func httpServer()

in server/cmd/harp-server/internal/dispatchers/vault/wire.go [87:142]

• 36 lines of code
• 5 McCabe index (conditional complexity)

func httpServer(ctx context.Context, cfg *config.Configuration, bm manager.Backend, tm transformerMap) (*http.Server, error) {
	r := chi.NewRouter()

	// middleware stack
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(middleware.Recoverer)

	// timeout before request cancelation
	r.Use(middleware.Timeout(60 * time.Second))

	routes.RootHandler(r)
	routes.KVHandler(r, bm)

	// Map transit handlers
	for name, t := range tm {
		routes.TransitHandler(r, name, t)
	}

	// Apply container keyring
	container.SetKeyring(cfg.Keyring)

	// Assign router to server
	server := &http.Server{
		Handler: r,
	}

	// Enable TLS if requested
	if cfg.Vault.UseTLS {
		// Client authentication enabled but not required
		clientAuth := tls.VerifyClientCertIfGiven
		if cfg.Vault.TLS.ClientAuthenticationRequired {
			clientAuth = tls.RequireAndVerifyClientCert
		}

		// Generate TLS configuration
		tlsConfig, err := tlsconfig.Server(&tlsconfig.Options{
			KeyFile:    cfg.Vault.TLS.PrivateKeyPath,
			CertFile:   cfg.Vault.TLS.CertificatePath,
			CAFile:     cfg.Vault.TLS.CACertificatePath,
			ClientAuth: clientAuth,
		})
		if err != nil {
			log.For(ctx).Error("Unable to build TLS configuration from settings", zap.Error(err))
			return nil, err
		}

		// Create the TLS credentials
		server.TLSConfig = tlsConfig
	} else {
		log.For(ctx).Info("No transport encryption enabled for fake Vault server")
	}

	// Return result
	return server, nil
}