TLS & HTTPS

[dependencies]
axum-server = { version = "0.8.0", features = ["tls-rustls"] }
rustls = "0.23" # only to select the crypto provider explicitly (see below)

use std::net::SocketAddr;

use axum::{
    Router,
    http::{HeaderMap, StatusCode, Uri, header, uri::Authority},
    response::Redirect,
    routing::get,
};
use axum_server::tls_rustls::RustlsConfig;
use tokio::signal::unix::{SignalKind, signal};

const HTTP_PORT: u16 = 3000;
const HTTPS_PORT: u16 = 3443;

/// Redirects every plain-HTTP request to the same path on HTTPS.
async fn redirect_to_https(headers: HeaderMap, uri: Uri) -> Result<Redirect, StatusCode> {
    let host = headers.get(header::HOST).and_then(|h| h.to_str().ok()).ok_or(StatusCode::BAD_REQUEST)?;
    let authority: Authority = host.parse().map_err(|_| StatusCode::BAD_REQUEST)?;
    let path = uri.path_and_query().map_or("/", |pq| pq.as_str());
    Ok(Redirect::permanent(&format!("https://{}:{HTTPS_PORT}{path}", authority.host())))
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Pick the process-wide crypto provider explicitly (see "Choosing the rustls crypto provider").
    let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();

    let cert = std::env::var("TLS_CERT").unwrap_or_else(|_| "certs/cert.pem".into());
    let key = std::env::var("TLS_KEY").unwrap_or_else(|_| "certs/key.pem".into());
    let config = RustlsConfig::from_pem_file(&cert, &key).await?; // ALPN: h2 and http/1.1

    // Reload the certificate on SIGHUP (e.g. after certbot renews it): new connections use it, old ones continue.
    let reload = config.clone();
    tokio::spawn(async move {
        let mut hup = signal(SignalKind::hangup()).expect("signal handler");
        while hup.recv().await.is_some() {
            match reload.reload_from_pem_file(&cert, &key).await {
                Ok(()) => tracing::info!("certificate reloaded"),
                Err(err) => tracing::error!(%err, "certificate reload failed; keeping the old one"),
            }
        }
    });

    // Plain-HTTP listener that only redirects.
    let redirect = Router::new().fallback(redirect_to_https);
    let http = tokio::net::TcpListener::bind(("127.0.0.1", HTTP_PORT)).await?;
    tokio::spawn(async move { axum::serve(http, redirect).await });

    let app = Router::new().route("/", get(|| async { "hello over TLS\n" }));
    axum_server::bind_rustls(SocketAddr::from(([127, 0, 0, 1], HTTPS_PORT)), config)
        .serve(app.into_make_service())
        .await?;
    Ok(())
}

$ openssl req -x509 -newkey rsa:2048 -nodes -days 30 -subj '/CN=localhost' \
    -addext 'subjectAltName=DNS:localhost' -keyout certs/key.pem -out certs/cert.pem   # development only
$ curl -si localhost:3000/books?page=2 | grep -i -E '^HTTP|location'
HTTP/1.1 308 Permanent Redirect
location: https://localhost:3443/books?page=2
$ curl -s --cacert certs/cert.pem -w '%{http_version}\n' https://localhost:3443/
hello over TLS
2

use std::sync::Arc;

use axum::{Router, extract::Request, routing::get};
use hyper_util::{
    rt::{TokioExecutor, TokioIo},
    server::conn::auto::Builder,
    service::TowerToHyperService,
};
use rustls_pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject};
use tokio_rustls::{TlsAcceptor, rustls::ServerConfig};
use tower::ServiceExt;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let _ = tokio_rustls::rustls::crypto::aws_lc_rs::default_provider().install_default();
    let certs = CertificateDer::pem_file_iter("certs/cert.pem")?.collect::<Result<Vec<_>, _>>()?;
    let key = PrivateKeyDer::from_pem_file("certs/key.pem")?;
    let mut config = ServerConfig::builder().with_no_client_auth().with_single_cert(certs, key)?;
    config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
    let acceptor = TlsAcceptor::from(Arc::new(config));

    let app = Router::new().route("/", get(|| async { "hello from a hand-written TLS loop\n" }));
    let listener = tokio::net::TcpListener::bind("127.0.0.1:3443").await?;

    loop {
        let (tcp, peer) = listener.accept().await?;
        let (acceptor, router) = (acceptor.clone(), app.clone());
        tokio::spawn(async move {
            // the TLS handshake happens on the connection's own task, so a slow client blocks nobody
            let Ok(tls) = acceptor.accept(tcp).await else {
                tracing::debug!(%peer, "TLS handshake failed");
                return;
            };
            let service = TowerToHyperService::new(
                router.map_request(|req: Request<hyper::body::Incoming>| req.map(axum::body::Body::new)),
            );
            if let Err(err) = Builder::new(TokioExecutor::new()).serve_connection_with_upgrades(TokioIo::new(tls), service).await {
                tracing::debug!(%err, "connection error");
            }
        });
    }
}

use axum::{Router, routing::get};
use tokio::net::UnixListener;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let path = std::env::temp_dir().join("bookshelf.sock");
    let _ = std::fs::remove_file(&path); // a stale socket file from a previous run prevents binding
    let listener = UnixListener::bind(&path)?;
    println!("listening on {}", path.display());

    let app = Router::new().route("/health", get(|| async { "ok over a Unix socket\n" }));
    axum::serve(listener, app).await?;
    Ok(())
}

$ curl -s --unix-socket /tmp/bookshelf.sock http://localhost/health
ok over a Unix socket