remove tls cfg (#105)

Author: louisinger

Dockerfile

@@ -35,8 +35,5 @@ WORKDIR /app
 COPY --from=builder /app/bin/* /app/
 
 ENV PATH="/app:${PATH}"
-ENV EMULATOR_DATADIR=/app/data
-
-VOLUME /app/data
 
 ENTRYPOINT [ "emulator" ]

README.md

@@ -183,11 +183,7 @@ The service can be configured using environment variables:
 |----------|-------------|---------|
 | `EMULATOR_SECRET_KEY` | Private key for signing (hex encoded) | Required |
 | `EMULATOR_DEPRECATED_KEYS` | Comma-separated deprecated private keys (hex encoded) still accepted for signing. Empty means none. CSV is strict: leading commas, trailing commas, empty entries, whitespace, duplicates, and the current key are rejected. | Empty |
-| `EMULATOR_DATADIR` | Data directory path | OS-specific app data dir |
 | `EMULATOR_PORT` | Server port (gRPC + HTTP REST gateway) | 7073 |
-| `EMULATOR_NO_TLS` | Disable TLS encryption | false |
-| `EMULATOR_TLS_EXTRA_IPS` | Additional IPs for TLS cert | [] |
-| `EMULATOR_TLS_EXTRA_DOMAINS` | Additional domains for TLS cert | [] |
 | `EMULATOR_LOG_LEVEL` | Log level (0-6) | 4 (Debug) |
 | `EMULATOR_ARKD_URL` | URL of the `arkd` instance used for attempted finalization in [`SubmitTx`](#submittx) | Required |
 | `EMULATOR_COMPUTE_LIMITS` | Comma-separated `OPCODE=limit` overrides for per-input opcode execution caps, for example `OP_ECPAIRING=8,OP_MODEXP=128`. Overrides are applied on top of defaults; use an empty value such as `OP_ECADD=` to remove a default cap. | Default compute limits |

cmd/emulator.go

@@ -21,12 +21,8 @@ func main() {
 	}
 
 	log.WithFields(log.Fields{
-		"version":           Version,
-		"port":              cfg.Port,
-		"no_tls":            cfg.NoTLS,
-		"tls_extra_ips":     cfg.TLSExtraIPs,
-		"tls_extra_domains": cfg.TLSExtraDomains,
-		"datadir":           cfg.Datadir,
+		"version": Version,
+		"port":    cfg.Port,
 	}).Info("config loaded")
 
 	svc, err := grpcservice.NewService(Version, cfg)

docker-compose.regtest.yml

@@ -11,11 +11,7 @@ services:
        # public key has odd y
       - EMULATOR_SECRET_KEY=5646b2e23bbb82491fb4ef262079ff17594d5e873fc6bcea5f1453edbe1029b1
       - EMULATOR_DEPRECATED_KEYS=0202020202020202020202020202020202020202020202020202020202020202,0303030303030303030303030303030303030303030303030303030303030303
-      - EMULATOR_NO_TLS=true
       - EMULATOR_ARKD_URL=arkd:7070
-    volumes:
-      - type: tmpfs
-        target: /app/data
     depends_on:
       - arkd
   pgnbxplorer:

envs/emulator.dev.env

@@ -1,2 +1 @@
-EMULATOR_SECRET_KEY=f40f6e7a5cf262f4093d4605b8f40cbaf9da9e59bf32f24bb27a4ffc74f71eab
-EMULATOR_NO_TLS=true
+EMULATOR_SECRET_KEY=f40f6e7a5cf262f4093d4605b8f40cbaf9da9e59bf32f24bb27a4ffc74f71eab

go.mod

@@ -34,7 +34,6 @@ require (
 	github.com/stretchr/testify v1.11.1
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0
 	go.opentelemetry.io/otel v1.41.0
-	golang.org/x/net v0.55.0
 	google.golang.org/grpc v1.79.3
 )
 
@@ -152,6 +151,7 @@ require (
 	golang.org/x/crypto v0.52.0 // indirect
 	golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 // indirect
 	golang.org/x/mod v0.35.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/term v0.43.0 // indirect

internal/config/config.go

@@ -7,7 +7,6 @@ import (
 	"strconv"
 	"strings"
 
-	arklib "github.com/arkade-os/arkd/pkg/ark-lib"
 	"github.com/arkade-os/emulator/internal/application"
 	"github.com/arkade-os/emulator/pkg/arkade"
 	"github.com/btcsuite/btcd/btcec/v2"
@@ -16,48 +15,32 @@ import (
 )
 
 const (
-	SecretKey       = "SECRET_KEY"
-	DeprecatedKeys  = "DEPRECATED_KEYS"
-	Datadir         = "DATADIR"
-	Port            = "PORT"
-	NoTLS           = "NO_TLS"
-	TLSExtraIPs     = "TLS_EXTRA_IPS"
-	TLSExtraDomains = "TLS_EXTRA_DOMAINS"
-	LogLevel        = "LOG_LEVEL"
-	ArkdURL         = "ARKD_URL"
-	ComputeLimits   = "COMPUTE_LIMITS"
+	SecretKey      = "SECRET_KEY"
+	DeprecatedKeys = "DEPRECATED_KEYS"
+	Port           = "PORT"
+	LogLevel       = "LOG_LEVEL"
+	ArkdURL        = "ARKD_URL"
+	ComputeLimits  = "COMPUTE_LIMITS"
 )
 
 var (
-	defaultDatadir         = arklib.AppDataDir("emulator", false)
-	defaultPort            = uint32(7073)
-	defaultNoTLS           = false
-	defaultTLSExtraIPs     = []string{}
-	defaultTLSExtraDomains = []string{}
-	defaultLogLevel        = log.DebugLevel
+	defaultPort     = uint32(7073)
+	defaultLogLevel = log.DebugLevel
 )
 
 type Config struct {
-	CurrentKey      *btcec.PrivateKey
-	DeprecatedKeys  []*btcec.PrivateKey
-	Datadir         string
-	Port            uint32
-	NoTLS           bool
-	TLSExtraIPs     []string
-	TLSExtraDomains []string
-	ArkdURL         string
-	ComputeLimits   arkade.ComputeLimits
+	CurrentKey     *btcec.PrivateKey
+	DeprecatedKeys []*btcec.PrivateKey
+	Port           uint32
+	ArkdURL        string
+	ComputeLimits  arkade.ComputeLimits
 }
 
 func LoadConfig() (*Config, error) {
 	viper.SetEnvPrefix("EMULATOR")
 	viper.AutomaticEnv()
 
-	viper.SetDefault(Datadir, defaultDatadir)
 	viper.SetDefault(Port, defaultPort)
-	viper.SetDefault(NoTLS, defaultNoTLS)
-	viper.SetDefault(TLSExtraIPs, defaultTLSExtraIPs)
-	viper.SetDefault(TLSExtraDomains, defaultTLSExtraDomains)
 	viper.SetDefault(LogLevel, defaultLogLevel)
 
 	currentKey, err := parsePrivateKey(viper.GetString(SecretKey), "secret key")
@@ -94,15 +77,11 @@ func LoadConfig() (*Config, error) {
 	}
 
 	cfg := &Config{
-		CurrentKey:      currentKey,
-		DeprecatedKeys:  deprecatedKeys,
-		Datadir:         viper.GetString(Datadir),
-		Port:            viper.GetUint32(Port),
-		NoTLS:           viper.GetBool(NoTLS),
-		TLSExtraIPs:     viper.GetStringSlice(TLSExtraIPs),
-		TLSExtraDomains: viper.GetStringSlice(TLSExtraDomains),
-		ArkdURL:         viper.GetString(ArkdURL),
-		ComputeLimits:   computeLimits,
+		CurrentKey:     currentKey,
+		DeprecatedKeys: deprecatedKeys,
+		Port:           viper.GetUint32(Port),
+		ArkdURL:        viper.GetString(ArkdURL),
+		ComputeLimits:  computeLimits,
 	}
 	if cfg.ArkdURL == "" {
 		return nil, fmt.Errorf("missing arkd url")

internal/interface/grpc/config.go

@@ -1,22 +1,12 @@
 package grpcservice
 
 import (
-	"crypto/rand"
-	"crypto/tls"
 	"fmt"
 	"net"
-	"os"
-	"path/filepath"
-
-	"golang.org/x/net/http2"
 )
 
 type Config struct {
-	Datadir         string
-	Port            uint32
-	NoTLS           bool
-	TLSExtraIPs     []string
-	TLSExtraDomains []string
+	Port uint32
 }
 
 func (c Config) Validate() error {
@@ -27,95 +17,13 @@ func (c Config) Validate() error {
 	// nolint:all
 	defer lis.Close()
 
-	if !c.NoTLS {
-		tlsDir := c.tlsDatadir()
-		tlsKeyExists := pathExists(filepath.Join(tlsDir, tlsKeyFile))
-		tlsCertExists := pathExists(filepath.Join(tlsDir, tlsCertFile))
-		if !tlsKeyExists && tlsCertExists {
-			return fmt.Errorf(
-				"found %s file but %s is missing. Please delete %s to make the "+
-					"daemon recreating both files in path %s",
-				tlsCertFile, tlsKeyFile, tlsCertFile, tlsDir,
-			)
-		}
-
-		if len(c.TLSExtraIPs) > 0 {
-			for _, ip := range c.TLSExtraIPs {
-				if net.ParseIP(ip) == nil {
-					return fmt.Errorf("invalid operator extra ip %s", ip)
-				}
-			}
-		}
-	}
-
 	return nil
 }
 
-func (c Config) insecure() bool {
-	return c.NoTLS
-}
-
 func (c Config) address() string {
 	return fmt.Sprintf(":%d", c.Port)
 }
 
 func (c Config) gatewayAddress() string {
 	return fmt.Sprintf("127.0.0.1:%d", c.Port)
 }
-
-func (c Config) tlsDatadir() string {
-	return filepath.Join(c.Datadir, tlsFolder)
-}
-
-func (c Config) tlsKey() string {
-	if c.NoTLS {
-		return ""
-	}
-	return filepath.Join(c.tlsDatadir(), tlsKeyFile)
-}
-
-func (c Config) tlsCert() string {
-	if c.NoTLS {
-		return ""
-	}
-	return filepath.Join(c.tlsDatadir(), tlsCertFile)
-}
-
-func (c Config) tlsConfig() (*tls.Config, error) {
-	if c.NoTLS {
-		return nil, nil
-	}
-
-	if c.tlsKey() == "" || c.tlsCert() == "" {
-		return nil, fmt.Errorf("tls_key and tls_cert both needs to be provided")
-	}
-
-	certificate, err := tls.LoadX509KeyPair(c.tlsCert(), c.tlsKey())
-	if err != nil {
-		return nil, err
-	}
-
-	config := &tls.Config{
-		MinVersion: tls.VersionTLS12,
-		NextProtos: []string{
-			"http/1.1", http2.NextProtoTLS, "h2-14",
-		}, // h2-14 is just for compatibility. will be eventually removed.
-		Certificates: []tls.Certificate{certificate},
-		CipherSuites: []uint16{
-			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-		},
-	}
-	config.Rand = rand.Reader
-
-	return config, nil
-}
-
-func pathExists(path string) bool {
-	if _, err := os.Stat(path); err != nil {
-		if os.IsNotExist(err) {
-			return false
-		}
-	}
-	return true
-}