Clojurians Log v2
Clojure programming
Channels
Apps
pedestal
Parenoid 2020-04-14T06:13:20.071600Z
how do I enable ssl on my pedestal app so it's https as opposed to http?
KJO 2020-04-17T15:30:40.082300Z
It's a bit of a pain, but the following service map works (you can ignore the web socket stuff). Notes about the keystore are below.
(def service-map
(let
[keystore-location
(if (System/getenv "KEYSTORE_LOCATION")
(-> (io/file (System/getenv "KEYSTORE_LOCATION"))
(.getCanonicalPath))
"/home/user/security/jetty-keystore")]
{::http/host "0.0.0.0"
::http/allowed-origins
{:allowed-origins (fn[_] true)
:creds true}
::http/routes #(deref #'routes)
::http/type :jetty
::http/container-options
{:context-configurator jetty-websocket-configurator
:h2c? true
:h2 true
:ssl? true
:ssl-port 8081
:keystore keystore-location
:key-password "thepassword"
:security-provider "Conscrypt"}
::http/port 8080}))$ openssl genrsa -des3 -out site.key 2048$ cp site.key site.orig.key
$ openssl rsa -in site.orig.key -out site.key$ openssl req -new -key site.key -out site.csr$ openssl req -new -x509 -key site.key -out sitex509.crt$ openssl pkcs12 -inkey site.key -in sitex509.crt -export -out site.pkcs12
hindol 2020-04-17T16:10:56.082600Z
Can you please write a blog post about this? That will be very helpful for anyone needing to do the same thing. And thanks!
KJO 2020-04-17T21:10:14.082800Z
That's a good idea. Thanks. It's at https://heykieran.github.io/posts/pedestal-jetty-https/
hindol 2020-04-17T21:21:01.083100Z
Super! Thank you.
Parenoid 2020-04-14T06:14:02.071800Z
a big topic, I know.
hindol 2020-04-14T06:25:31.072100Z
You can see the implementation here: https://github.com/pedestal/pedestal/blob/master/jetty/src/io/pedestal/http/jetty.clj Check the comments towards the end.
hindol 2020-04-14T06:26:19.072500Z
I have not tried the steps myself though.
2020-04-14T10:20:57.074700Z
I have a question about
(fern/lit vase.datomic.cloud/clientjava.lang.AbstractMethodError: Receiver class datomic.client.impl.shared.Client does not define or inherit an implementation of the resolved method abstract create_database(Ljava/lang/Object;)Ljava/lang/Object; of interface datomic.client.impl.shared.protocols.Client.
at datomic.client.api.async$create_database.invokeStatic(async.clj:148)
at datomic.client.api.async$create_database.invoke(async.clj:140)
at datomic.client.api.sync.Client.create_database(sync.clj:73)
at datomic.client.api$create_database.invokeStatic(api.clj:144)
at datomic.client.api$create_database.invoke(api.clj:135)
at com.cognitect.vase.fern.CloudConnection._interceptor(fern.clj:94) 2020-04-14T10:42:29.074900Z
Oh I see, this is a special case > NOTE: create-database is not available with peer-server. > Use a Datomic Peer to create databases with Datomic On-Prem.
2020-04-14T10:46:20.075100Z
it would be nice if I could disable that (client/create-database call from the config
2020-04-14T14:05:04.075300Z
@ben.hammond thanks for pointing this out. In retrospect, DB lifecycle management should be done independently. Including calls to create-database for every request is not recommended. This new learning led to me changing the pedestal.ions sample app (https://github.com/pedestal/pedestal-ions-sample#database-life-cycle-management). I’m going to create an issue capture that this needs to be followed up on.
2020-04-14T14:06:12.075500Z
In that sample I adopted the approach taken by the Datomic Ions tutorial (https://docs.datomic.com/cloud/ions/ions-tutorial.html#orgd70504f)
2020-04-14T14:07:35.075700Z
I’m incorrect, the code you linked creates the db on interceptor creation only. Still, it should be done explicitly and elsewhere
2020-04-14T14:26:15.076Z
Yeah I'm combining integrant with vase & pedestal in order to manage lifecycle and dependencies