Testing against instance with SSL

[stefanak-michal]

Hi.

I would like to test socket connection with SSL and I'm thinking about using playground instance. I'm not sure if playground instance are turned off after some time of inactivity. So that would be my first question. Are they?

If yes then the title of this discussion takes place. Can I somehow request status of playground instance? I see in node info HTTP status port 8080 but I'm unable to create url which will work. What format should url have to get readiness and liveness ?

Maybe in the end I would like to ask other question to avoid all this trouble. It is possible to run thingsDB in container (docker) with certificate so I can test ssl connection with it? I don't see anything related to this in docs.

[joente]

1. Playground instances will stay alive and they are not turned off. Keep in mind however that we might bring the the playground offline for short periods like an hour as we do not consider this as a critical environment.
2. If you want your own playground and test TLS/SSL, you can use tlsproxy with ThingsDB.
3. I'm not sure if I understand the question about readiness/liveness correct, but this is what we do in Kubernetes:

        livenessProbe:
          httpGet:
            path: /healthy
            port: 8080
          initialDelaySeconds: 60
          periodSeconds: 20
          timeoutSeconds: 5
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 3

4. It is rather simple to create a docker container with TLS/SSL support, just by using the "tlsproxy" mentioned earlier. Can you create one? (If you need help, just reply)

[stefanak-michal]

@joente If I can run own instance with SSL I would like that. Therefore I don't have too keep instance eating up your resources at playground.

Yes I need help with that. I'm not very good with DevOps. But docker is maybe not that important. What I see as bigger issue is to set up github workflow where ThingsDB will be running with SSL.

I'm okay if the certificate will be self-signed. I can add allow_self_signed into configuration when connecting to it.

[joente]

No problem, I can create a docker image with TLS/SSL support.

[joente]

I've created a Dockerfile for TLS/SSL support in the dockssl branch: https://github.com/thingsdb/ThingsDB/blob/dockssl/docker/tls.Dockerfile

Build the image:

docker build -t thingsdbtls  . -f docker/tls.Dockerfile

You need to create a certificate, see: https://github.com/cesbit/tlsproxy/blob/main/README.md

Save the server.crt and server.key in ~/certificates

Next, start the container:

docker run \
    -d \
    -p 443:443 \
    -p 9443:9443 \
    -p 8080:8080 \
    -v ~/thingsdb-data:/data \
    -v ~/thingsdb-modules:/modules \
    -v ~/certificates:/certificates \
    thingsdbtls \
    --init

[stefanak-michal]

Maybe I can ask for some help with setting github workflow. My wip workflow is here https://github.com/stefanak-michal/thingsdb-php/blob/workflow/.github/workflows/tests.yml

I don't know why but connection to ThingsDB still doesn't work. Unable to connect to 127.0.0.1:9200 (Connection refused)

[stefanak-michal]

args is available only for step, not for service docs

[stefanak-michal]

Even when I tried it gave error:

[Invalid workflow file: .github/workflows/tests.yml#L22](https://github.com/stefanak-michal/thingsdb-php/actions/runs/8479131998/workflow)
The workflow is not valid. .github/workflows/tests.yml (Line: 22, Col: 9): Unexpected value 'args'

[joente]

You're right, args is not supported for services. I can change ThingsDB to accept an environment variable THINGSDB_INIT (and THINGSDB_SECRET and THINGSDB_DEPLOY) which can be read before parsing the arguments. This way, arguments would "win" but environment variable could be used as well.

[stefanak-michal]

@joente i agree. it seems that is the only workaround. i'm searching on internet about this issue and they resolve it in similar way.

[joente]

You can test the dockssl branch (v1.5.3-alpha0). see commit: e0dcde9

[stefanak-michal]

Thank you so much for your help. env variable will be good in future.

But thanks to you I was able to put together own Dockerfile(s). If somebody is interested I've made Dockerfile for ThingsDB without SSL and with SSL for my github actions.

https://github.com/stefanak-michal/thingsdb-php/blob/master/ci/thingsdb.Dockerfile

https://github.com/stefanak-michal/thingsdb-php/blob/master/ci/tls.Dockerfile

They also already contains discussed --init. TLS Dockerfile also automatically generate some dummy certificate.

Afterwards my github action workflow files looks like this:

https://github.com/stefanak-michal/thingsdb-php/blob/master/.github/workflows/tests.yml

https://github.com/stefanak-michal/thingsdb-php/blob/master/.github/workflows/tests_tls.yml