redis tls

lib/travis/hub/config.rb

@@ -25,8 +25,8 @@ def jwt_key(type)
              database: { adapter: 'postgresql', database: "travis_#{env}", encoding: 'unicode', min_messages: 'warning', pool: 25, reaping_frequency: 60, variables: { statement_timeout: 10_000 } },
              logs_api: { url: 'https://travis-logs-notset.example.com:1234', token: 'notset', retries: { max: 5, interval: 3, max_interval: 60, interval_randomness: 0.5, backoff_factor: 2 } },
              job_board: { url: 'https://not:[email protected]', site: 'org' },
-             redis: { url: ENV['TRAVIS_REDIS_URL'] || 'redis://localhost:6379' },
-             redis_insights: { url: ENV['INSIGHTS_REDIS_URL'] || 'redis://localhost:6379' },
+             redis: { url: ENV['TRAVIS_REDIS_URL'] || 'redis://localhost:6379', ssl: ENV['REDIS_SSL'] || false},
+             redis_insights: { url: ENV['INSIGHTS_REDIS_URL'] || 'redis://localhost:6379' , ssl: ENV['INSIGHTS_REDIS_SSL'] || false},
              sidekiq: { pool_size: 1 },
              lock: { strategy: :redis, ttl: 30_000 },
              states_cache: { memcached_servers: 'localhost:11211', memcached_options: {} },

lib/travis/hub/context.rb

@@ -23,7 +23,7 @@ def initialize(options = {})
         @logger     = options[:logger] || Travis::Logger.new(STDOUT, config)
         @exceptions = Travis::Exceptions.setup(config, config.env, logger)
         @metrics    = Travis::Metrics.setup(config.metrics, logger)
-        @redis      = Travis::RedisPool.new(config.redis.to_h)
+        @redis      = Travis::RedisPool.new(config)
         @amqp       = Travis::Amqp.setup(config.amqp, @config.enterprise?)
 
         Travis::Database.connect(ActiveRecord::Base, config.database, logger)

lib/travis/hub/helper/locking.rb

@@ -6,7 +6,14 @@ module Helper
       module Locking
         def exclusive(key, options = nil, &block)
           options ||= config.lock.to_h
-          options[:url] ||= config.redis.url if options[:strategy] == :redis
+          if options[:strategy] == :redis
+            options[:url] ||= config.redis.url
+            options[:ssl] ||= config[:redis][:ssl]
+            options[:ca_path] ||= ENV['REDIS_SSL_CA_PATH'] if ENV['REDIS_SSL_CA_PATH']
+            options[:cert] ||= OpenSSL::X509::Certificate.new(File.read(ENV['REDIS_SSL_CERT_FILE'])) if ENV['REDIS_SSL_CERT_FILE']
+            options[:key] ||= OpenSSL::PKEY::RSA.new(File.read(ENV['REDIS_SSL_KEY_FILE'])) if ENV['REDIS_SSL_KEY_FILE']
+            options[:verify_mode] ||= OpenSSL::SSL::VERIFY_NONE if config[:ssl_verify] == false
+          end
 
           Lock.exclusive(key, options) do
             logger.debug "Locking #{key}"

lib/travis/hub/support/redis_pool.rb

@@ -7,9 +7,25 @@ class RedisPool
     attr_reader :pool
 
     def initialize(options = {})
-      pool_options = options.delete(:pool) || {}
+      config = options.redis.to_h
+      pool_options = config.delete(:pool) || {}
+      cfg = config.to_h
+      cfg = cfg.merge(ssl_params: redis_ssl_params(options)) if cfg[:ssl]
       @pool = ConnectionPool.new(pool_options) do
-        ::Redis.new(options)
+        ::Redis.new(cfg)
+      end
+    end
+
+    def redis_ssl_params(config)
+      @redis_ssl_params ||= begin
+        return nil unless config[:redis][:ssl]
+
+        value = {}
+        value[:ca_path] = ENV['REDIS_SSL_CA_PATH'] if ENV['REDIS_SSL_CA_PATH']
+        value[:cert] = OpenSSL::X509::Certificate.new(File.read(ENV['REDIS_SSL_CERT_FILE'])) if ENV['REDIS_SSL_CERT_FILE']
+        value[:key] = OpenSSL::PKEY::RSA.new(File.read(ENV['REDIS_SSL_KEY_FILE'])) if ENV['REDIS_SSL_KEY_FILE']
+        value[:verify_mode] = OpenSSL::SSL::VERIFY_NONE if config[:ssl_verify] == false
+        value
       end
     end
 

lib/travis/hub/support/sidekiq.rb

@@ -7,12 +7,28 @@
 
 module Travis
   module Sidekiq
+
+    def redis_ssl_params(config)
+      @redis_ssl_params ||= begin
+        return nil unless config.redis.ssl
+
+        value = {}
+        value[:ca_path] = ENV['REDIS_SSL_CA_PATH'] if ENV['REDIS_SSL_CA_PATH']
+        value[:cert] = OpenSSL::X509::Certificate.new(File.read(ENV['REDIS_SSL_CERT_FILE'])) if ENV['REDIS_SSL_CERT_FILE']
+        value[:key] = OpenSSL::PKEY::RSA.new(File.read(ENV['REDIS_SSL_KEY_FILE'])) if ENV['REDIS_SSL_KEY_FILE']
+        value[:verify_mode] = OpenSSL::SSL::VERIFY_NONE if config.ssl_verify == false
+        value
+      end
+    end
+
     def setup(config)
       ::Sidekiq.configure_server do |c|
         c.logger.level = Logger::WARN
         c.redis = {
           url: config.redis.url,
-          id: nil
+          id: nil,
+          ssl: config.redis.ssl || false,
+          ssl_params: redis_ssl_params(config)
         }
 
         c.server_middleware do |chain|
@@ -33,7 +49,9 @@ def setup(config)
       ::Sidekiq.configure_client do |c|
         c.redis = {
           url: config.redis.url,
-          id: nil
+          id: nil,
+          ssl: config.redis.ssl || false,
+          ssl_params: redis_ssl_params(config)
         }
 
         if pro?

lib/travis/sidekiq.rb

@@ -71,7 +71,9 @@ def default_client
     def default_pool
       ::Sidekiq::RedisConnection.create(
         url: config.redis.url,
-        id: nil
+        id: nil,
+        ssl: config.redis.ssl || false,
+        ssl_params: redis_ssl_params(config)
       )
     end
 
@@ -85,10 +87,25 @@ def insights_client
 
     def insights_pool
       ::Sidekiq::RedisConnection.create(
-        url: config.redis_insights.url
+        url: config.redis_insights.url,
+        ssl: config.redis.ssl || false,
+        ssl_params: redis_insights_ssl_params
       )
     end
 
+    def redis_insights_ssl_params
+      @redis_insights_ssl_params ||= begin
+        return nil unless config.redis.ssl
+
+        value = {}
+        value[:ca_path] = ENV['REDIS_INSIGHTS_SSL_CA_PATH'] if ENV['REDIS_INSIGHTS_SSL_CA_PATH']
+        value[:cert] = OpenSSL::X509::Certificate.new(File.read(ENV['REDIS_INSIGHTS_SSL_CERT_FILE'])) if ENV['REDIS_INSIGHTS_SSL_CERT_FILE']
+        value[:key] = OpenSSL::PKEY::RSA.new(File.read(ENV['REDIS_INSIGHTS_SSL_KEY_FILE'])) if ENV['REDIS_INSIGHTS_SSL_KEY_FILE']
+        value[:verify_mode] = OpenSSL::SSL::VERIFY_NONE if config.ssl_verify == false
+        value
+      end
+    end
+
     def config
       @config ||= Travis::Hub::Config.load
     end