mirror of https://github.com/grafana/grafana
Alerting: Support tls config for webhook receiver (#93513)
Adds the ability to configure tls settings on the webhook receiver (e.g. to skip server certificate validation)pull/95144/head
Tito Lins
9 months ago
committed by
GitHub
parent
d722a25084
commit
71d04a326b
@ -0,0 +1,33 @@ |
||||
# TLS Caddy Server |
||||
|
||||
Starts a [Caddy server](https://caddyserver.com/) with TLS configured. |
||||
|
||||
## Setup |
||||
|
||||
- Caddy is setup to run on port 2081, so when configuring the webhook receiver in Grafana Alerting you should use the |
||||
following the following URL: `https://localhost:2081` |
||||
- Also, Caddy is configured to use a self-signed certificate and to check the client certificate (`require_and_verify` mode) |
||||
- Caddy is setup to log requests and has debug mode enabled to make it easier to investigate possible issues |
||||
|
||||
## TLS Certificates |
||||
|
||||
If you want to configure a webhook contact point in Grafana Alerting with TLS, you need to provide a certificate and key. |
||||
|
||||
You can find them in `/etc/caddy` directory in the container: |
||||
|
||||
``` shell |
||||
docker exec devenv-caddy_tls-1 ls /etc/caddy/ |
||||
``` |
||||
|
||||
### CA Certificate |
||||
|
||||
``` shell |
||||
docker exec devenv-caddy_tls-1 cat /etc/caddy/ca.pem |
||||
``` |
||||
|
||||
### Client certificates |
||||
|
||||
``` shell |
||||
docker exec devenv-caddy_tls-1 cat /etc/caddy/client.pem |
||||
docker exec devenv-caddy_tls-1 cat /etc/caddy/client.key |
||||
``` |
||||
@ -0,0 +1,14 @@ |
||||
{ |
||||
debug |
||||
} |
||||
|
||||
localhost:2081 { |
||||
log |
||||
tls /etc/caddy/server.pem /etc/caddy/server.key { |
||||
ca_root /etc/caddy/ca.pem |
||||
client_auth { |
||||
mode require_and_verify |
||||
trust_pool file /etc/caddy/client.pem /etc/caddy/ca.pem |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1,12 @@ |
||||
FROM caddy:2.8.4-alpine |
||||
|
||||
WORKDIR /etc/caddy |
||||
EXPOSE 2081 |
||||
|
||||
COPY Caddyfile ./Caddyfile |
||||
COPY san.cnf ./san.cnf |
||||
COPY gen_certs.sh ./gen_certs.sh |
||||
|
||||
RUN apk update && apk upgrade --no-cache && apk add openssl |
||||
|
||||
RUN ./gen_certs.sh |
||||
@ -0,0 +1,17 @@ |
||||
#!/bin/sh |
||||
|
||||
DAYS_VALID=3650 |
||||
|
||||
# Create CA certificate |
||||
openssl genpkey -algorithm RSA -out ca.key |
||||
openssl req -new -x509 -days $DAYS_VALID -key ca.key -out ca.pem -subj "/CN=My CA" |
||||
|
||||
# Create server certificate |
||||
openssl genpkey -algorithm RSA -out server.key |
||||
openssl req -new -key server.key -out server.csr -subj "/CN=localhost" |
||||
openssl x509 -req -days $DAYS_VALID -in server.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out server.pem -extfile san.cnf -extensions v3_req |
||||
|
||||
# Create client key and certificate |
||||
openssl genpkey -algorithm RSA -out client.key |
||||
openssl req -new -key client.key -out client.csr -subj "/CN=Client" |
||||
openssl x509 -req -days $DAYS_VALID -in client.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out client.pem -extfile san.cnf -extensions v3_req |
||||
@ -0,0 +1,7 @@ |
||||
[ v3_req ] |
||||
subjectAltName = @alt_names |
||||
|
||||
[ alt_names ] |
||||
DNS.1 = localhost |
||||
IP.1 = 127.0.0.1 |
||||
IP.2 = ::1 |
||||
@ -0,0 +1,5 @@ |
||||
caddy_tls: |
||||
build: |
||||
context: docker/blocks/caddy_tls/build |
||||
ports: |
||||
- "2081:2081" |
||||
Loading…
Reference in new issue