gRPC SSL/TLS support

application.yml.example

@@ -13,7 +13,13 @@ micronaut:
               url: http://localhost:4444/oauth2/sessions/logout
 
 plugin:
-  address: http://localhost:65226
+  host: localhost
+  port: 65226
+  ssl:
+    enabled: false
+    trust-ca:
+    cert:
+    private-key:
 
 frontend:
   host: http://localhost:3000

build.gradle.kts

@@ -26,9 +26,11 @@ dependencies {
     ksp("io.micronaut.serde:micronaut-serde-processor")
     ksp("io.micronaut.validation:micronaut-validation-processor")
     implementation("com.google.protobuf:protobuf-kotlin:4.36.2")
-    implementation("io.micronaut.grpc:micronaut-grpc-runtime")
     implementation("io.micronaut.validation:micronaut-validation")
+    implementation("io.grpc:grpc-protobuf:1.84.0")
+    implementation("io.grpc:grpc-stub:1.84.0")
     implementation("io.grpc:grpc-kotlin-stub:1.5.0")
+    implementation("io.grpc:grpc-netty-shaded:1.84.0")
     implementation("io.micronaut.data:micronaut-data-r2dbc")
     implementation("io.micronaut.r2dbc:micronaut-r2dbc-core")
     implementation("io.micronaut.flyway:micronaut-flyway")

gradle.properties

@@ -1,3 +1,4 @@
 micronautVersion=4.10.18
 kotlinVersion=2.4.20
 org.gradle.jvmargs=-Xmx4096M
+ksp.incremental=false

src/main/kotlin/net/trueog/staffauth/configuration/PluginConfiguration.kt

@@ -0,0 +1,18 @@
+package net.trueog.staffauth.configuration
+
+import io.micronaut.context.annotation.ConfigurationProperties
+
+@ConfigurationProperties("plugin")
+data class PluginConfiguration(
+    var host: String,
+    var port: Int,
+    var ssl: SslConfig = SslConfig()
+) {
+    @ConfigurationProperties("ssl")
+    data class SslConfig(
+        var enabled: Boolean = false,
+        var trustCa: String = "",
+        var cert: String = "",
+        var privateKey: String = ""
+    )
+}

src/main/kotlin/net/trueog/staffauth/grpc/GrpcClients.kt

@@ -1,14 +1,35 @@
 package net.trueog.staffauth.grpc
 
 import io.grpc.ManagedChannel
+import io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts
+import io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder
 import io.micronaut.context.annotation.Factory
-import io.micronaut.grpc.annotation.GrpcChannel
+import jakarta.inject.Named
 import jakarta.inject.Singleton
+import net.trueog.staffauth.configuration.PluginConfiguration
 import proto.IpCheckerGrpcKt
+import java.io.File
 
 @Factory
 class GrpcClients {
     @Singleton
-    fun ipCheckStub(@GrpcChannel($$"${plugin.address}") channel: ManagedChannel) =
+    @Named("ipCheckChannel")
+    fun ipCheckChannel(config: PluginConfiguration) : ManagedChannel {
+        val builder = NettyChannelBuilder.forAddress(config.host, config.port)
+        if (config.ssl.enabled) {
+            builder.sslContext(
+                GrpcSslContexts.forClient()
+                    .trustManager(File(config.ssl.trustCa))
+                    .keyManager(File(config.ssl.cert), File(config.ssl.privateKey))
+                    .build()
+            )
+        } else {
+            builder.usePlaintext()
+        }
+        return builder.build()
+    }
+
+    @Singleton
+    fun ipCheckStub(@Named("ipCheckChannel") channel: ManagedChannel) =
         IpCheckerGrpcKt.IpCheckerCoroutineStub(channel)
 }

src/main/resources/application.yml

@@ -31,12 +31,6 @@ micronaut:
       charset: UTF-8
       expire-after-write: 1h
 
-grpc:
-  server:
-    port: 65225
-  client:
-    plaintext: true
-
 datasources:
   default:
     url: jdbc:${db.url}