Nov 18, 2024 · Nov 18, 2024
diff --git a/cli/server.go b/cli/server.go
 "github.com/coder/serpent"
 "github.com/coder/wgtunnel/tunnelsdk"

 "github.com/coder/coder/v2/coderd/cryptokeys"
 "github.com/coder/coder/v2/coderd/entitlements"
 "github.com/coder/coder/v2/coderd/notifications/reports"
 "github.com/coder/coder/v2/coderd/runtimeconfig"
 return xerrors.Errorf("set deployment id: %w", err)
 }

 fetcher := &cryptokeys.DBFetcher{
 DB: options.Database,
 }

 resumeKeycache, err := cryptokeys.NewSigningCache(ctx,
 logger,
 fetcher,
 codersdk.CryptoKeyFeatureTailnetResume,
 )
 if err != nil {
 logger.Critical(ctx, "failed to properly instantiate tailnet resume signing cache", slog.Error(err))
 }

 options.CoordinatorResumeTokenProvider = tailnet.NewResumeTokenKeyProvider(
 resumeKeycache,
 quartz.NewReal(),
 tailnet.DefaultResumeTokenExpiry,
 )

 options.RuntimeConfig = runtimeconfig.NewManager()

 // This should be output before the logs start streaming.
diff --git a/coderd/coderd.go b/coderd/coderd.go
 codersdk.CryptoKeyFeatureOIDCConvert,
 )
 if err != nil {
 options.Logger.Critical(ctx, "failed to properly instantiate oidc convert signing cache", slog.Error(err))
 options.Logger.Fatal(ctx, "failed to properly instantiate oidc convert signing cache", slog.Error(err))
 }
 }

 codersdk.CryptoKeyFeatureWorkspaceAppsToken,
 )
 if err != nil {
 options.Logger.Critical(ctx, "failed to properly instantiate app signing key cache", slog.Error(err))
 options.Logger.Fatal(ctx, "failed to properly instantiate app signing key cache", slog.Error(err))
 }
 }

 codersdk.CryptoKeyFeatureWorkspaceAppsAPIKey,
 )
 if err != nil {
 options.Logger.Critical(ctx, "failed to properly instantiate app encryption key cache", slog.Error(err))
 options.Logger.Fatal(ctx, "failed to properly instantiate app encryption key cache", slog.Error(err))
 }
 }

 if options.CoordinatorResumeTokenProvider == nil {
 fetcher := &cryptokeys.DBFetcher{
 DB: options.Database,
 }

 resumeKeycache, err := cryptokeys.NewSigningCache(ctx,
 options.Logger,
 fetcher,
 codersdk.CryptoKeyFeatureTailnetResume,
 )
 if err != nil {
 options.Logger.Fatal(ctx, "failed to properly instantiate tailnet resume signing cache", slog.Error(err))
 }
 options.CoordinatorResumeTokenProvider = tailnet.NewResumeTokenKeyProvider(
 resumeKeycache,
 options.Clock,
 tailnet.DefaultResumeTokenExpiry,
 )
 }

 // Start a background process that rotates keys. We intentionally start this after the caches
 // are created to force initial requests for a key to populate the caches. This helps catch
 // bugs that may only occur when a key isn't precached in tests and the latency cost is minimal.
Original file line number	Diff line number	Diff line change
Expand Up		@@ -61,7 +61,6 @@ import (
		"github.com/coder/serpent"
		"github.com/coder/wgtunnel/tunnelsdk"

		"github.com/coder/coder/v2/coderd/cryptokeys"
		"github.com/coder/coder/v2/coderd/entitlements"
		"github.com/coder/coder/v2/coderd/notifications/reports"
		"github.com/coder/coder/v2/coderd/runtimeconfig"
Expand DownExpand Up		@@ -754,25 +753,6 @@ func (r RootCmd) Server(newAPI func(context.Context, coderd.Options) (*coderd.
		return xerrors.Errorf("set deployment id: %w", err)
		}

		fetcher := &cryptokeys.DBFetcher{
		DB: options.Database,
		}

		resumeKeycache, err := cryptokeys.NewSigningCache(ctx,
		logger,
		fetcher,
		codersdk.CryptoKeyFeatureTailnetResume,
		)
		if err != nil {
		logger.Critical(ctx, "failed to properly instantiate tailnet resume signing cache", slog.Error(err))
		}

		options.CoordinatorResumeTokenProvider = tailnet.NewResumeTokenKeyProvider(
		resumeKeycache,
		quartz.NewReal(),
		tailnet.DefaultResumeTokenExpiry,
		)

		options.RuntimeConfig = runtimeconfig.NewManager()

		// This should be output before the logs start streaming.
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -467,7 +467,7 @@ func New(options Options) API {
		codersdk.CryptoKeyFeatureOIDCConvert,
		)
		if err != nil {
		options.Logger.Critical(ctx, "failed to properly instantiate oidc convert signing cache", slog.Error(err))
		options.Logger.Fatal(ctx, "failed to properly instantiate oidc convert signing cache", slog.Error(err))
		}
		}

Expand All		@@ -478,7 +478,7 @@ func New(options Options) API {
		codersdk.CryptoKeyFeatureWorkspaceAppsToken,
		)
		if err != nil {
		options.Logger.Critical(ctx, "failed to properly instantiate app signing key cache", slog.Error(err))
		options.Logger.Fatal(ctx, "failed to properly instantiate app signing key cache", slog.Error(err))
		}
		}

Expand All		@@ -489,10 +489,30 @@ func New(options Options) API {
		codersdk.CryptoKeyFeatureWorkspaceAppsAPIKey,
		)
		if err != nil {
		options.Logger.Critical(ctx, "failed to properly instantiate app encryption key cache", slog.Error(err))
		options.Logger.Fatal(ctx, "failed to properly instantiate app encryption key cache", slog.Error(err))
		}
		}

		if options.CoordinatorResumeTokenProvider == nil {
		fetcher := &cryptokeys.DBFetcher{
		DB: options.Database,
		}

		resumeKeycache, err := cryptokeys.NewSigningCache(ctx,
		options.Logger,
		fetcher,
		codersdk.CryptoKeyFeatureTailnetResume,
		)
		if err != nil {
		options.Logger.Fatal(ctx, "failed to properly instantiate tailnet resume signing cache", slog.Error(err))
		}
		options.CoordinatorResumeTokenProvider = tailnet.NewResumeTokenKeyProvider(
		resumeKeycache,
		options.Clock,
		tailnet.DefaultResumeTokenExpiry,
		)
		}

		// Start a background process that rotates keys. We intentionally start this after the caches
		// are created to force initial requests for a key to populate the caches. This helps catch
		// bugs that may only occur when a key isn't precached in tests and the latency cost is minimal.
Expand Down