From a3797bbe0803dd47579a215fedf38f707c4680c9 Mon Sep 17 00:00:00 2001 From: Ben Yanke Date: Fri, 11 May 2018 12:35:39 -0500 Subject: [PATCH] Merging in minor fixes for v1.0.1 (#29) Merging in: * fixes to amazon s3 packages * dockerfiles (build was previously not yet working) * adding version number to bin so `glauth --version` reports correctly * Some Travis CI tweaks --- .travis.yml | 49 +++++++++++++++++ Dockerfile | 52 ++++++++++++++++++ ansible/glauth.yml | 5 -- ansible/hosts | 2 - ansible/roles/glauth/files/mkhomedir | 6 -- ansible/roles/glauth/handlers/main.yml | 7 --- ansible/roles/glauth/tasks/main.yml | 56 ------------------- ansible/roles/glauth/templates/goklp.ini | 5 -- ansible/roles/glauth/templates/ldap.conf | 7 --- ansible/roles/glauth/vars/main.yml | 6 -- bindata.go | 20 +++---- configbackend.go | 3 +- glauth.go | 6 +- sample-simple.cfg | 18 +++++- scripts/docker/default-config.cfg | 70 ++++++++++++++++++++++++ scripts/docker/start.sh | 9 +++ scripts/test-build.sh | 9 +++ scripts/travis/integration-test.sh | 11 ++++ scripts/travis/test-config.cfg | 70 ++++++++++++++++++++++++ 19 files changed, 299 insertions(+), 112 deletions(-) create mode 100644 .travis.yml create mode 100644 Dockerfile delete mode 100644 ansible/glauth.yml delete mode 100644 ansible/hosts delete mode 100644 ansible/roles/glauth/files/mkhomedir delete mode 100644 ansible/roles/glauth/handlers/main.yml delete mode 100644 ansible/roles/glauth/tasks/main.yml delete mode 100644 ansible/roles/glauth/templates/goklp.ini delete mode 100644 ansible/roles/glauth/templates/ldap.conf delete mode 100644 ansible/roles/glauth/vars/main.yml create mode 100644 scripts/docker/default-config.cfg create mode 100755 scripts/docker/start.sh create mode 100755 scripts/test-build.sh create mode 100755 scripts/travis/integration-test.sh create mode 100644 scripts/travis/test-config.cfg diff --git a/.travis.yml b/.travis.yml new file mode 100644 index 0000000..94f61e7 --- /dev/null +++ b/.travis.yml @@ -0,0 +1,49 @@ +language: go + +go: + - 1.3.x # Test an old version, to be sure it works + - 1.9.x # last version + - 1.10.x # current version + +# Speed up git clones +git: + depth: 1 + + +# Anything in before_script that returns a nonzero exit code will +# flunk the build and immediately stop. It's sorta like having +# set -e enabled in bash. +before_script: + - GO_FILES=$(find . -iname '*.go' -type f | grep -v /vendor/) # All the .go files, excluding vendor/ + #- go get github.com/golang/lint/golint # Linter + #- go get honnef.co/go/tools/cmd/megacheck # Badass static analyzer/linter + # - go get github.com/fzipp/gocyclo + + +# Fetch dependencies + - go get -t -v ./... + + +script: + - diff -u <(echo -n) <(gofmt -d ./) # Fail if a .go file hasn't been formatted with 'go fmt' + # - go test -v -race ./... # Run all the tests with the race detector enabled + # - go vet ./... # go vet is the official Go static analyzer + # - megacheck ./... # "go vet on steroids" + linter + # - gocyclo -over 19 $GO_FILES # forbid code with huge functions + # - golint -set_exit_status $(go list ./...) # one last linter + + + + # Unit tests + # - tbd - use 'go test' here when we have unit tests written. example command below. This will generate output for codecov + # - go test -race -coverprofile=coverage.txt -covermode=atomic + + # Full compile test + - go build -o ./glauth glauth.go bindata.go ldapbackend.go webapi.go configbackend.go + + # Integration test with compiled binary + - scripts/travis/integration-test.sh "scripts/travis/test-config.cfg" + + +# after_success: +# - bash <(curl -s https://codecov.io/bash) diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..516dabf --- /dev/null +++ b/Dockerfile @@ -0,0 +1,52 @@ +################# +# Build Step +################# + +FROM golang:alpine as build +MAINTAINER Ben Yanke + +# Setup work env +RUN mkdir /app /tmp/gocode +ADD . /app/ +WORKDIR /app + + +# Required envs for GO +ENV GOPATH=/tmp/gocode +ENV GOOS=linux +ENV GOARCH=amd64 + +# Only needed for alpine builds +RUN apk add --no-cache git bzr + +# Install deps +RUN go get -d -v ./... + +# Build +RUN go build -o /app/glauth glauth.go bindata.go ldapbackend.go webapi.go configbackend.go + +################# +# Run Step +################# + +FROM golang:alpine as run +MAINTAINER Ben Yanke + +# Copies a sample config to be used if a volume isn't mounted with user's config +ADD sample-simple.cfg /app/config/config.cfg + +# Copy binary from build container +COPY --from=build /app/glauth /app/glauth + +# Copy docker specific scripts from build container +COPY --from=build /app/scripts/docker/start.sh /app/docker/ +COPY --from=build /app/scripts/docker/default-config.cfg /app/docker/ + +# Install init +RUN wget -O /usr/local/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v1.2.1/dumb-init_1.2.1_amd64 && chmod +x /usr/local/bin/dumb-init + +# Expose web and LDAP ports +EXPOSE 389 5555 + +ENTRYPOINT ["/usr/local/bin/dumb-init", "--"] +CMD ["/bin/sh", "/app/docker/start.sh"] diff --git a/ansible/glauth.yml b/ansible/glauth.yml deleted file mode 100644 index 03d1993..0000000 --- a/ansible/glauth.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- name: deploy glauth.yml - hosts: localhost - roles: - - glauth diff --git a/ansible/hosts b/ansible/hosts deleted file mode 100644 index ce1ae41..0000000 --- a/ansible/hosts +++ /dev/null @@ -1,2 +0,0 @@ -localhost ansible_connection=local - diff --git a/ansible/roles/glauth/files/mkhomedir b/ansible/roles/glauth/files/mkhomedir deleted file mode 100644 index 1083a0a..0000000 --- a/ansible/roles/glauth/files/mkhomedir +++ /dev/null @@ -1,6 +0,0 @@ -Name: activate mkhomedir -Default: yes -Priority: 900 -Session-Type: Additional -Session: required pam_mkhomedir.so - diff --git a/ansible/roles/glauth/handlers/main.yml b/ansible/roles/glauth/handlers/main.yml deleted file mode 100644 index 6d8b92c..0000000 --- a/ansible/roles/glauth/handlers/main.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: restart nscd - sudo: true - service: name=nscd state=restarted -- name: restart sshd - sudo: true - service: name=ssh state=restarted diff --git a/ansible/roles/glauth/tasks/main.yml b/ansible/roles/glauth/tasks/main.yml deleted file mode 100644 index 4452d3e..0000000 --- a/ansible/roles/glauth/tasks/main.yml +++ /dev/null @@ -1,56 +0,0 @@ ---- -- name: install packages needed for glauth - sudo: true - apt: pkg={{item}} state=installed - with_items: - - ldap-auth-client - - nscd -# - ldap-utils -# - netcat - -- name: configure nsswitch passwd - sudo: true - lineinfile: 'dest=/etc/nsswitch.conf state=present backrefs=yes regexp="^passwd:\s+compat" line="passwd: files ldap"' - notify: restart nscd -- name: configure nsswitch group - sudo: true - lineinfile: 'dest=/etc/nsswitch.conf state=present backrefs=yes regexp="^group:\s+compat" line="group: files ldap"' - notify: restart nscd -- name: configure nsswitch shadow - sudo: true - lineinfile: 'dest=/etc/nsswitch.conf state=present backrefs=yes regexp="^shadow:\s+compat" line="shadow: files ldap"' - notify: restart nscd -- name: configure pam common-session - sudo: true - lineinfile: 'dest=/etc/pam.d/common-session state=present regexp="^session\s+required\s+pam_mkhomedir.so" line="session required pam_mkhomedir.so"' - notify: restart nscd -- name: configure pam common-session-noninteractive - sudo: true - lineinfile: 'dest=/etc/pam.d/common-session-noninteractive state=present regexp="^session\s+required\s+pam_mkhomedir.so" line="session required pam_mkhomedir.so"' - notify: restart nscd -- name: copy over ldap.conf file - sudo: true - template: src=ldap.conf dest=/etc/ldap.conf mode=0600 - notify: restart nscd -- name: copy over mkdhomedir pam config file - sudo: true - copy: src=mkhomedir dest=/usr/share/pam-configs/my_mkhomedir mode=0600 -- name: download goklp command - sudo: true - get_url: url=https://github.com/AppliedTrust/goklp/releases/download/1.4/goklp dest=/usr/local/sbin/goklp mode=0755 owner=root -- name: copy over goklp config - sudo: true - template: src=goklp.ini dest=/usr/local/sbin/goklp.ini mode=0600 owner=root -#- name: disable ssh password auth -# sudo: true -# lineinfile: dest=/etc/ssh/sshd_config state=present regexp="^PasswordAuthentication" line="PasswordAuthentication no" -# notify: restart sshd -- name: configure ssh AuthorizedKeysCommand for glauth - sudo: true - lineinfile: dest=/etc/ssh/sshd_config state=present regexp="^AuthorizedKeysCommand\s+" line="AuthorizedKeysCommand /usr/local/sbin/goklp" - notify: restart sshd -- name: configure ssh AuthorizedKeysCommandUser for glauth - sudo: true - lineinfile: dest=/etc/ssh/sshd_config state=present regexp="^AuthorizedKeysCommandUser\s+" line="AuthorizedKeysCommandUser root" - notify: restart sshd - diff --git a/ansible/roles/glauth/templates/goklp.ini b/ansible/roles/glauth/templates/goklp.ini deleted file mode 100644 index 38308a2..0000000 --- a/ansible/roles/glauth/templates/goklp.ini +++ /dev/null @@ -1,5 +0,0 @@ -goklp_ldap_uri = {{ glauth_ldap_uri }} -goklp_ldap_bind_dn = {{ glauth_bind_dn }} -goklp_ldap_base_dn = {{ glauth_base_dn }} -goklp_ldap_bind_pw = {{ glauth_bind_pw }} -goklp_ldap_timeout_secs = 3 diff --git a/ansible/roles/glauth/templates/ldap.conf b/ansible/roles/glauth/templates/ldap.conf deleted file mode 100644 index 95ee624..0000000 --- a/ansible/roles/glauth/templates/ldap.conf +++ /dev/null @@ -1,7 +0,0 @@ -ldap_version 3 -uri {{ glauth_ldap_uri }} -base {{ glauth_base_dn }} -binddn {{ glauth_bind_dn }} -bindpw {{ glauth_bind_pw }} -pam_password_prohibit_message Please change your password in the central system. -nss_initgroups_ignoreusers root,daemon,bin,sys,sync,games,man,lp,mail,news,uucp,proxy,www-data,backup,list,irc,gnats,nobody,libuuid,syslog,messagebus,landscape,sshd,pollinate,ubuntu diff --git a/ansible/roles/glauth/vars/main.yml b/ansible/roles/glauth/vars/main.yml deleted file mode 100644 index 0ce117a..0000000 --- a/ansible/roles/glauth/vars/main.yml +++ /dev/null @@ -1,6 +0,0 @@ ---- -glauth_ldap_uri: ldap://localhost:389 -glauth_bind_dn: cn=serviceuser,ou=svcaccts,dc=glauth,dc=com -glauth_base_dn: dc=glauth,dc=com -glauth_bind_pw: mysecret -glauth_timeout_secs: 5 diff --git a/bindata.go b/bindata.go index 9912cc2..1ec8585 100644 --- a/bindata.go +++ b/bindata.go @@ -1,10 +1,10 @@ package main import ( - "bytes" - "compress/gzip" - "fmt" - "io" + "bytes" + "compress/gzip" + "fmt" + "io" ) func bindata_read(data []byte, name string) ([]byte, error) { @@ -47,7 +47,7 @@ func assets_glauth_css() ([]byte, error) { 0x33, 0x16, 0x49, 0x05, 0x9d, 0x5f, 0x52, 0x2b, 0xd4, 0x52, 0xaf, 0xff, 0xf8, 0x0d, 0x00, 0x00, 0xff, 0xff, 0x91, 0x33, 0xcc, 0x6e, 0xee, 0x01, 0x00, 0x00, - }, + }, "assets/glauth.css", ) } @@ -94,7 +94,7 @@ func assets_glauth_js() ([]byte, error) { 0x43, 0xdd, 0xe0, 0xd3, 0x14, 0x3d, 0xc0, 0xfa, 0xc3, 0xe1, 0xd5, 0xf8, 0x2f, 0x00, 0x00, 0xff, 0xff, 0x1d, 0x12, 0x43, 0xad, 0x6a, 0x05, 0x00, 0x00, - }, + }, "assets/glauth.js", ) } @@ -198,12 +198,11 @@ func assets_index_html() ([]byte, error) { 0x90, 0xb4, 0xee, 0x77, 0xcb, 0x26, 0x38, 0x89, 0x7d, 0x68, 0x93, 0xd8, 0x7f, 0x06, 0xff, 0x1b, 0x00, 0x00, 0xff, 0xff, 0x08, 0x9c, 0x44, 0x70, 0x17, 0x0f, 0x00, 0x00, - }, + }, "assets/index.html", ) } - // Asset loads and returns the asset for the given name. // It returns an error if the asset could not be found or // could not be loaded. @@ -215,9 +214,8 @@ func Asset(name string) ([]byte, error) { } // _bindata is a table, holding each asset generator, mapped to its name. -var _bindata = map[string] func() ([]byte, error) { +var _bindata = map[string]func() ([]byte, error){ "assets/glauth.css": assets_glauth_css, - "assets/glauth.js": assets_glauth_js, + "assets/glauth.js": assets_glauth_js, "assets/index.html": assets_index_html, - } diff --git a/configbackend.go b/configbackend.go index 6f90c87..e7722d3 100644 --- a/configbackend.go +++ b/configbackend.go @@ -141,11 +141,10 @@ func (h configHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn attrs = append(attrs, &ldap.EntryAttribute{"sn", []string{u.SN}}) } - attrs = append(attrs, &ldap.EntryAttribute{"ou", []string{h.getGroupName(u.PrimaryGroup)}}) attrs = append(attrs, &ldap.EntryAttribute{"uidNumber", []string{fmt.Sprintf("%d", u.UnixID)}}) - if (u.Disabled) { + if u.Disabled { attrs = append(attrs, &ldap.EntryAttribute{"accountStatus", []string{"inactive"}}) } else { attrs = append(attrs, &ldap.EntryAttribute{"accountStatus", []string{"active"}}) diff --git a/glauth.go b/glauth.go index d95ab22..af33184 100644 --- a/glauth.go +++ b/glauth.go @@ -7,13 +7,13 @@ import ( "github.com/docopt/docopt-go" "github.com/nmcclain/ldap" "github.com/op/go-logging" - "launchpad.net/goamz/aws" - "launchpad.net/goamz/s3" + "gopkg.in/amz.v1/aws" + "gopkg.in/amz.v1/s3" "os" "strings" ) -var version = "0.1" +var version = "1.0.1" const programName = "glauth" diff --git a/sample-simple.cfg b/sample-simple.cfg index 74cc3b5..a97572a 100644 --- a/sample-simple.cfg +++ b/sample-simple.cfg @@ -10,7 +10,7 @@ debug = true # The frontend section controls how clients connect to the proxy. [frontend] tls = false # enable TLS for production!! - listen = "localhost:389" + listen = "localhost:3893" cert = "cert.pem" key = "key.pem" @@ -29,9 +29,23 @@ debug = true primarygroup = 5501 passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood +# This user record shows all of the possible fields available +[[users]] + name = "johndoe" + givenname="John" + sn="Doe" + mail = "jdoe@example.com" + unixid = 5002 + primarygroup = 5501 + loginShell = "/bin/sh" + homeDir = "/root" + passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood + sshkeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA3UKCEllO2IZXgqNygiVb+dDLJJwVw3AJwV34t2jzR+/tUNVeJ9XddKpYQektNHsFmY93lJw5QDSbeH/mAC4KPoUM47EriINKEelRbyG4hC/ko/e2JWqEclPS9LP7GtqGmscXXo4JFkqnKw4TIRD52XI9n1syYM9Y8rJ88fjC/Lpn+01AB0paLVIfppJU35t0Ho9doHAEfEvcQA6tcm7FLJUvklAxc8WUbdziczbRV40KzDroIkXAZRjX7vXXhh/p7XBYnA0GO8oTa2VY4dTQSeDAUJSUxbzevbL0ll9Gi1uYaTDQyE5gbn2NfJSqq0OYA+3eyGtIVjFYZgi+txSuhw== rsa-key-20160209"] + + [[users]] name = "serviceuser" - unixid = 5002 + unixid = 5003 primarygroup = 5502 passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret diff --git a/scripts/docker/default-config.cfg b/scripts/docker/default-config.cfg new file mode 100644 index 0000000..a97572a --- /dev/null +++ b/scripts/docker/default-config.cfg @@ -0,0 +1,70 @@ +################# +# glauth.conf + +################# +# General configuration. +debug = true +#syslog = true + +################# +# The frontend section controls how clients connect to the proxy. +[frontend] + tls = false # enable TLS for production!! + listen = "localhost:3893" + cert = "cert.pem" + key = "key.pem" + +################# +# The backend section controls the data store. +[backend] + datastore = "config" + baseDN = "dc=glauth,dc=com" + +################# +# The users section contains a hardcoded list of valid users. +# to create a passSHA256: echo -n "mysecret" | openssl dgst -sha256 +[[users]] + name = "hackers" + unixid = 5001 + primarygroup = 5501 + passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood + +# This user record shows all of the possible fields available +[[users]] + name = "johndoe" + givenname="John" + sn="Doe" + mail = "jdoe@example.com" + unixid = 5002 + primarygroup = 5501 + loginShell = "/bin/sh" + homeDir = "/root" + passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood + sshkeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA3UKCEllO2IZXgqNygiVb+dDLJJwVw3AJwV34t2jzR+/tUNVeJ9XddKpYQektNHsFmY93lJw5QDSbeH/mAC4KPoUM47EriINKEelRbyG4hC/ko/e2JWqEclPS9LP7GtqGmscXXo4JFkqnKw4TIRD52XI9n1syYM9Y8rJ88fjC/Lpn+01AB0paLVIfppJU35t0Ho9doHAEfEvcQA6tcm7FLJUvklAxc8WUbdziczbRV40KzDroIkXAZRjX7vXXhh/p7XBYnA0GO8oTa2VY4dTQSeDAUJSUxbzevbL0ll9Gi1uYaTDQyE5gbn2NfJSqq0OYA+3eyGtIVjFYZgi+txSuhw== rsa-key-20160209"] + + +[[users]] + name = "serviceuser" + unixid = 5003 + primarygroup = 5502 + passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret + +################# +# The groups section contains a hardcoded list of valid users. +[[groups]] + name = "superheros" + unixid = 5501 + +[[groups]] + name = "svcaccts" + unixid = 5502 + +################# +# Enable and configure the optional REST API here. +[api] + enabled = true + tls = false # enable TLS for production!! + listen = "localhost:5555" + cert = "cert.pem" + key = "key.pem" + diff --git a/scripts/docker/start.sh b/scripts/docker/start.sh new file mode 100755 index 0000000..5611681 --- /dev/null +++ b/scripts/docker/start.sh @@ -0,0 +1,9 @@ +#!/bin/sh + +# Copy config file if it doesn't exist so that the app can start +if [ ! -f /app/config/config.cfg ] ; then + cp /app/docker/default-config.cfg /app/config/config.cfg; + fi + +# Run app +/app/glauth -c /app/config/config.cfg diff --git a/scripts/test-build.sh b/scripts/test-build.sh new file mode 100755 index 0000000..95f15b9 --- /dev/null +++ b/scripts/test-build.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +img="localhost/glauth-dev" + +sudo docker rmi -f "$img" + +sudo docker build -f Dockerfile -t "$img" . + +sudo docker run -P "$img" diff --git a/scripts/travis/integration-test.sh b/scripts/travis/integration-test.sh new file mode 100755 index 0000000..b8a20bc --- /dev/null +++ b/scripts/travis/integration-test.sh @@ -0,0 +1,11 @@ +#!/bin/bash + +sudo apt-get -qq update && sudo apt-get -qq install -y ldap-utils && + +$TRAVIS_BUILD_DIR/glauth -c "$TRAVIS_BUILD_DIR/$1" & +glauthPid="$!" + +echo "Running at $glauthPid" +sleep 2; +kill $glauthPid; +echo "done." diff --git a/scripts/travis/test-config.cfg b/scripts/travis/test-config.cfg new file mode 100644 index 0000000..a97572a --- /dev/null +++ b/scripts/travis/test-config.cfg @@ -0,0 +1,70 @@ +################# +# glauth.conf + +################# +# General configuration. +debug = true +#syslog = true + +################# +# The frontend section controls how clients connect to the proxy. +[frontend] + tls = false # enable TLS for production!! + listen = "localhost:3893" + cert = "cert.pem" + key = "key.pem" + +################# +# The backend section controls the data store. +[backend] + datastore = "config" + baseDN = "dc=glauth,dc=com" + +################# +# The users section contains a hardcoded list of valid users. +# to create a passSHA256: echo -n "mysecret" | openssl dgst -sha256 +[[users]] + name = "hackers" + unixid = 5001 + primarygroup = 5501 + passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood + +# This user record shows all of the possible fields available +[[users]] + name = "johndoe" + givenname="John" + sn="Doe" + mail = "jdoe@example.com" + unixid = 5002 + primarygroup = 5501 + loginShell = "/bin/sh" + homeDir = "/root" + passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood + sshkeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA3UKCEllO2IZXgqNygiVb+dDLJJwVw3AJwV34t2jzR+/tUNVeJ9XddKpYQektNHsFmY93lJw5QDSbeH/mAC4KPoUM47EriINKEelRbyG4hC/ko/e2JWqEclPS9LP7GtqGmscXXo4JFkqnKw4TIRD52XI9n1syYM9Y8rJ88fjC/Lpn+01AB0paLVIfppJU35t0Ho9doHAEfEvcQA6tcm7FLJUvklAxc8WUbdziczbRV40KzDroIkXAZRjX7vXXhh/p7XBYnA0GO8oTa2VY4dTQSeDAUJSUxbzevbL0ll9Gi1uYaTDQyE5gbn2NfJSqq0OYA+3eyGtIVjFYZgi+txSuhw== rsa-key-20160209"] + + +[[users]] + name = "serviceuser" + unixid = 5003 + primarygroup = 5502 + passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret + +################# +# The groups section contains a hardcoded list of valid users. +[[groups]] + name = "superheros" + unixid = 5501 + +[[groups]] + name = "svcaccts" + unixid = 5502 + +################# +# Enable and configure the optional REST API here. +[api] + enabled = true + tls = false # enable TLS for production!! + listen = "localhost:5555" + cert = "cert.pem" + key = "key.pem" +