Fix replica sync TLS

kylecarbs · kylecarbs · commit ee59d88a0874 · 2022-10-15T04:09:16.000Z
diff --git a/enterprise/coderd/coderd.go b/enterprise/coderd/coderd.go
@@ -129,32 +129,38 @@ func New(ctx context.Context, options *Options) (*API, error) {
 		})
 	}
 
-	var err error
-	api.replicaManager, err = replicasync.New(ctx, options.Logger, options.Database, options.Pubsub, replicasync.Options{
-		// Create a new replica ID for each Coder instance!
-		ID:           uuid.New(),
-		RelayAddress: options.DERPServerRelayAddress,
-		RegionID:     int32(options.DERPServerRegionID),
-	})
-	if err != nil {
-		return nil, xerrors.Errorf("initialize replica: %w", err)
-	}
-
-	rootCA := x509.NewCertPool()
+	meshRootCA := x509.NewCertPool()
 	for _, certificate := range options.TLSCertificates {
 		for _, certificatePart := range certificate.Certificate {
 			certificate, err := x509.ParseCertificate(certificatePart)
 			if err != nil {
 				return nil, xerrors.Errorf("parse certificate %s: %w", certificate.Subject.CommonName, err)
 			}
-			rootCA.AddCert(certificate)
+			meshRootCA.AddCert(certificate)
 		}
 	}
-	// nolint:gosec
-	api.derpMesh = derpmesh.New(options.Logger.Named("derpmesh"), api.DERPServer, &tls.Config{
+	// This TLS configuration spoofs access from the access URL hostname
+	// assuming that the certificates provided will cover that hostname.
+	//
+	// Replica sync and DERP meshing require accessing replicas via their
+	// internal IP addresses, and if TLS is configured we use the same
+	// certificates.
+	meshTLSConfig := &tls.Config{
 		ServerName: options.AccessURL.Hostname(),
-		RootCAs:    rootCA,
+		RootCAs:    meshRootCA,
+	}
+	var err error
+	api.replicaManager, err = replicasync.New(ctx, options.Logger, options.Database, options.Pubsub, replicasync.Options{
+		// Create a new replica ID for each Coder instance!
+		ID:           uuid.New(),
+		RelayAddress: options.DERPServerRelayAddress,
+		RegionID:     int32(options.DERPServerRegionID),
+		TLSConfig:    meshTLSConfig,
 	})
+	if err != nil {
+		return nil, xerrors.Errorf("initialize replica: %w", err)
+	}
+	api.derpMesh = derpmesh.New(options.Logger.Named("derpmesh"), api.DERPServer, meshTLSConfig)
 
 	err = api.updateEntitlements(ctx)
 	if err != nil {
diff --git a/enterprise/coderd/replicas_test.go b/enterprise/coderd/replicas_test.go
@@ -129,5 +129,11 @@ func TestReplicas(t *testing.T) {
 			return err == nil
 		}, testutil.WaitLong, testutil.IntervalFast)
 		_ = conn.Close()
+		replicas, err = secondClient.Replicas(context.Background())
+		require.NoError(t, err)
+		require.Len(t, replicas, 2)
+		for _, replica := range replicas {
+			require.Empty(t, replica.Error)
+		}
 	})
 }
diff --git a/enterprise/replicasync/replicasync.go b/enterprise/replicasync/replicasync.go
@@ -2,6 +2,7 @@ package replicasync
 
 import (
 	"context"
+	"crypto/tls"
 	"database/sql"
 	"errors"
 	"fmt"
@@ -30,6 +31,7 @@ type Options struct {
 	PeerTimeout    time.Duration
 	RelayAddress   string
 	RegionID       int32
+	TLSConfig      *tls.Config
 }
 
 // New registers the replica with the database and periodically updates to ensure
@@ -254,6 +256,9 @@ func (m *Manager) run(ctx context.Context) error {
 			}
 			client := http.Client{
 				Timeout: m.options.PeerTimeout,
+				Transport: &http.Transport{
+					TLSClientConfig: m.options.TLSConfig,
+				},
 			}
 			res, err := client.Do(req)
 			if err != nil {
