feat: run official executor behind SPIFFE mTLS

internal/runnerfacade/server.go

@@ -0,0 +1,84 @@
+package runnerfacade
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"time"
+
+	"github.com/spiffe/go-spiffe/v2/spiffeid"
+	"github.com/spiffe/go-spiffe/v2/spiffetls/tlsconfig"
+	"github.com/spiffe/go-spiffe/v2/workloadapi"
+)
+
+const APIBasePath = "/api/actions"
+
+// APIHandler exposes the facade at the base path used by the official Runner.
+// SPIFFE middleware runs after the TLS listener has authenticated the peer.
+func APIHandler(facade *Facade) http.Handler {
+	path, handler := facade.Handler()
+	mux := http.NewServeMux()
+	mux.Handle(APIBasePath+path, http.StripPrefix(APIBasePath, SPIFFEMiddleware(handler)))
+	return mux
+}
+
+type Server struct {
+	Facade          *Facade
+	ListenAddress   string
+	TrustDomain     string
+	WorkloadAPIAddr string
+}
+
+// Run serves the RunnerService facade with workload-to-workload mTLS. Any
+// identity in the local trust domain may complete TLS; the facade then requires
+// the exact logical task identity stored in its assignment registry.
+func (s Server) Run(ctx context.Context) error {
+	if s.Facade == nil || s.ListenAddress == "" || s.TrustDomain == "" {
+		return errors.New("runner facade, listen address, and trust domain are required")
+	}
+	trustDomain, err := spiffeid.TrustDomainFromString(s.TrustDomain)
+	if err != nil {
+		return fmt.Errorf("parse facade trust domain: %w", err)
+	}
+	options := []workloadapi.X509SourceOption{}
+	if s.WorkloadAPIAddr != "" {
+		options = append(options, workloadapi.WithClientOptions(workloadapi.WithAddr(s.WorkloadAPIAddr)))
+	}
+	source, err := workloadapi.NewX509Source(ctx, options...)
+	if err != nil {
+		return fmt.Errorf("open facade SPIFFE Workload API X509 source: %w", err)
+	}
+	defer source.Close()
+
+	listener, err := net.Listen("tcp", s.ListenAddress)
+	if err != nil {
+		return fmt.Errorf("listen for runner facade: %w", err)
+	}
+	defer listener.Close()
+	tlsListener := tls.NewListener(listener, tlsconfig.MTLSServerConfig(
+		source, source, tlsconfig.AuthorizeMemberOf(trustDomain),
+	))
+	httpServer := &http.Server{Handler: APIHandler(s.Facade), ReadHeaderTimeout: 10 * time.Second}
+	serverErrors := make(chan error, 1)
+	go func() { serverErrors <- httpServer.Serve(tlsListener) }()
+
+	select {
+	case <-ctx.Done():
+		shutdownContext, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		shutdownErr := httpServer.Shutdown(shutdownContext)
+		cancel()
+		serverErr := <-serverErrors
+		if errors.Is(serverErr, http.ErrServerClosed) {
+			serverErr = nil
+		}
+		return errors.Join(shutdownErr, serverErr)
+	case err := <-serverErrors:
+		if errors.Is(err, http.ErrServerClosed) {
+			return nil
+		}
+		return fmt.Errorf("serve runner facade: %w", err)
+	}
+}