Add TLS to gRPC server
diff --git a/osm_ee/util/util_grpc.py b/osm_ee/util/util_grpc.py
new file mode 100644
index 0000000..df904c1
--- /dev/null
+++ b/osm_ee/util/util_grpc.py
@@ -0,0 +1,26 @@
+import logging
+import ssl
+
+logger = logging.getLogger("osm_ee.util_grpc")
+
+SERVER_CERT = "/etc/ssl/grpc-tls/tls.crt"
+SERVER_KEY = "/etc/ssl/grpc-tls/tls.key"
+
+
+def create_secure_context() -> ssl.SSLContext:
+ ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+ # ctx.verify_mode = ssl.CERT_REQUIRED
+ try:
+ ctx.load_cert_chain(str(SERVER_CERT), str(SERVER_KEY))
+ except FileNotFoundError:
+ logger.warning("TLS Certificate not found, starting gRPC server in unsecure mode")
+ return None
+ # TODO: client TLS
+ # ctx.load_verify_locations(str(trusted))
+ ctx.set_ciphers('ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20')
+ ctx.set_alpn_protocols(['h2'])
+ try:
+ ctx.set_npn_protocols(['h2'])
+ except NotImplementedError:
+ pass
+ return ctx
\ No newline at end of file