Organize local infrastructure and Vault secrets by service ownership

backend/product/notifications/client.go

@@ -12,6 +12,7 @@ import (
 	merrors "git.sendico.io/tech/sxchnge/shared/errors"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
@@ -57,7 +58,11 @@ func Open(c Config) (*Client, error) {
 		}
 		tlsConfig.RootCAs = pool
 	}
-	conn, err := grpc.NewClient(c.Address, grpc.WithTransportCredentials(credentials.NewTLS(tlsConfig)))
+	var transport credentials.TransportCredentials = insecure.NewCredentials()
+	if c.CAFile != "" || c.ServerName != "" {
+		transport = credentials.NewTLS(tlsConfig)
+	}
+	conn, err := grpc.NewClient(c.Address, grpc.WithTransportCredentials(transport))
 	if err != nil {
 		return nil, merrors.InternalWrap(err, "create notification client")
 	}

backend/product/notifications/client_test.go

@@ -88,3 +88,19 @@ func TestOpenUsesVerifiedTLSAndCallerAuthentication(t *testing.T) {
 	require.NoError(t, client.Send(context.Background(), Message{ExpiresAt: time.Now().Add(time.Minute)}))
 	require.Equal(t, "Bearer test-service-token-with-at-least-32-bytes", <-rpc.auth)
 }
+
+func TestOpenUsesPlaintextAndCallerTokenOnPrivateNetwork(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	server := grpc.NewServer()
+	rpc := &tlsRPC{auth: make(chan string, 1)}
+	pb.RegisterNotificationsServiceServer(server, rpc)
+	go func() { _ = server.Serve(listener) }()
+	t.Cleanup(server.Stop)
+	t.Setenv("TEST_PLAIN_CALLER_TOKEN", "test-private-service-token-at-least-32-bytes")
+	client, err := Open(Config{Address: listener.Addr().String(), TokenEnv: "TEST_PLAIN_CALLER_TOKEN"})
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = client.Close() })
+	require.NoError(t, client.Send(context.Background(), Message{ExpiresAt: time.Now().Add(time.Minute)}))
+	require.Equal(t, "Bearer test-private-service-token-at-least-32-bytes", <-rpc.auth)
+}