feat: add SSL support

.env.example

@@ -39,3 +39,7 @@ GCS_CLIENT_EMAIL=
 GCS_PRIVATE_KEY=
 # Azure Blob Storage
 ABS_CONNECTION_STRING=
+# HTTPS
+HTTP2=
+SSL_KEY_PATH=
+SSL_CERT_PATH=

.gitignore

@@ -65,3 +65,6 @@ junit-testresults.xml
 .DS_Store
 build
 .envrc
+
+# Certs, if placed locally for testing
+**/certs

docs/environment-variables.md

@@ -26,3 +26,7 @@ nav_order: 2
 | `STORAGE_PATH_USE_TMP_FOLDER` | boolean | optional | `true` | Uses the system tmp folder as a prefix to `STORAGE_PATH` |
 | `BODY_LIMIT` | number | optional | `104857600` | The limit for artifact upload size  |
 | `HTTP2` | boolean | optional | `'false'` | If set to `true`, the server will use the HTTP/2 protocol, which helps bypass the 32MB payload size limit in Cloud Run |
+| `SSL_KEY_PATH` | string | optional | `` | If set, enables HTTPS using the key file at the specified path. |
+| `SSL_CERT_PATH` | string | optional | `` | If set, enables HTTPS using the certificate file at the specified path. |
+
+Both `SSL_KEY_PATH` and `SSL_CERT_PATH` must be set to enable HTTPS.

src/app.ts

@@ -1,3 +1,4 @@
+import * as fs from 'node:fs'
 import { isBoom } from '@hapi/boom'
 import Fastify, { FastifyInstance, FastifyServerOptions } from 'fastify'
 import hyperid from 'hyperid'
@@ -11,9 +12,25 @@ const uuid = hyperid({ urlSafe: true })
 export function createApp(
   options: FastifyServerOptions & { configOverrides?: Partial<Config> } = {},
 ): FastifyInstance {
+  const SSL_CERT_PATH = env.get().SSL_CERT_PATH
+  const SSL_KEY_PATH = env.get().SSL_KEY_PATH
+  const isHttps =
+    SSL_CERT_PATH &&
+    SSL_KEY_PATH &&
+    fs.existsSync(SSL_CERT_PATH) &&
+    fs.existsSync(SSL_KEY_PATH)
+
   const fastifyOptions: FastifyServerOptions = {
     ...options,
     ...(env.get().HTTP2 ? { http2: true } : {}),
+    ...(isHttps
+      ? {
+          https: {
+            key: fs.readFileSync(SSL_KEY_PATH),
+            cert: fs.readFileSync(SSL_CERT_PATH),
+          },
+        }
+      : {}),
   }
 
   const hasConfiguredLogger =

src/env.ts

@@ -58,6 +58,10 @@ const schema = Type.Object(
 
     // Azure Blob Storage credentials
     ABS_CONNECTION_STRING: Type.Optional(Type.String()),
+
+    // SSL support
+    SSL_KEY_PATH: Type.Optional(Type.String()),
+    SSL_CERT_PATH: Type.Optional(Type.String()),
   },
   {
     additionalProperties: false,