Upload custom SSL certificates for proxied accessories

lib/kamal/cli/accessory.rb

@@ -28,6 +28,16 @@ def boot(name, prepare: true)
             execute *KAMAL.auditor.record("Booted #{name} accessory"), verbosity: :debug
             execute *accessory.ensure_env_directory
             upload! accessory.secrets_io, accessory.secrets_path, mode: "0600"
+
+            if accessory.running_proxy? && accessory.proxy.custom_ssl_certificate?
+              cert_content = accessory.proxy.certificate_pem_content
+              key_content = accessory.proxy.private_key_pem_content
+
+              execute *accessory.create_ssl_directory
+              upload! StringIO.new(cert_content), accessory.proxy.host_tls_cert, mode: "0644"
+              upload! StringIO.new(key_content), accessory.proxy.host_tls_key, mode: "0644"
+            end
+
             execute *accessory.run(host: host)
 
             if accessory.running_proxy?

lib/kamal/commands/accessory/proxy.rb

@@ -9,6 +9,10 @@ def remove
     proxy_exec :remove, service_name
   end
 
+  def create_ssl_directory
+    make_directory(File.join(config.proxy_boot.tls_directory, proxy.role_name))
+  end
+
   private
     def proxy_exec(*command)
       docker :exec, proxy_container_name, "kamal-proxy", *command

lib/kamal/configuration/accessory.rb

@@ -132,6 +132,7 @@ def initialize_proxy
       Kamal::Configuration::Proxy.new \
         config: config,
         proxy_config: accessory_config["proxy"],
+        role_name: "accessories/#{name}",
         context: "accessories/#{name}/proxy",
         secrets: config.secrets
     end

test/cli/accessory_test.rb

@@ -42,6 +42,21 @@ class CliAccessoryTest < CliTestCase
     end
   end
 
+  test "boot with custom ssl certificate" do
+    Kamal::Cli::Accessory.any_instance.expects(:directories).with("busybox")
+    Kamal::Cli::Accessory.any_instance.expects(:upload).with("busybox")
+    Kamal::Configuration::Proxy.any_instance.stubs(:custom_ssl_certificate?).returns(true)
+    Kamal::Configuration::Proxy.any_instance.stubs(:certificate_pem_content).returns("CERTIFICATE CONTENT")
+    Kamal::Configuration::Proxy.any_instance.stubs(:private_key_pem_content).returns("PRIVATE KEY CONTENT")
+
+    run_command("boot", "busybox").tap do |output|
+      assert_match "mkdir -p .kamal/proxy/apps-config/app/tls/accessories/busybox", output
+      assert_match "Uploading \"CERTIFICATE CONTENT\" to .kamal/proxy/apps-config/app/tls/accessories/busybox/cert.pem", output
+      assert_match "Uploading \"PRIVATE KEY CONTENT\" to .kamal/proxy/apps-config/app/tls/accessories/busybox/key.pem", output
+      assert_match "--tls-certificate-path=\"/home/kamal-proxy/.apps-config/app/tls/accessories/busybox/cert.pem\" --tls-private-key-path=\"/home/kamal-proxy/.apps-config/app/tls/accessories/busybox/key.pem\"", output
+    end
+  end
+
   test "upload" do
     run_command("upload", "mysql").tap do |output|
       assert_match "mkdir -p app-mysql/etc/mysql", output

test/configuration/accessory_test.rb

@@ -446,6 +446,16 @@ class ConfigurationAccessoryTest < ActiveSupport::TestCase
     assert_equal [ "monitoring.example.com" ], @config.accessory(:monitoring).proxy.hosts
   end
 
+  test "proxy with custom ssl certificate" do
+    @deploy[:accessories]["monitoring"]["proxy"]["ssl"] = { "certificate_pem" => "CERT_PEM", "private_key_pem" => "KEY_PEM" }
+    proxy = Kamal::Configuration.new(@deploy).accessory(:monitoring).proxy
+
+    assert_equal ".kamal/proxy/apps-config/app/tls/accessories/monitoring/cert.pem", proxy.host_tls_cert
+    assert_equal ".kamal/proxy/apps-config/app/tls/accessories/monitoring/key.pem", proxy.host_tls_key
+    assert_equal "/home/kamal-proxy/.apps-config/app/tls/accessories/monitoring/cert.pem", proxy.container_tls_cert
+    assert_equal "/home/kamal-proxy/.apps-config/app/tls/accessories/monitoring/key.pem", proxy.container_tls_key
+  end
+
   test "invalid boolean restart policy" do
     @deploy[:accessories]["mysql"]["options"] = { "restart" => false }
 

test/fixtures/deploy_with_accessories_with_different_registries.yml

@@ -43,5 +43,7 @@ accessories:
       server: other.registry
       username: other_user
       password: other_pw
+    proxy:
+      host: busybox.example.com
 
 readiness_delay: 0