From b3154fa822263702d4a8b3c4fdc858c242708395 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Strna=CC=81dek?= Date: Thu, 27 Nov 2025 10:55:21 +0100 Subject: [PATCH 1/2] Allow TLS in cache config --- .env-issuer.sample | 1 + internal/cache/cache.go | 16 +++++++++++++--- internal/config/config.go | 1 + internal/config/config_test.go | 8 ++++++++ internal/pubsub/pubsub.go | 16 ++++++++++++++-- internal/redis/redis.go | 10 +++++++++- 6 files changed, 46 insertions(+), 6 deletions(-) diff --git a/.env-issuer.sample b/.env-issuer.sample index 5c23818f4..f5ce779d4 100644 --- a/.env-issuer.sample +++ b/.env-issuer.sample @@ -64,6 +64,7 @@ ISSUER_CIRCUIT_PATH=./pkg/credentials/circuits # ISSUER_CACHE_PROVIDER could be either [redis | valkey] ISSUER_CACHE_PROVIDER=redis ISSUER_CACHE_URL=redis://@redis:6379/1 +ISSUER_CACHE_TLS=false ISSUER_KEY_STORE_TOKEN= diff --git a/internal/cache/cache.go b/internal/cache/cache.go index 2bf439d4e..031ae4ebd 100644 --- a/internal/cache/cache.go +++ b/internal/cache/cache.go @@ -3,6 +3,7 @@ package cache import ( "context" "time" + "crypto/tls" "github.com/valkey-io/valkey-go" @@ -32,20 +33,29 @@ type Cache interface { func NewCacheClient(ctx context.Context, cfg config.Configuration) (Cache, error) { var cachex Cache if cfg.Cache.Provider == config.CacheProviderRedis { - rdb, err := redis.Open(ctx, cfg.Cache.Url) + rdb, err := redis.Open(ctx, cfg.Cache.Url, cfg.Cache.TLS) if err != nil { log.Error(ctx, "cannot connect to redis", "err", err, "host", cfg.Cache.Url) return nil, err } cachex = NewRedisCache(rdb) } else if cfg.Cache.Provider == config.CacheProviderValKey { - client, err := valkey.NewClient(valkey.ClientOption{InitAddress: []string{cfg.Cache.Url}}) + opts := []valkey.ClientOption{ + InitAddress: []string{cfg.Cache.Url}, + } + + if cfg.Cache.TLS { + opts.TLSConfig = &tls.Config{} + } + + client, err := valkey.NewClient(opts) + if err != nil { log.Error(ctx, "cannot connect to valkey", "err", err, "host", cfg.Cache.Url) return nil, err } - cachex = NewValKeyCache(client) + cachex = NewValKeyCache(client) } return cachex, nil diff --git a/internal/config/config.go b/internal/config/config.go index 5e21fb8e3..85148f06c 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -83,6 +83,7 @@ type Database struct { type Cache struct { Provider string `env:"ISSUER_CACHE_PROVIDER" envDefault:"redis"` Url string `env:"ISSUER_CACHE_URL"` + TLS bool `env:"ISSUER_CACHE_TLS" envDefault:"false"` } // IPFS configurations diff --git a/internal/config/config_test.go b/internal/config/config_test.go index db0b0bd1a..a101392ff 100644 --- a/internal/config/config_test.go +++ b/internal/config/config_test.go @@ -233,6 +233,13 @@ func TestLoadCacheProvider(t *testing.T) { cfg, err := Load() assert.NoError(t, err) assert.Equal(t, "redis", cfg.Cache.Provider) + assert.Equal(t, false, cfg.Cache.TLS) + + envVars["ISSUER_CACHE_TLS"] = "true" + loadEnvironmentVariables(t, envVars) + cfg, err = Load() + assert.NoError(t, err) + assert.Equal(t, true, cfg.Cache.TLS) envVars["ISSUER_CACHE_URL"] = "" loadEnvironmentVariables(t, envVars) @@ -274,6 +281,7 @@ func initVariables(t *testing.T) envVarsT { "ISSUER_MEDIA_TYPE_MANAGER_ENABLED": "true", "ISSUER_CACHE_PROVIDER": "redis", "ISSUER_CACHE_URL": "redis://@localhost:6379/1", + "ISSUER_CACHE_TLS": "false", } return envVars } diff --git a/internal/pubsub/pubsub.go b/internal/pubsub/pubsub.go index acfc39600..8cdcd31b8 100644 --- a/internal/pubsub/pubsub.go +++ b/internal/pubsub/pubsub.go @@ -3,6 +3,8 @@ package pubsub import ( "context" + "crypto/tls" + "github.com/valkey-io/valkey-go" "github.com/polygonid/sh-id-platform/internal/config" @@ -43,18 +45,28 @@ type Client interface { func NewPubSub(ctx context.Context, cfg config.Configuration) (Client, error) { var ps Client if cfg.Cache.Provider == config.CacheProviderRedis { - rdb, err := redis.Open(ctx, cfg.Cache.Url) + rdb, err := redis.Open(ctx, cfg.Cache.Url, cfg.Cache.TLS) if err != nil { log.Error(ctx, "cannot connect to redis", "err", err, "host", cfg.Cache.Url) return nil, err } ps = NewRedis(rdb) } else if cfg.Cache.Provider == config.CacheProviderValKey { - client, err := valkey.NewClient(valkey.ClientOption{InitAddress: []string{cfg.Cache.Url}}) + opts = := []valkey.ClientOption{ + InitAddress: []string{cfg.Cache.Url}, + } + + if cfg.Cache.TLS { + opts.TLSConfig = &tls.Config{} + } + + client, err := valkey.NewClient(opts) + if err != nil { log.Error(ctx, "cannot connect to valkey", "err", err, "host", cfg.Cache.Url) return nil, err } + ps = NewValKeyClient(client) } diff --git a/internal/redis/redis.go b/internal/redis/redis.go index 0c085a17c..51b940c1d 100644 --- a/internal/redis/redis.go +++ b/internal/redis/redis.go @@ -2,16 +2,24 @@ package redis import ( "context" + "crypto/tls" "github.com/go-redis/redis/v8" ) // Open opens a connection to redis and returns it -func Open(ctx context.Context, url string) (*redis.Client, error) { +func Open(ctx context.Context, url string, tls bool) (*redis.Client, error) { opts, err := redis.ParseURL(url) if err != nil { return nil, err } + + if tls { + opts.TLSConfig = &tls.Config{ + InsecureSkipVerify: false, // true only if you want to test self-signed certificates + } + } + rdb := redis.NewClient(opts) if err := Status(ctx, rdb); err != nil { return nil, err From 1b4b27674505ccbaa6cce2a75b5143ecaaca042e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Strna=CC=81dek?= Date: Thu, 27 Nov 2025 12:30:26 +0100 Subject: [PATCH 2/2] feat(cache#tls) Allow TLS --- internal/cache/cache.go | 4 ++-- internal/pubsub/pubsub.go | 2 +- internal/redis/redis.go | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/internal/cache/cache.go b/internal/cache/cache.go index 031ae4ebd..98f1e56fa 100644 --- a/internal/cache/cache.go +++ b/internal/cache/cache.go @@ -2,8 +2,8 @@ package cache import ( "context" - "time" "crypto/tls" + "time" "github.com/valkey-io/valkey-go" @@ -40,7 +40,7 @@ func NewCacheClient(ctx context.Context, cfg config.Configuration) (Cache, error } cachex = NewRedisCache(rdb) } else if cfg.Cache.Provider == config.CacheProviderValKey { - opts := []valkey.ClientOption{ + opts := valkey.ClientOption{ InitAddress: []string{cfg.Cache.Url}, } diff --git a/internal/pubsub/pubsub.go b/internal/pubsub/pubsub.go index 8cdcd31b8..24c88a56d 100644 --- a/internal/pubsub/pubsub.go +++ b/internal/pubsub/pubsub.go @@ -52,7 +52,7 @@ func NewPubSub(ctx context.Context, cfg config.Configuration) (Client, error) { } ps = NewRedis(rdb) } else if cfg.Cache.Provider == config.CacheProviderValKey { - opts = := []valkey.ClientOption{ + opts := valkey.ClientOption{ InitAddress: []string{cfg.Cache.Url}, } diff --git a/internal/redis/redis.go b/internal/redis/redis.go index 51b940c1d..2fe87a8a8 100644 --- a/internal/redis/redis.go +++ b/internal/redis/redis.go @@ -8,13 +8,13 @@ import ( ) // Open opens a connection to redis and returns it -func Open(ctx context.Context, url string, tls bool) (*redis.Client, error) { +func Open(ctx context.Context, url string, tlsEnabled bool) (*redis.Client, error) { opts, err := redis.ParseURL(url) if err != nil { return nil, err } - if tls { + if tlsEnabled { opts.TLSConfig = &tls.Config{ InsecureSkipVerify: false, // true only if you want to test self-signed certificates }