Class FlowServiceTlsOptions

java.lang.Object

io.superdurable.dex.FlowServiceTlsOptions

public final class FlowServiceTlsOptions
extends Object

Enables verified TLS for a Client or Worker's outbound FlowService connection.

Set this option independently on ClientOptions.Builder.flowServiceTls and WorkerOptions.Builder.flowServiceTls. Omitting it keeps plaintext gRPC. An empty builder enables TLS 1.2 or newer with the JDK default trust store. Additional PEM root CAs add to that store. Certificates are read at construction and are not watched for changes. The Worker uses TLS for startup, blob hydration, and pull task streams. Bearer credentials remain call metadata. These settings do not configure the API-key token endpoint.

With TLS, the server address must be host:port, dns:///host:port, or dns://authority/host:port, with port 1 through 65535. The endpoint host determines certificate verification and SNI unless serverName overrides it. The DNS resolver authority does not determine certificate identity. Without an override, HTTP/2 authority remains the endpoint's host and port. IP addresses require a matching IP subject alternative name. Netty omits SNI for IP addresses and single-label DNS names such as localhost. The endpoint must negotiate ALPN h2; HTTP/1.1 and absent ALPN are rejected.

Invalid settings throw IllegalArgumentException during options or Client/Worker construction. Connections open lazily. Certificate, hostname, and handshake failures surface as UNAVAILABLE on a Client call or as a Worker startup failure.

String rootPem = new String(java.nio.file.Files.readAllBytes(
        java.nio.file.Paths.get("/etc/dex/root-ca.pem")),
        java.nio.charset.StandardCharsets.US_ASCII);
FlowServiceTlsOptions tls = FlowServiceTlsOptions.newBuilder()
        .additionalRootCAsPem(rootPem)
        .build();
ClientOptions clientOptions = ClientOptions.newBuilder()
        .serverAddress("dex.example.com:443").flowServiceTls(tls).build();
WorkerOptions workerOptions = WorkerOptions.newBuilder()
        .serverAddress("dex.example.com:443").flowServiceTls(tls).build();
try (Client client = new Client(registry, blobCache, clientOptions);
        Worker worker = new Worker(registry, blobCache, workerOptions)) {
    Thread workerThread = new Thread(worker::start);
    workerThread.start();
    try {
        worker.waitPullRegistered(java.time.Duration.ofSeconds(30));
        client.searchFlows("", 10);
    } finally {
        worker.stop();
        workerThread.join();
    }
}

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	FlowServiceTlsOptions.Builder	Builds immutable TLS settings; see FlowServiceTlsOptions for a complete example.

Method Summary

Modifier and Type	Method	Description
static FlowServiceTlsOptions.Builder	newBuilder()	Creates TLS settings using the JDK default roots and the address host.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

newBuilder

public static FlowServiceTlsOptions.Builder newBuilder()

Creates TLS settings using the JDK default roots and the address host.

See this class's example for configuring both a Client and Worker.

Returns:

a new mutable builder with both optional values unset