Merge pull request #24 from SgtCoDFish/guestbookoutput

Censor emails and remove autocert

guestbook/go.mod

@@ -2,10 +2,7 @@ module github.com/cert-manager/print-your-cert/guestbook
 
 go 1.22
 
-require (
-	golang.org/x/crypto v0.21.0
-	modernc.org/sqlite v1.29.1
-)
+require modernc.org/sqlite v1.29.1
 
 require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
@@ -15,9 +12,7 @@ require (
 	github.com/mattn/go-isatty v0.0.16 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	golang.org/x/net v0.21.0 // indirect
 	golang.org/x/sys v0.18.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
 	modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6 // indirect
 	modernc.org/libc v1.41.0 // indirect
 	modernc.org/mathutil v1.6.0 // indirect

guestbook/go.sum

@@ -18,17 +18,11 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
-golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
 golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
 golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
 golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
 modernc.org/gc/v3 v3.0.0-20240107210532-573471604cb6 h1:5D53IMaUuA5InSeMu9eJtlQXS2NxAhyWQvkKEgXZhHI=

guestbook/index.sh

@@ -2,4 +2,4 @@
 
 set -eu -o pipefail
 
-curl --cacert root-ca.pem --cert /tmp/chain.pem --key /tmp/pkey.pem https://guestbook.print-your-cert.cert-manager.io/
+curl --cert /tmp/chain.pem --key /tmp/pkey.pem https://guestbook.print-your-cert.cert-manager.io/

guestbook/main.go

@@ -20,21 +20,19 @@ import (
 	"time"
 
 	"github.com/inconshreveable/go-vhost"
-	"golang.org/x/crypto/acme/autocert"
 	_ "modernc.org/sqlite"
 )
 
 var (
-	listen         = flag.String("listen", "127.0.0.1:9090", "Address and port to listen on")
-	caCertPath     = flag.String("ca-cert", "", "Path to CA certs to trust for client certs")
+	listen = flag.String("listen", "127.0.0.1:9090", "Address and port to listen on")
+
+	caCertPath = flag.String("ca-cert", "", "Path to CA certs to trust for client certs")
+
 	chainPath      = flag.String("tls-chain", "", "Path to TLS cert chain")
 	privateKeyPath = flag.String("tls-key", "", "Path to TLS private key")
-	mainDomain     = flag.String("domain", "guestbook.print-your-cert.cert-manager.io", "Domain used to access the guestbook. Used for SNI routing.")
 
-	readOnlyDomain         = flag.String("readonly-domain", "readonly-guestbook.print-your-cert.cert-manager.io", "Domain used to access the guestbook in read-only mode")
-	readOnlyListenInsecure = flag.String("readonly-listen-insecure", "0.0.0.0:8080", "Address and port to listen on. Must be 80 if -prod is set.")
-	readOnlyProd           = flag.Bool("prod", false, "If true, enables HTTPS for the readonly domain using Let's Encrypt.")
-	readOnlyAutocertDir    = flag.String("autocert-dir", ".", "The directory used to cache the certificate and temporary files to work with Let's Encrypt.")
+	mainDomain     = flag.String("domain", "guestbook.print-your-cert.cert-manager.io", "Domain used to access the guestbook. Used for SNI routing.")
+	readOnlyDomain = flag.String("readonly-domain", "readonly-guestbook.print-your-cert.cert-manager.io", "Domain used to access the guestbook in read-only mode")
 
 	dbPath = flag.String("db-path", "guestbook.sqlite", "Path to sqlite database")
 	initDB = flag.Bool("init-db", false, "If set, initialise a fresh database at db-path")
@@ -65,6 +63,14 @@ func indexPage(db *sql.DB) http.Handler {
 	})
 }
 
+func censorEmail(s string) string {
+	if len(s) <= 1 {
+		return "*"
+	}
+
+	return s[0:1] + strings.Repeat("*", len(s)-1)
+}
+
 func allMessages(ctx context.Context, db *sql.DB, w io.Writer) ([]byte, error) {
 	rows, err := db.QueryContext(ctx, `SELECT email, user_agent, date, message from entries;`)
 	if err != nil {
@@ -82,6 +88,8 @@ func allMessages(ctx context.Context, db *sql.DB, w io.Writer) ([]byte, error) {
 			return nil, err
 		}
 
+		email = censorEmail(email)
+
 		star := "⭐"
 		if strings.ToLower(userAgent) == "kiosk" {
 			star = "❌"
@@ -232,10 +240,6 @@ func run(ctx context.Context) error {
 		return fmt.Errorf("missing required path to CA cert")
 	}
 
-	if *readOnlyProd && !strings.HasSuffix(*readOnlyListenInsecure, ":80") {
-		return fmt.Errorf("with -prod, use -readonly-listen-insecure=:80 so that Let's Encrypt can verify the domain")
-	}
-
 	logger := LoggerFromContext(ctx)
 
 	sigs := make(chan os.Signal, 1)
@@ -296,54 +300,22 @@ func run(ctx context.Context) error {
 		BaseContext: func(_ net.Listener) context.Context { return ctx },
 		ErrorLog:    slog.NewLogLogger(logger.With("handler", "http.Server", "server", "readonly-server-https").Handler(), slog.LevelError),
 	}
-	mgr := &autocert.Manager{
-		Prompt: autocert.AcceptTOS,
-		HostPolicy: func(ctx context.Context, host string) error {
-			allowedHost := *readOnlyDomain
-			if host == allowedHost {
-				return nil
-			}
-			return fmt.Errorf("acme/autocert: only %s host is allowed", allowedHost)
-		},
-		Cache: autocert.DirCache(*readOnlyAutocertDir),
-	}
+
 	readOnlyListener, err := tlsMux.Listen(*readOnlyDomain)
 	if err != nil {
 		return fmt.Errorf("failed to create vhost listener: %s", err)
 	}
 
 	go func() {
-		if !*readOnlyProd {
-			logger.Info("readonly-server not enabled, use -prod to turn it on")
-			return
-		}
 		logger.Info("readonly-server-https listening", "address", *listen, "sni", *readOnlyDomain)
 		err := readOnlySrv.Serve(tls.NewListener(readOnlyListener, &tls.Config{
-			GetCertificate: mgr.GetCertificate,
+			Certificates: []tls.Certificate{cert},
 		}))
 		if err != nil && err != http.ErrServerClosed {
 			logger.Info("failed to listen", "error", err)
 		}
 	}()
 
-	readOnlySrvHTTP := &http.Server{
-		Handler:     readOnlyMux,
-		BaseContext: func(_ net.Listener) context.Context { return ctx },
-		ErrorLog:    slog.NewLogLogger(logger.With("handler", "http.Server", "server", "readonly-server-http").Handler(), slog.LevelError),
-		Addr:        *readOnlyListenInsecure,
-	}
-	if mgr != nil {
-		// Allows autocert handle Let's Encrypt HTTP-01 callbacks.
-		readOnlySrv.Handler = mgr.HTTPHandler(readOnlySrvHTTP.Handler)
-	}
-	go func() {
-		logger.Info("readonly-server-http listening", "address", *readOnlyListenInsecure)
-		err := readOnlySrv.ListenAndServe()
-		if err != nil && err != http.ErrServerClosed {
-			logger.Info("failed to listen", "error", err)
-		}
-	}()
-
 	go tlsMux.HandleErrors()
 
 	<-sigs
@@ -357,12 +329,6 @@ func run(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
-	if readOnlySrvHTTP != nil {
-		err = readOnlySrvHTTP.Shutdown(context.Background())
-		if err != nil {
-			return err
-		}
-	}
 
 	return nil
 }