| 1 | import * as GCP from "@/GCP"; |
| 2 | import * as Effect from "effect/Effect"; |
| 3 | import { serveProbes } from "../../bindingHost.ts"; |
| 4 | |
| 5 | /** CA pool the bindings are granted on. */ |
| 6 | export const Pool = GCP.PrivateCA.CaPool("AppCa", { |
| 7 | location: "us-central1", |
| 8 | tier: "DEVOPS", |
| 9 | publishingOptions: { publishCaCert: false, publishCrl: false }, |
| 10 | }); |
| 11 | |
| 12 | /** Enabled self-signed root CA in {@link Pool}. */ |
| 13 | export const Root = Effect.gen(function* () { |
| 14 | const pool = yield* Pool; |
| 15 | return yield* GCP.PrivateCA.CertificateAuthority("Root", { |
| 16 | caPool: pool.name, |
| 17 | type: "SELF_SIGNED", |
| 18 | keySpec: { algorithm: "RSA_PKCS1_2048_SHA256" }, |
| 19 | }); |
| 20 | }); |
| 21 | |
| 22 | /** |
| 23 | * Effect-native Cloud Run service exercising every Private CA binding as its |
| 24 | * own runtime service account. Deployed from {@link ../Bindings.test.ts}. |
| 25 | */ |
| 26 | export default class PrivateCaBindingsHost extends GCP.Function<PrivateCaBindingsHost>()( |
| 27 | "PrivateCaBindingsHost", |
| 28 | { main: import.meta.url, invokerIamDisabled: true }, |
| 29 | Effect.gen(function* () { |
| 30 | const fetchCaCerts = yield* GCP.PrivateCA.FetchCaCerts(Pool); |
| 31 | const getCa = yield* GCP.PrivateCA.GetCertificateAuthority(Root); |
| 32 | |
| 33 | return { |
| 34 | fetch: serveProbes({ |
| 35 | fetchCaCerts: fetchCaCerts(), |
| 36 | getCertificateAuthority: getCa(), |
| 37 | }), |
| 38 | }; |
| 39 | }).pipe( |
| 40 | Effect.provide(GCP.PrivateCA.FetchCaCertsHttp), |
| 41 | Effect.provide(GCP.PrivateCA.GetCertificateAuthorityHttp), |
| 42 | ), |
| 43 | ) {} |