From c62d4229cf108436bc0e0fd296b67b6be3e261ee Mon Sep 17 00:00:00 2001
From: Jonathan Zernik <yzernik@gmail.com>
Date: Tue, 24 Nov 2020 01:18:53 -0500
Subject: [PATCH] Remove btcd cert shared volume (#486)

* Remove shared volume for btcd cert file

* Got ssl cert working as a config

* Remove old comment about adding ssl certificate in dockerfile
---
 docker/docker-compose.yml                       | 7 -------
 docker/squeaknode/start-squeaknode.sh           | 9 ---------
 itests/config.ini                               | 1 +
 squeaknode/bitcoin/bitcoin_blockchain_client.py | 7 +++++++
 squeaknode/config/config.py                     | 4 ++++
 squeaknode/main.py                              | 1 +
 6 files changed, 13 insertions(+), 16 deletions(-)

diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index de0ae8eb..aae3cedc 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -17,7 +17,6 @@ services:
       - RPCHOST=bitcoin-core
       - BACKEND=bitcoind
     volumes:
-      - shared:/rpc
       - ~/.lnd:/root/.lnd
     ports:
       - 9735:9735
@@ -40,7 +39,6 @@ services:
       - LOG_LEVEL
       - SQUEAKNODE_SYNC_INTERVAL_S
     volumes:
-      - shared:/rpc
       - ~/.lnd:/root/.lnd
       - ./config.ini:/app/config.ini
       - ~/.sqk:/root/.sqk
@@ -53,8 +51,3 @@ services:
     sysctls:
       - net.ipv6.conf.all.disable_ipv6=0
     entrypoint: ["./start-squeaknode.sh"]
-
-volumes:
-  # shared volume is needed for sharing the btcd certificate
-  shared:
-    driver: local
diff --git a/docker/squeaknode/start-squeaknode.sh b/docker/squeaknode/start-squeaknode.sh
index a397f3c9..608230d6 100644
--- a/docker/squeaknode/start-squeaknode.sh
+++ b/docker/squeaknode/start-squeaknode.sh
@@ -3,15 +3,6 @@
 # exit from script if error was raised.
 set -e
 
-# Add btcd's RPC TLS certificate to system Certificate Authority list.	exec runsqueak \
-cp /rpc/rpc.cert /usr/share/ca-certificates/btcd.crt
-echo btcd.crt >> /etc/ca-certificates.conf
-update-ca-certificates
-
-# To make python requests use the system ca-certificates bundle, it
-# needs to be told to use it over its own embedded bundle
-export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
-
 # Wait for the lnd cert file to exist before starting
 while ! test -f "/root/.lnd/tls.cert"; do
     sleep 10
diff --git a/itests/config.ini b/itests/config.ini
index 55c52501..ecbf5fd2 100644
--- a/itests/config.ini
+++ b/itests/config.ini
@@ -12,6 +12,7 @@ rpc_host=btcd
 rpc_user=devuser
 rpc_pass=devpass
 rpc_use_ssl=true
+rpc_ssl_cert=/rpc/rpc.cert
 
 [postgresql]
 host=db
diff --git a/squeaknode/bitcoin/bitcoin_blockchain_client.py b/squeaknode/bitcoin/bitcoin_blockchain_client.py
index b86b443e..1d4af3a8 100644
--- a/squeaknode/bitcoin/bitcoin_blockchain_client.py
+++ b/squeaknode/bitcoin/bitcoin_blockchain_client.py
@@ -1,3 +1,4 @@
+import os
 import json
 import logging
 from typing import Optional
@@ -20,10 +21,16 @@ class BitcoinBlockchainClient(BlockchainClient):
         rpc_user: str,
         rpc_password: str,
         use_ssl: bool,
+        ssl_cert: str,
     ) -> None:
         protocol = "https" if use_ssl else "http"
         self.url = f"{protocol}://{rpc_user}:{rpc_password}@{host}:{port}"
         self.headers = {"content-type": "application/json"}
+        s = requests.Session()
+        if ssl_cert:
+            os.environ['SSL_CERT_FILE'] = ssl_cert
+            os.environ['REQUESTS_CA_BUNDLE'] = ssl_cert
+            s.cert = ssl_cert
 
     def get_best_block_info(self) -> BlockInfo:
         block_height = self.get_block_count()
diff --git a/squeaknode/config/config.py b/squeaknode/config/config.py
index d6c39ec5..3a770ee0 100644
--- a/squeaknode/config/config.py
+++ b/squeaknode/config/config.py
@@ -45,6 +45,7 @@ class Config:
         self._configs['bitcoin_rpc_user'] = self._get_bitcoin_rpc_user()
         self._configs['bitcoin_rpc_pass'] = self._get_bitcoin_rpc_pass()
         self._configs['bitcoin_rpc_use_ssl'] = self._get_bitcoin_rpc_use_ssl()
+        self._configs['bitcoin_rpc_ssl_cert'] = self._get_bitcoin_rpc_ssl_cert()
 
         #lnd
         self._configs['lnd_host'] = self._get_lnd_host()
@@ -111,6 +112,9 @@ class Config:
     def _get_bitcoin_rpc_use_ssl(self):
         return self.parser.getboolean("bitcoin", "rpc_use_ssl", fallback=False)
 
+    def _get_bitcoin_rpc_ssl_cert(self):
+        return self.parser.get("bitcoin", "rpc_ssl_cert", fallback=None)
+
     def _get_lnd_host(self):
         return self.parser.get("lnd", "host")
 
diff --git a/squeaknode/main.py b/squeaknode/main.py
index 1890631e..ab7d815a 100644
--- a/squeaknode/main.py
+++ b/squeaknode/main.py
@@ -120,6 +120,7 @@ def load_blockchain_client(config):
         config.bitcoin_rpc_user,
         config.bitcoin_rpc_pass,
         config.bitcoin_rpc_use_ssl,
+        config.bitcoin_rpc_ssl_cert,
     )