add CA config option

cmd/vetinari-server/dev-config.json

@@ -1,8 +1,9 @@
 {
 	"server": {
 		"addr": ":4443",
-		"tls_cert_file": "../../fixtures/ca.pem",
-		"tls_key_file": "../../fixtures/ca-key.pem"
+		"tls_cert_file": "../../fixtures/vetinari.key",
+		"tls_key_file": "../../fixtures/vetinari.pem",
+		"tls_ca_file": "/go/src/github.com/docker/vetinari/fixtures/ca.cert"
 	},
 	"trust_service": {
 		"type": "remote",

config/config.go

@@ -18,6 +18,7 @@ type ServerConf struct {
 	Addr        string `json:"addr"`
 	TLSCertFile string `json:"tls_cert_file"`
 	TLSKeyFile  string `json:"tls_key_file"`
+	TLSCAFile  string `json:"tls_ca_file,omitempty"`
 }
 
 // TrustServiceConf specificies the service to use for signing.

docker-compose.yml

@@ -4,6 +4,7 @@ vetinari:
    - rufus
   ports:
    - "8080:8080"
+   - "127.0.0.1:4443:4443"
 rufus:
   build: ../rufus
   ports:

server/rufus_trust.go

@@ -21,10 +21,13 @@ type RufusSigner struct {
 	sClient  pb.SignerClient
 }
 
-func newRufusSigner(hostname string, port string) *RufusSigner {
+func newRufusSigner(hostname string, port string, tlscafile string) *RufusSigner {
 	var opts []grpc.DialOption
 	netAddr := net.JoinHostPort(hostname, port)
-	creds := credentials.NewClientTLSFromCert(nil, hostname)
+	creds, err := credentials.NewClientTLSFromFile(tlscafile, hostname)
+	if err != nil {
+		log.Fatalf("fail to read: %v", err)
+	}
 	opts = append(opts, grpc.WithTransportCredentials(creds))
 	conn, err := grpc.Dial(netAddr, opts...)
 	if err != nil {

server/server.go

@@ -24,7 +24,7 @@ func Run(ctx context.Context, conf *config.Configuration) error {
 	var trust signed.TrustService
 	if conf.TrustService.Type == "remote" {
 		log.Println("[Vetinari Server] : Using remote signing service")
-		trust = newRufusSigner(conf.TrustService.Hostname, conf.TrustService.Port)
+		trust = newRufusSigner(conf.TrustService.Hostname, conf.TrustService.Port, conf.Server.TLSCAFile)
 	} else {
 		log.Println("[Vetinari Server] : Using local signing service")
 		trust = signed.NewEd25519()