 222 | + | return resolveInsecureTLS(flagInsecure, config, remotes, remoteName) | |||
| 223 | + | } | |||
| 224 | + | ||||
| 225 | + | func resolveInsecureTLS(flagInsecure bool, config *ClientConfig, remotes *ClientConfig, remoteName string) bool { | |||
| 226 | + | if flagInsecure { | |||
| 227 | + | return true | |||
| 228 | + | } | |||
| 229 | + | ||||
| 230 | + | if env := os.Getenv("GORDON_INSECURE"); env != "" { | |||
| 231 | + | if value, err := strconv.ParseBool(env); err == nil { | |||
| 232 | + | return value | |||
| 233 | + | } | |||
| 234 | + | } | |||
| 235 | + | ||||
| 236 | + | if config != nil && config.Client.InsecureTLS { | |||
| 237 | + | return true | |||
| 238 | + | } | |||
| 239 | + | ||||
| 240 | + | if remoteName != "" && remotes != nil { | |||
| 241 | + | if remote, ok := remotes.Remotes[remoteName]; ok && remote.InsecureTLS { | |||
| 242 | + | return true | |||
| 243 | + | } | |||
| 244 | + | } | |||
| 245 | + | ||||
| 246 | + | return false | |||
| 247 | + | } | |||
| 248 | + | ||||
| 213 | // AddRemote adds a new remote to the remotes configuration. | 249 | // AddRemote adds a new remote to the remotes configuration. | ||
| 214 | func AddRemote(name, url, token string) error { | 250 | func AddRemote(name, url, token string) error { | ||
| 215 | config, err := LoadRemotes("") | 251 | config, err := LoadRemotes("") | ||
A internal/adapters/in/cli/remote/config_test.go +72 -0
| @@ -0,0 +1,72 @@ | |||
| 1 | + | package remote | |
| 2 | + | ||
| 3 | + | import ( | |
| 4 | + | "os" | |
| 5 | + | "path/filepath" | |
| 6 | + | "testing" | |
| 7 | + | ) | |
| 8 | + | ||
| 9 | + | func TestResolveRemote_InsecureTLSFromClientConfig(t *testing.T) { | |
| 10 | + | t.Setenv("XDG_CONFIG_HOME", t.TempDir()) | |
| 11 | + | ||
| 12 | + | cfg := []byte(` | |
| 13 | + | [client] | |
| 14 | + | mode = "remote" | |
| 15 | + | remote = "https://gordon.example.com" | |
| 16 | + | insecure_tls = true | |
| 17 | + | `) | |
| 18 | + | path := DefaultClientConfigPath() | |
| 19 | + | if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil { | |
| 20 | + | t.Fatalf("mkdir config dir: %v", err) | |
| 21 | + | } | |
| 22 | + | if err := os.WriteFile(path, cfg, 0o600); err != nil { | |
| 23 | + | t.Fatalf("write config: %v", err) | |
| 24 | + | } | |
| 25 | + | ||
| 26 | + | url, _, insecure, isRemote := ResolveRemote("", "", false) | |
| 27 | + | if !isRemote { | |
| 28 | + | t.Fatalf("expected remote mode") | |
| 29 | + | } | |
| 30 | + | if url != "https://gordon.example.com" { | |
| 31 | + | t.Fatalf("unexpected url: %s", url) | |
| 32 | + | } | |
| 33 | + | if !insecure { | |
| 34 | + | t.Fatalf("expected insecure TLS true from client config") | |
| 35 | + | } | |
| 36 | + | } | |
| 37 | + | ||
| 38 | + | func TestResolveInsecureTLSForRemote_FromRemoteEntry(t *testing.T) { | |
| 39 | + | t.Setenv("XDG_CONFIG_HOME", t.TempDir()) | |
| 40 | + | ||
| 41 | + | remotes := &ClientConfig{ | |
| 42 | + | Active: "prod", | |
| 43 | + | Remotes: map[string]RemoteEntry{ | |
| 44 | + | "prod": { | |
| 45 | + | URL: "https://gordon.example.com", | |
| 46 | + | InsecureTLS: true, | |
| 47 | + | }, | |
| 48 | + | }, | |
| 49 | + | } | |
| 50 | + | if err := SaveRemotes("", remotes); err != nil { | |
| 51 | + | t.Fatalf("save remotes: %v", err) | |
| 52 | + | } | |
| 53 | + | ||
| 54 | + | if !ResolveInsecureTLSForRemote(false, "prod") { | |
| 55 | + | t.Fatalf("expected insecure TLS true from remote entry") | |
| 56 | + | } | |
| 57 | + | } | |
| 58 | + | ||
| 59 | + | func TestResolveInsecureTLSForRemote_EnvAndFlagPrecedence(t *testing.T) { | |
| 60 | + | t.Setenv("XDG_CONFIG_HOME", t.TempDir()) | |
| 61 | + | t.Setenv("GORDON_INSECURE", "true") | |
| 62 | + | ||
| 63 | + | // env=true should enable when flag is false | |
| 64 | + | if !ResolveInsecureTLSForRemote(false, "") { | |
| 65 | + | t.Fatalf("expected insecure TLS true from env") | |
| 66 | + | } | |
| 67 | + | ||
| 68 | + | // flag=true should always enable | |
| 69 | + | if !ResolveInsecureTLSForRemote(true, "") { | |
| 70 | + | t.Fatalf("expected insecure TLS true from flag") | |
| 71 | + | } | |
| 72 | + | } | |
| @@ -0,0 +1,72 @@ | |||||
| 1 | + | package remote | |||
| 2 | + | ||||
| 3 | + | import ( | |||
| 4 | + | "os" | |||
| 5 | + | "path/filepath" | |||
| 6 | + | "testing" | |||
| 7 | + | ) | |||
| 8 | + | ||||
| 9 | + | func TestResolveRemote_InsecureTLSFromClientConfig(t *testing.T) { | |||
| 10 | + | t.Setenv("XDG_CONFIG_HOME", t.TempDir()) | |||
| 11 | + | ||||
| 12 | + | cfg := []byte(` | |||
| 13 | + | [client] | |||
| 14 | + | mode = "remote" | |||
| 15 | + | remote = "https://gordon.example.com" | |||
| 16 | + | insecure_tls = true | |||
| 17 | + | `) | |||
| 18 | + | path := DefaultClientConfigPath() | |||
| 19 | + | if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil { | |||
| 20 | + | t.Fatalf("mkdir config dir: %v", err) | |||
| 21 | + | } | |||
| 22 | + | if err := os.WriteFile(path, cfg, 0o600); err != nil { | |||
| 23 | + | t.Fatalf("write config: %v", err) | |||
| 24 | + | } | |||
| 25 | + | ||||
| 26 | + | url, _, insecure, isRemote := ResolveRemote("", "", false) | |||
| 27 | + | if !isRemote { | |||
| 28 | + | t.Fatalf("expected remote mode") | |||
| 29 | + | } | |||
| 30 | + | if url != "https://gordon.example.com" { | |||
| 31 | + | t.Fatalf("unexpected url: %s", url) | |||
| 32 | + | } | |||
| 33 | + | if !insecure { | |||
| 34 | + | t.Fatalf("expected insecure TLS true from client config") | |||
| 35 | + | } | |||
| 36 | + | } | |||
| 37 | + | ||||
| 38 | + | func TestResolveInsecureTLSForRemote_FromRemoteEntry(t *testing.T) { | |||
| 39 | + | t.Setenv("XDG_CONFIG_HOME", t.TempDir()) | |||
| 40 | + | ||||
| 41 | + | remotes := &ClientConfig{ | |||
| 42 | + | Active: "prod", | |||
| 43 | + | Remotes: map[string]RemoteEntry{ | |||
| 44 | + | "prod": { | |||
| 45 | + | URL: "https://gordon.example.com", | |||
| 46 | + | InsecureTLS: true, | |||
| 47 | + | }, | |||
| 48 | + | }, | |||
| 49 | + | } | |||
| 50 | + | if err := SaveRemotes("", remotes); err != nil { | |||
| 51 | + | t.Fatalf("save remotes: %v", err) | |||
| 52 | + | } | |||
| 53 | + | ||||
| 54 | + | if !ResolveInsecureTLSForRemote(false, "prod") { | |||
| 55 | + | t.Fatalf("expected insecure TLS true from remote entry") | |||
| 56 | + | } | |||
| 57 | + | } | |||
| 58 | + | ||||
| 59 | + | func TestResolveInsecureTLSForRemote_EnvAndFlagPrecedence(t *testing.T) { | |||
| 60 | + | t.Setenv("XDG_CONFIG_HOME", t.TempDir()) | |||
| 61 | + | t.Setenv("GORDON_INSECURE", "true") | |||
| 62 | + | ||||
| 63 | + | // env=true should enable when flag is false | |||
| 64 | + | if !ResolveInsecureTLSForRemote(false, "") { | |||
| 65 | + | t.Fatalf("expected insecure TLS true from env") | |||
| 66 | + | } | |||
| 67 | + | ||||
| 68 | + | // flag=true should always enable | |||
| 69 | + | if !ResolveInsecureTLSForRemote(true, "") { | |||
| 70 | + | t.Fatalf("expected insecure TLS true from flag") | |||
| 71 | + | } | |||
| 72 | + | } | |||
M internal/adapters/in/cli/root.go +5 -5
| @@ -136,21 +136,21 @@ Commands are organized by where they run: | |||
| 136 | 136 | // GetRemoteClient returns a remote client if targeting a remote instance, | |
| 137 | 137 | // or nil if running locally. | |
| 138 | 138 | func GetRemoteClient() (*remote.Client, bool) { | |
| 139 | - | url, token, isRemote := remote.ResolveRemote(remoteFlag, tokenFlag) | |
| 139 | + | url, token, insecureTLS, isRemote := remote.ResolveRemote(remoteFlag, tokenFlag, insecureTLSFlag) | |
| 140 | 140 | if !isRemote { | |
| 141 | 141 | return nil, false | |
| 142 | 142 | } | |
| 143 | 143 | ||
| 144 | - | client := remote.NewClient(url, remoteClientOptions(token)...) | |
| 144 | + | client := remote.NewClient(url, remoteClientOptions(token, insecureTLS)...) | |
| 145 | 145 | return client, true | |
| 146 | 146 | } | |
| 147 | 147 | ||
| 148 | - | func remoteClientOptions(token string) []remote.ClientOption { | |
| 148 | + | func remoteClientOptions(token string, insecureTLS bool) []remote.ClientOption { | |
| 149 | 149 | opts := make([]remote.ClientOption, 0, 2) | |
| 150 | 150 | if token != "" { | |
| 151 | 151 | opts = append(opts, remote.WithToken(token)) | |
| 152 | 152 | } | |
| 153 | - | if insecureTLSFlag { | |
| 153 | + | if insecureTLS { | |
| 154 | 154 | opts = append(opts, remote.WithInsecureTLS(true)) | |
| 155 | 155 | } | |
| 156 | 156 | return opts | |
| @@ -158,7 +158,7 @@ func remoteClientOptions(token string) []remote.ClientOption { | |||
| 158 | 158 | ||
| 159 | 159 | // IsRemoteMode returns true if CLI is targeting a remote Gordon instance. | |
| 160 | 160 | func IsRemoteMode() bool { | |
| 161 | - | _, _, isRemote := remote.ResolveRemote(remoteFlag, tokenFlag) | |
| 161 | + | _, _, _, isRemote := remote.ResolveRemote(remoteFlag, tokenFlag, insecureTLSFlag) | |
| 162 | 162 | return isRemote | |
| 163 | 163 | } | |
| 164 | 164 | ||
| @@ -136,21 +136,21 @@ Commands are organized by where they run: | |||||
| 136 | // GetRemoteClient returns a remote client if targeting a remote instance, | 136 | // GetRemoteClient returns a remote client if targeting a remote instance, | ||
| 137 | // or nil if running locally. | 137 | // or nil if running locally. | ||
| 138 | func GetRemoteClient() (*remote.Client, bool) { | 138 | func GetRemoteClient() (*remote.Client, bool) { | ||
| 139 | - | url, token, isRemote := remote.ResolveRemote(remoteFlag, tokenFlag) | 139 | + | url, token, insecureTLS, isRemote := remote.ResolveRemote(remoteFlag, tokenFlag, insecureTLSFlag) |
| 140 | if !isRemote { | 140 | if !isRemote { | ||
| 141 | return nil, false | 141 | return nil, false | ||
| 142 | } | 142 | } | ||
| 143 | 143 | ||||
| 144 | - | client := remote.NewClient(url, remoteClientOptions(token)...) | 144 | + | client := remote.NewClient(url, remoteClientOptions(token, insecureTLS)...) |
| 145 | return client, true | 145 | return client, true | ||
| 146 | } | 146 | } | ||
| 147 | 147 | ||||
| 148 | - | func remoteClientOptions(token string) []remote.ClientOption { | 148 | + | func remoteClientOptions(token string, insecureTLS bool) []remote.ClientOption { |
| 149 | opts := make([]remote.ClientOption, 0, 2) | 149 | opts := make([]remote.ClientOption, 0, 2) | ||
| 150 | if token != "" { | 150 | if token != "" { | ||
| 151 | opts = append(opts, remote.WithToken(token)) | 151 | opts = append(opts, remote.WithToken(token)) | ||
| 152 | } | 152 | } | ||
| 153 | - | if insecureTLSFlag { | 153 | + | if insecureTLS { |
| 154 | opts = append(opts, remote.WithInsecureTLS(true)) | 154 | opts = append(opts, remote.WithInsecureTLS(true)) | ||
| 155 | } | 155 | } | ||
| 156 | return opts | 156 | return opts | ||
| @@ -158,7 +158,7 @@ func remoteClientOptions(token string) []remote.ClientOption { | |||||
| 158 | 158 | ||||
| 159 | // IsRemoteMode returns true if CLI is targeting a remote Gordon instance. | 159 | // IsRemoteMode returns true if CLI is targeting a remote Gordon instance. | ||
| 160 | func IsRemoteMode() bool { | 160 | func IsRemoteMode() bool { | ||
| 161 | - | _, _, isRemote := remote.ResolveRemote(remoteFlag, tokenFlag) | 161 | + | _, _, _, isRemote := remote.ResolveRemote(remoteFlag, tokenFlag, insecureTLSFlag) |
| 162 | return isRemote | 162 | return isRemote | ||
| 163 | } | 163 | } | ||
| 164 | 164 | ||||