add support for proxy encryption

Author: tayloraswift

Sources/HTTPServer/HTTP.Server.swift

@@ -113,7 +113,7 @@ extension HTTP.Server
     func serve(origin server:HTTP.ServerOrigin,
         host:String,
         port:Int,
-        with context:NIOSSLContext? = nil,
+        with encryption:HTTP.ServerEncryptionLayer? = nil,
         policy:(any HTTP.ServerPolicy)? = nil) async throws
     {
         let bootstrap:ServerBootstrap = .init(group: MultiThreadedEventLoopGroup.singleton)
@@ -129,13 +129,25 @@ extension HTTP.Server
                     HTTPPart<HTTPResponseHead, ByteBuffer>>,
                 (any Channel, NIOHTTP2Handler.AsyncStreamMultiplexer<HTTP.Stream>)>>, Never>
 
-        if  let context:NIOSSLContext
+
+        if  let encryption:HTTP.ServerEncryptionLayer
         {
             listener = try await bootstrap.bind(host: host, port: port)
             {
                 (channel:any Channel) in
 
-                channel.pipeline.addHandler(NIOSSLServerHandler.init(context: context))
+                let encryptionHandlers:[any ChannelHandler]
+
+                switch encryption
+                {
+                case .local(let context):
+                    encryptionHandlers = [NIOSSLServerHandler.init(context: context)]
+
+                case .proxy:
+                    encryptionHandlers = []
+                }
+
+                return channel.pipeline.addHandlers(encryptionHandlers)
                     .flatMap
                 {
                     channel.configureAsyncHTTPServerPipeline

Sources/HTTPServer/HTTP.ServerEncryptionLayer.swift

@@ -0,0 +1,13 @@
+import NIOSSL
+
+extension HTTP
+{
+    @frozen public
+    enum ServerEncryptionLayer
+    {
+        /// Encryption happens on this server.
+        case local(NIOSSLContext)
+        /// Encryption happens on an upstream proxy.
+        case proxy
+    }
+}

Sources/UnidocServer/HTTP.Server (ext).swift

@@ -6,7 +6,7 @@ import NIOSSL
 extension HTTP.Server where Self:Unidoc.Server
 {
     public
-    func run(on port:Int, with niossl:NIOSSLContext? = nil) async throws
+    func run(on port:Int, with encryption:HTTP.ServerEncryptionLayer? = nil) async throws
     {
         try await self._setup()
         try await withThrowingTaskGroup(of: Void.self)
@@ -26,7 +26,7 @@ extension HTTP.Server where Self:Unidoc.Server
                 try await self.serve(origin: self.options.origin,
                     host: "::",
                     port: port,
-                    with: niossl,
+                    with: encryption,
                     policy: self.policy)
             }
             tasks.addTask

Sources/unidoc-linkerd/Main.swift

@@ -27,6 +27,11 @@ struct Main
     var db:Unidoc.DatabaseOptions
     @OptionGroup
     var s3:Unidoc.BucketOptions
+
+    @Flag(
+        name: [.customLong("assume-encrypted")],
+        help: "Assume that the connection is encrypted")
+    var assumeEncrypted:Bool = false
 }
 
 @main
@@ -73,7 +78,7 @@ extension Main:AsyncParsableCommand
                     logger: $0,
                     db: .init(settings: settings, sessions: pool, unidoc: "unidoc"))
 
-                try await server.run(on: self.port)
+                try await server.run(on: self.port, with: self.assumeEncrypted ? .proxy : nil)
             }
         }
     }

Sources/unidoc-tools/Main.Preview.swift

@@ -110,7 +110,8 @@ extension Main.Preview:AsyncParsableCommand
                     logger: $0,
                     db: .init(settings: settings, sessions: pool, unidoc: "unidoc"))
 
-                try await server.run(on: port, with: serverIdentity)
+                try await server.run(on: port,
+                    with: serverIdentity.map(HTTP.ServerEncryptionLayer.local(_:)))
             }
         }
     }