|
1 | 1 | """API configuration.""" |
2 | 2 | import os |
| 3 | +import ssl |
3 | 4 | from typing import Any, Dict, Set |
4 | 5 |
|
5 | 6 | from elasticsearch import AsyncElasticsearch, Elasticsearch # type: ignore |
6 | 7 | from stac_fastapi.types.config import ApiSettings |
7 | 8 |
|
8 | 9 |
|
9 | 10 | def _es_config() -> Dict[str, Any]: |
| 11 | + # Determine the scheme (http or https) |
| 12 | + use_ssl = os.getenv("ES_USE_SSL", "true").lower() == "true" |
| 13 | + scheme = "https" if use_ssl else "http" |
| 14 | + |
| 15 | + # Configure the hosts parameter with the correct scheme |
| 16 | + hosts = [f"{scheme}://{os.getenv('ES_HOST')}:{os.getenv('ES_PORT')}"] |
| 17 | + |
| 18 | + # Initialize the configuration dictionary |
10 | 19 | config = { |
11 | | - "hosts": [{"host": os.getenv("ES_HOST"), "port": os.getenv("ES_PORT")}], |
| 20 | + "hosts": hosts, |
12 | 21 | "headers": {"accept": "application/vnd.elasticsearch+json; compatible-with=7"}, |
13 | | - "use_ssl": True, |
14 | | - "verify_certs": True, |
15 | 22 | } |
16 | 23 |
|
17 | | - if (u := os.getenv("ES_USER")) and (p := os.getenv("ES_PASS")): |
18 | | - config["http_auth"] = (u, p) |
| 24 | + # Explicitly exclude SSL settings when not using SSL |
| 25 | + if not use_ssl: |
| 26 | + return config |
19 | 27 |
|
20 | | - if (v := os.getenv("ES_USE_SSL")) and v == "false": |
21 | | - config["use_ssl"] = False |
| 28 | + # Include SSL settings if using https |
| 29 | + config["ssl_version"] = ssl.TLSVersion.TLSv1_3 # type: ignore |
| 30 | + config["verify_certs"] = os.getenv("ES_VERIFY_CERTS", "true").lower() != "false" # type: ignore |
22 | 31 |
|
23 | | - if (v := os.getenv("ES_VERIFY_CERTS")) and v == "false": |
24 | | - config["verify_certs"] = False |
| 32 | + # Include CA Certificates if verifying certs |
| 33 | + if config["verify_certs"]: |
| 34 | + config["ca_certs"] = os.getenv( |
| 35 | + "CURL_CA_BUNDLE", "/etc/ssl/certs/ca-certificates.crt" |
| 36 | + ) |
25 | 37 |
|
26 | | - if v := os.getenv("CURL_CA_BUNDLE"): |
27 | | - config["ca_certs"] = v |
| 38 | + # Handle authentication |
| 39 | + if (u := os.getenv("ES_USER")) and (p := os.getenv("ES_PASS")): |
| 40 | + config["http_auth"] = (u, p) |
28 | 41 |
|
29 | 42 | return config |
30 | 43 |
|
|
0 commit comments