TLS support for RPC server and upstream connections
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- go, grpc
- Domain
- api, backend, networking, security
Research direction
Start by reading the related issues #2, #3, #12, and #13, then trace the configuration system and the upstream and server entry points they describe. The work is complete when outbound WebSocket and gRPC connections support the specified TLS options and both RPC servers can optionally load certificate and key files, with tests covering configuration and TLS behavior.
Written by the indexing model from the issue text.
Description
Summary
Add TLS support for both apex's outbound connections (to celestia-node) and its inbound RPC server.
Motivation
- Production deployments often require encrypted transport
- celestia-node is also tracking TLS support (celestiaorg/celestia-node#4346)
- Without TLS, auth tokens transit in plaintext
Requirements
Upstream fetcher (outbound)
- Support
wss://endpoints for celestia-node WebSocket connections - Support TLS for gRPC connections to upstream nodes
- Configurable CA certificate for self-signed certs
- Skip-verify option for development (with warning log)
RPC server (inbound)
- Optional TLS termination on the JSON-RPC server
- Optional TLS on the gRPC server
- Certificate and key file paths in config
Configuration
data_source:
endpoint: wss://celestia-node.example.com:26658
tls:
ca_cert: "" # custom CA for self-signed
skip_verify: false # dev only
rpc:
address: 0.0.0.0:26659
tls:
cert_file: ""
key_file: ""
grpc:
address: 0.0.0.0:26660
tls:
cert_file: ""
key_file: ""
Non-goals
- mTLS (mutual TLS) — add later if needed
- Automatic cert provisioning (Let's Encrypt) — use a reverse proxy for that
Related
- #2 — JSON-RPC server
- #3 — gRPC server
- #12 — CelestiaNodeFetcher (upstream client)
- #13 — Configuration system
- Dominant language
- Go
- Stars
- 4
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from evstack/apex
-
Difficulty 5/5 Over a week Newbie friendliness 20/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 60/100
github/gh-aw-mcpg#13748 ·
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
googleapis/librarian#7670 · 2 comments ·