From 6b6018c207379df8b1e5a924708096f85bba6ae1 Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Thu, 5 Mar 2026 23:49:31 -0500 Subject: [PATCH] fix: make TLS configurable in goosed agent via GOOSE_TLS env var (#7686) --- crates/goose-server/src/commands/agent.rs | 41 ++++++++++++------- crates/goose-server/src/configuration.rs | 8 ++++ .../src/routes/action_required.rs | 2 +- crates/goose-server/src/routes/reply.rs | 2 +- crates/goose-server/src/state.rs | 4 +- crates/goose-server/src/tunnel/mod.rs | 9 ++-- 6 files changed, 44 insertions(+), 22 deletions(-) diff --git a/crates/goose-server/src/commands/agent.rs b/crates/goose-server/src/commands/agent.rs index 87eec07f4e..6a1a93cc30 100644 --- a/crates/goose-server/src/commands/agent.rs +++ b/crates/goose-server/src/commands/agent.rs @@ -40,7 +40,7 @@ pub async fn run() -> Result<()> { let secret_key = std::env::var("GOOSE_SERVER__SECRET_KEY").unwrap_or_else(|_| "test".to_string()); - let app_state = state::AppState::new().await?; + let app_state = state::AppState::new(settings.tls).await?; let cors = CorsLayer::new() .allow_origin(Any) @@ -55,16 +55,6 @@ pub async fn run() -> Result<()> { .layer(cors); let addr = settings.socket_addr(); - let tls_setup = self_signed_config().await?; - - let handle = Handle::new(); - let shutdown_handle = handle.clone(); - tokio::spawn(async move { - shutdown_signal().await; - shutdown_handle.graceful_shutdown(None); - }); - - info!("listening on https://{}", addr); let tunnel_manager = app_state.tunnel_manager.clone(); tokio::spawn(async move { @@ -76,10 +66,31 @@ pub async fn run() -> Result<()> { gateway_manager.check_auto_start().await; }); - axum_server::bind_rustls(addr, tls_setup.config) - .handle(handle) - .serve(app.into_make_service()) - .await?; + if settings.tls { + let tls_setup = self_signed_config().await?; + + let handle = Handle::new(); + let shutdown_handle = handle.clone(); + tokio::spawn(async move { + shutdown_signal().await; + shutdown_handle.graceful_shutdown(None); + }); + + info!("listening on https://{}", addr); + + axum_server::bind_rustls(addr, tls_setup.config) + .handle(handle) + .serve(app.into_make_service()) + .await?; + } else { + let listener = tokio::net::TcpListener::bind(addr).await?; + + info!("listening on http://{}", addr); + + axum::serve(listener, app) + .with_graceful_shutdown(async { shutdown_signal().await }) + .await?; + } if goose::otel::otlp::is_otlp_initialized() { tokio::time::sleep(tokio::time::Duration::from_millis(100)).await; diff --git a/crates/goose-server/src/configuration.rs b/crates/goose-server/src/configuration.rs index f0f3349bac..4f28ec34b9 100644 --- a/crates/goose-server/src/configuration.rs +++ b/crates/goose-server/src/configuration.rs @@ -9,6 +9,8 @@ pub struct Settings { pub host: String, #[serde(default = "default_port")] pub port: u16, + #[serde(default = "default_tls")] + pub tls: bool, } impl Settings { @@ -28,6 +30,7 @@ impl Settings { // Server defaults .set_default("host", default_host())? .set_default("port", default_port())? + .set_default("tls", default_tls())? // Layer on the environment variables .add_source( Environment::with_prefix("GOOSE") @@ -74,6 +77,10 @@ fn default_port() -> u16 { 3000 } +fn default_tls() -> bool { + true +} + #[cfg(test)] mod tests { use super::*; @@ -83,6 +90,7 @@ mod tests { let server_settings = Settings { host: "127.0.0.1".to_string(), port: 3000, + tls: true, }; let addr = server_settings.socket_addr(); assert_eq!(addr.to_string(), "127.0.0.1:3000"); diff --git a/crates/goose-server/src/routes/action_required.rs b/crates/goose-server/src/routes/action_required.rs index f925a487a2..1301f41c40 100644 --- a/crates/goose-server/src/routes/action_required.rs +++ b/crates/goose-server/src/routes/action_required.rs @@ -72,7 +72,7 @@ mod tests { #[tokio::test(flavor = "multi_thread")] async fn test_tool_confirmation_endpoint() { - let state = AppState::new().await.unwrap(); + let state = AppState::new(true).await.unwrap(); let app = routes(state); diff --git a/crates/goose-server/src/routes/reply.rs b/crates/goose-server/src/routes/reply.rs index 0cc40535eb..70eafd3353 100644 --- a/crates/goose-server/src/routes/reply.rs +++ b/crates/goose-server/src/routes/reply.rs @@ -480,7 +480,7 @@ mod tests { #[tokio::test(flavor = "multi_thread")] async fn test_reply_endpoint() { - let state = AppState::new().await.unwrap(); + let state = AppState::new(true).await.unwrap(); let app = routes(state); diff --git a/crates/goose-server/src/state.rs b/crates/goose-server/src/state.rs index 1b33e167d4..da00db4a56 100644 --- a/crates/goose-server/src/state.rs +++ b/crates/goose-server/src/state.rs @@ -29,11 +29,11 @@ pub struct AppState { } impl AppState { - pub async fn new() -> anyhow::Result> { + pub async fn new(tls: bool) -> anyhow::Result> { register_builtin_extensions(goose_mcp::BUILTIN_EXTENSIONS.clone()); let agent_manager = AgentManager::instance().await?; - let tunnel_manager = Arc::new(TunnelManager::new()); + let tunnel_manager = Arc::new(TunnelManager::new(tls)); let gateway_manager = Arc::new(GatewayManager::new(agent_manager.clone())?); Ok(Arc::new(Self { diff --git a/crates/goose-server/src/tunnel/mod.rs b/crates/goose-server/src/tunnel/mod.rs index 2cbb29e3e5..6d8c049be9 100644 --- a/crates/goose-server/src/tunnel/mod.rs +++ b/crates/goose-server/src/tunnel/mod.rs @@ -91,16 +91,17 @@ pub struct TunnelManager { restart_tx: Arc>>>, watchdog_handle: Arc>>>, lock_file: Arc>>, + scheme: String, } impl Default for TunnelManager { fn default() -> Self { - Self::new() + Self::new(true) } } impl TunnelManager { - pub fn new() -> Self { + pub fn new(tls: bool) -> Self { TunnelManager { state: Arc::new(RwLock::new(TunnelState::Idle)), info: Arc::new(RwLock::new(None)), @@ -108,6 +109,7 @@ impl TunnelManager { restart_tx: Arc::new(RwLock::new(None)), watchdog_handle: Arc::new(RwLock::new(None)), lock_file: Arc::new(std::sync::Mutex::new(None)), + scheme: if tls { "https" } else { "http" }.to_string(), } } @@ -229,7 +231,7 @@ impl TunnelManager { tunnel_secret, server_secret, agent_id, - "https", + &self.scheme, self.lapstone_handle.clone(), restart_tx, ) @@ -317,6 +319,7 @@ impl TunnelManager { restart_tx: self.restart_tx.clone(), watchdog_handle: self.watchdog_handle.clone(), lock_file: self.lock_file.clone(), + scheme: self.scheme.clone(), } }