func ClairServiceInit() error {
// Load database setting
if setting.ClairDBPath != "" {
clairConf.DBPath = setting.ClairDBPath
} else {
clairConf.DBPath = DefaultClairDBPath
}
clairConf.KeepDB = setting.ClairKeepDB
clairConf.LogLevel = setting.ClairLogLevel
clairConf.Duration = setting.ClairUpdateDuration
clairConf.VulnPriority = setting.ClairVulnPriority
// Set database
if err := database.Open("bolt", clairConf.DBPath); err != nil {
logrus.Debug(err)
return err
}
// Set logLevel of clair lib
logLevel, err := capnslog.ParseLevel(strings.ToUpper(clairConf.LogLevel))
if err != nil {
logLevel, _ = capnslog.ParseLevel(strings.ToUpper(DefaultClairLogLevel))
}
capnslog.SetGlobalLogLevel(logLevel)
capnslog.SetFormatter(capnslog.NewPrettyFormatter(os.Stdout, false))
// Set minumum priority parameter.
if types.Priority(clairConf.VulnPriority).IsValid() {
logrus.Debugf("Vuln priority is invalid :%v.", clairConf.VulnPriority)
clairConf.VulnPriority = DefaultClairVulnPriority
}
// Set 'duration' and Update the CVE database
if clairConf.Duration == "" {
logrus.Debugf("No duration set, so only update at the beginning.")
go updater.Update()
clairStopper = nil
} else {
st := utils.NewStopper()
st.Begin()
d, err := time.ParseDuration(clairConf.Duration)
if err != nil {
logrus.Warnf("Wrong duration format, use the default duration: %v.", DefaultClairUpdateDuration)
clairConf.Duration = DefaultClairUpdateDuration
d, err = time.ParseDuration(clairConf.Duration)
if err != nil {
logrus.Debugf("Cannot pare du %v", err)
}
}
go updater.Run(d, st)
clairStopper = st
st.Begin()
}
return nil
}
func main() {
// Parse command-line arguments
flag.CommandLine = flag.NewFlagSet(os.Args[0], flag.ExitOnError)
flagConfigPath := flag.String("config", "/etc/clair/config.yaml", "Load configuration from the specified file.")
flagCPUProfilePath := flag.String("cpu-profile", "", "Write a CPU profile to the specified file before exiting.")
flagLogLevel := flag.String("log-level", "info", "Define the logging level.")
flag.Parse()
// Load configuration
config, err := config.Load(*flagConfigPath)
if err != nil {
log.Fatalf("failed to load configuration: %s", err)
}
// Initialize logging system
logLevel, err := capnslog.ParseLevel(strings.ToUpper(*flagLogLevel))
capnslog.SetGlobalLogLevel(logLevel)
capnslog.SetFormatter(capnslog.NewPrettyFormatter(os.Stdout, false))
// Enable CPU Profiling if specified
if *flagCPUProfilePath != "" {
defer stopCPUProfiling(startCPUProfiling(*flagCPUProfilePath))
}
clair.Boot(config)
}
func logHandleFunc(w http.ResponseWriter, r *http.Request) {
if !allowMethod(w, r.Method, "PUT") {
return
}
in := struct{ Level string }{}
d := json.NewDecoder(r.Body)
if err := d.Decode(&in); err != nil {
writeError(w, r, httptypes.NewHTTPError(http.StatusBadRequest, "Invalid json body"))
return
}
logl, err := capnslog.ParseLevel(strings.ToUpper(in.Level))
if err != nil {
writeError(w, r, httptypes.NewHTTPError(http.StatusBadRequest, "Invalid log level "+in.Level))
return
}
plog.Noticef("globalLogLevel set to %q", logl.String())
capnslog.SetGlobalLogLevel(logl)
w.WriteHeader(http.StatusNoContent)
}
func main() {
rand.Seed(time.Now().UTC().UnixNano())
var err error
st := utils.NewStopper()
// Parse command-line arguments
kingpin.Parse()
if *cfgDbType != "memstore" && *cfgDbPath == "" {
kingpin.Errorf("required flag --db-path not provided, try --help")
os.Exit(1)
}
if *cfgNotifierType == "http" && *cfgNotifierHTTPURL == "" {
kingpin.Errorf("required flag --notifier-http-url not provided, try --help")
os.Exit(1)
}
// Initialize error/logging system
logLevel, err := capnslog.ParseLevel(strings.ToUpper(*cfgLogLevel))
capnslog.SetGlobalLogLevel(logLevel)
capnslog.SetFormatter(capnslog.NewPrettyFormatter(os.Stdout, false))
// Enable CPU Profiling if specified
if *cfgCPUProfilePath != "" {
f, err := os.Create(*cfgCPUProfilePath)
if err != nil {
log.Fatalf("failed to create profile file: %s", err)
}
defer f.Close()
pprof.StartCPUProfile(f)
log.Info("started profiling")
defer func() {
pprof.StopCPUProfile()
log.Info("stopped profiling")
}()
}
// Open database
err = database.Open(*cfgDbType, *cfgDbPath)
if err != nil {
log.Fatal(err)
}
defer database.Close()
// Start notifier
var notifierService notifier.Notifier
switch *cfgNotifierType {
case "http":
notifierService, err = notifier.NewHTTPNotifier(*cfgNotifierHTTPURL)
if err != nil {
log.Fatalf("could not initialize HTTP notifier: %s", err)
}
}
if notifierService != nil {
st.Begin()
go notifierService.Run(st)
}
// Start Main API and Health API
st.Begin()
go api.RunMain(&api.Config{
Port: *cfgAPIPort,
TimeOut: *cfgAPITimeout,
CertFile: *cfgAPICertFile,
KeyFile: *cfgAPIKeyFile,
CAFile: *cfgAPICAFile,
}, st)
st.Begin()
go api.RunHealth(*cfgAPIPort+1, st)
// Start updater
st.Begin()
go updater.Run(*cfgUpdateInterval, st)
// This blocks the main goroutine which is required to keep all the other goroutines running
interrupts := make(chan os.Signal, 1)
signal.Notify(interrupts, os.Interrupt)
<-interrupts
log.Info("Received interruption, gracefully stopping ...")
st.Stop()
}
func main() {
flags := struct {
address string
rpcAddress string
dataPath string
assetsPath string
logLevel string
certFile string
keyFile string
caFile string
keyRingPath string
version bool
help bool
}{}
flag.StringVar(&flags.address, "address", "127.0.0.1:8080", "HTTP listen address")
flag.StringVar(&flags.rpcAddress, "rpc-address", "", "RPC listen address")
flag.StringVar(&flags.dataPath, "data-path", "/var/lib/bootcfg", "Path to data directory")
flag.StringVar(&flags.assetsPath, "assets-path", "/var/lib/bootcfg/assets", "Path to static assets")
// Log levels https://godoc.org/github.com/coreos/pkg/capnslog#LogLevel
flag.StringVar(&flags.logLevel, "log-level", "info", "Set the logging level")
// gRPC Server TLS
flag.StringVar(&flags.certFile, "cert-file", "/etc/bootcfg/server.crt", "Path to the server TLS certificate file")
flag.StringVar(&flags.keyFile, "key-file", "/etc/bootcfg/server.key", "Path to the server TLS key file")
// TLS Client Authentication
flag.StringVar(&flags.caFile, "ca-file", "/etc/bootcfg/ca.crt", "Path to the CA verify and authenticate client certificates")
// Signing
flag.StringVar(&flags.keyRingPath, "key-ring-path", "", "Path to a private keyring file")
// subcommands
flag.BoolVar(&flags.version, "version", false, "print version and exit")
flag.BoolVar(&flags.help, "help", false, "print usage and exit")
// parse command-line and environment variable arguments
flag.Parse()
if err := flagutil.SetFlagsFromEnv(flag.CommandLine, "BOOTCFG"); err != nil {
log.Fatal(err.Error())
}
// restrict OpenPGP passphrase to pass via environment variable only
passphrase := os.Getenv("BOOTCFG_PASSPHRASE")
if flags.version {
fmt.Println(version.Version)
return
}
if flags.help {
flag.Usage()
return
}
// validate arguments
if url, err := url.Parse(flags.address); err != nil || url.String() == "" {
log.Fatal("A valid HTTP listen address is required")
}
if finfo, err := os.Stat(flags.dataPath); err != nil || !finfo.IsDir() {
log.Fatal("A valid -data-path is required")
}
if flags.assetsPath != "" {
if finfo, err := os.Stat(flags.assetsPath); err != nil || !finfo.IsDir() {
log.Fatalf("Provide a valid -assets-path or '' to disable asset serving: %s", flags.assetsPath)
}
}
if flags.rpcAddress != "" {
if _, err := os.Stat(flags.certFile); err != nil {
log.Fatalf("Provide a valid TLS server certificate with -cert-file: %v", err)
}
if _, err := os.Stat(flags.keyFile); err != nil {
log.Fatalf("Provide a valid TLS server key with -key-file: %v", err)
}
if _, err := os.Stat(flags.caFile); err != nil {
log.Fatalf("Provide a valid TLS certificate authority for authorizing client certificates: %v", err)
}
}
// logging setup
lvl, err := capnslog.ParseLevel(strings.ToUpper(flags.logLevel))
if err != nil {
log.Fatalf("invalid log-level: %v", err)
}
capnslog.SetGlobalLogLevel(lvl)
capnslog.SetFormatter(capnslog.NewPrettyFormatter(os.Stdout, false))
// (optional) signing
var signer, armoredSigner sign.Signer
if flags.keyRingPath != "" {
entity, err := sign.LoadGPGEntity(flags.keyRingPath, passphrase)
if err != nil {
log.Fatal(err)
}
signer = sign.NewGPGSigner(entity)
armoredSigner = sign.NewArmoredGPGSigner(entity)
}
// storage
store := storage.NewFileStore(&storage.Config{
Root: flags.dataPath,
})
// core logic
server := server.NewServer(&server.Config{
Store: store,
})
// gRPC Server (feature disabled by default)
if flags.rpcAddress != "" {
log.Infof("starting bootcfg gRPC server on %s", flags.rpcAddress)
log.Infof("Using TLS server certificate: %s", flags.certFile)
log.Infof("Using TLS server key: %s", flags.keyFile)
log.Infof("Using CA certificate: %s to authenticate client certificates", flags.caFile)
lis, err := net.Listen("tcp", flags.rpcAddress)
if err != nil {
log.Fatalf("failed to start listening: %v", err)
}
tlsinfo := tlsutil.TLSInfo{
CertFile: flags.certFile,
KeyFile: flags.keyFile,
CAFile: flags.caFile,
}
tlscfg, err := tlsinfo.ServerConfig()
if err != nil {
log.Fatalf("Invalid TLS credentials: %v", err)
}
grpcServer := rpc.NewServer(server, tlscfg)
go grpcServer.Serve(lis)
defer grpcServer.Stop()
}
// HTTP Server
config := &web.Config{
Store: store,
AssetsPath: flags.assetsPath,
Signer: signer,
ArmoredSigner: armoredSigner,
}
httpServer := web.NewServer(config)
log.Infof("starting bootcfg HTTP server on %s", flags.address)
err = http.ListenAndServe(flags.address, httpServer.HTTPHandler())
if err != nil {
log.Fatalf("failed to start listening: %v", err)
}
}
func main() {
flags := struct {
address string
configPath string
dataPath string
assetsPath string
logLevel string
version bool
help bool
}{}
flag.StringVar(&flags.address, "address", "127.0.0.1:8080", "HTTP listen address")
flag.StringVar(&flags.configPath, "config", "./data/config.yaml", "Path to config file")
flag.StringVar(&flags.dataPath, "data-path", "./data", "Path to data directory")
flag.StringVar(&flags.assetsPath, "assets-path", "./assets", "Path to static assets")
// available log levels https://godoc.org/github.com/coreos/pkg/capnslog#LogLevel
flag.StringVar(&flags.logLevel, "log-level", "info", "Set the logging level")
// subcommands
flag.BoolVar(&flags.version, "version", false, "print version and exit")
flag.BoolVar(&flags.help, "help", false, "print usage and exit")
// parse command-line and environment variable arguments
flag.Parse()
if err := flagutil.SetFlagsFromEnv(flag.CommandLine, "BOOTCFG"); err != nil {
log.Fatal(err.Error())
}
if flags.version {
fmt.Println(version)
return
}
if flags.help {
flag.Usage()
return
}
// validate arguments
if url, err := url.Parse(flags.address); err != nil || url.String() == "" {
log.Fatal("A valid HTTP listen address is required")
}
if finfo, err := os.Stat(flags.configPath); err != nil || finfo.IsDir() {
log.Fatal("A path to a config file is required")
}
if finfo, err := os.Stat(flags.dataPath); err != nil || !finfo.IsDir() {
log.Fatal("A path to a data directory is required")
}
if finfo, err := os.Stat(flags.assetsPath); err != nil || !finfo.IsDir() {
log.Fatal("A path to an assets directory is required")
}
// logging setup
lvl, err := capnslog.ParseLevel(strings.ToUpper(flags.logLevel))
if err != nil {
log.Fatalf("Invalid log-level: %v", err.Error())
}
capnslog.SetGlobalLogLevel(lvl)
capnslog.SetFormatter(capnslog.NewPrettyFormatter(os.Stdout, false))
// storage
store := api.NewFileStore(http.Dir(flags.dataPath))
// load bootstrap config
cfg, err := config.LoadConfig(flags.configPath)
if err != nil {
log.Fatal(err)
}
store.BootstrapGroups(cfg.Groups)
// API server
config := &api.Config{
Store: store,
AssetsPath: flags.assetsPath,
}
server := api.NewServer(config)
log.Infof("starting bootcfg API Server on %s", flags.address)
err = http.ListenAndServe(flags.address, server.HTTPHandler())
if err != nil {
log.Fatalf("failed to start listening: %s", err)
}
}