phoenix-oss/llama-stack-mirror
0
0
Fork 1
mirror of https://github.com/meta-llama/llama-stack.git synced 2025-08-02 00:34:44 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: enable mutual tls

Browse source 
Signed-off-by: Gordon Sim <gsim@redhat.com>
This commit is contained in:
Gordon Sim 2025-05-12 11:53:24 +01:00
parent fe5f5e530c
commit 91602bfa5e
2 changed files with 13 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
llama_stack/distribution/datatypes.py
View file

@ -249,6 +249,10 @@ class ServerConfig(BaseModel):
default=None, default=None,
description="Path to TLS key file for HTTPS", description="Path to TLS key file for HTTPS",
) )
tls_cafile: str | None = Field(
default=None,
description="Path to TLS CA file for HTTPS with mutual TLS authentication",
)
auth: AuthenticationConfig | None = Field( auth: AuthenticationConfig | None = Field(
default=None, default=None,
description="Authentication configuration for the server", description="Authentication configuration for the server",

10
llama_stack/distribution/server/server.py
View file

@ -9,6 +9,7 @@ import asyncio
import inspect import inspect
import json import json
import os import os
import ssl
import sys import sys
import traceback import traceback
import warnings import warnings
@ -484,7 +485,14 @@ def main(args: argparse.Namespace | None = None):
"ssl_keyfile": keyfile, "ssl_keyfile": keyfile,
"ssl_certfile": certfile, "ssl_certfile": certfile,
} }
logger.info(f"HTTPS enabled with certificates:\n Key: {keyfile}\n Cert: {certfile}") if config.server.tls_cafile:
ssl_config["ssl_ca_certs"] = config.server.tls_cafile
ssl_config["ssl_cert_reqs"] = ssl.CERT_REQUIRED
logger.info(
f"HTTPS enabled with certificates:\n Key: {keyfile}\n Cert: {certfile}\n CA: {config.server.tls_cafile}"
)
else:
logger.info(f"HTTPS enabled with certificates:\n Key: {keyfile}\n Cert: {certfile}")
listen_host = ["::", "0.0.0.0"] if not config.server.disable_ipv6 else "0.0.0.0" listen_host = ["::", "0.0.0.0"] if not config.server.disable_ipv6 else "0.0.0.0"
logger.info(f"Listening on {listen_host}:{port}") logger.info(f"Listening on {listen_host}:{port}")