Merge pull request #47 from begriffs/better-cert

Better self-signed cert and accompanying documentation

README.md

@@ -12,9 +12,19 @@ cabal install -j --enable-tests
 Example usage:
 
 ```sh
-dbapi -p 3000 -d postgres://[user]:@localhost:5432/[database]
+cabal run -p 3000 -d postgres://[auth-role]:@localhost:5432/[database] -a [anonymous-role]
 ```
 
+You will need to provide two database roles (which are allowed to
+be the same). One is called the authenticator role (`auth-role`
+above) which should have enough privileges to read the `auth` table
+in the `dbapi` schema if you intend to support multi-user applications.
+
+The other role is for anonymous access (`anonymous-role` above).
+Immediately upon acceping any unauthenticated HTTP connection dbapi
+assumes this role in its queries to postgres. Give this role as
+much or little permissions as you would like.
+
 ### Running tests
 
 ```sh
@@ -23,3 +33,11 @@ createdb -O dbapi_test -U postgres dbapi_test
 
 cabal test --show-details=always --test-options="--color"
 ```
+
+### Accessing server on localhost
+
+Dbapi permits only secure https access. By default it uses a
+self-signed key which will cause Chrome and other rest clients to
+complain. You will need to configure your system to trust this key.
+On mac follow [these
+instructions](http://www.robpeck.com/2010/10/google-chrome-mac-os-x-and-self-signed-ssl-certificates/).

src/Main.hs

@@ -25,7 +25,7 @@ argParser = AppConfig
     <> help "path to SSL cert file")
   <*> strOption (long "sslkey" <> short 'k' <> metavar "PATH" <> value "test/test.key"
     <> help "path to SSL key file")
-  <*> strOption (long "anonymous" <> short 'a' <> metavar "ROLE" <> value "dbapi_anon"
+  <*> strOption (long "anonymous" <> short 'a' <> metavar "ROLE"
     <> help "postgres role to use for non-authenticated requests")
 
 main :: IO ()

test/test.crt

@@ -1,20 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIIDRDCCAiwCCQD/S2JyvJS0tjANBgkqhkiG9w0BAQUFADBkMQswCQYDVQQGEwJV
-UzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzET
-MBEGA1UEChMKTG9vcCBSZWN1cjETMBEGA1UEAxMKSm9lIE5lbHNvbjAeFw0xNDA5
-MjkxODU2MTFaFw0xNTA5MjkxODU2MTFaMGQxCzAJBgNVBAYTAlVTMRMwEQYDVQQI
-EwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRMwEQYDVQQKEwpM
-b29wIFJlY3VyMRMwEQYDVQQDEwpKb2UgTmVsc29uMIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEAveoymmQBbtw9CqgWRIuV4YSxqRqitew6EmGdBcrz5hii
-n78KwpB6c3U5pQknTh+eVDiifB3CBghC9ns5XiCMseXbaKaliJFo6BTyAWglkk12
-ckbqodzceBqeCiRDZnHXgA17fTnxS8igw2Ov1pv1aKdoW+FO9aSqCetKAm0xsDfz
-Mfq9XBNJ4eN/aBxJCFS4vO0HFoFtWAAFUF4/fGoAZv65rNkR74Z/y26gJ58FKq6i
-NaUnBgZgZ+5Odi9ZTv+yZdIP6Abl3iC85S7vCtcRNWlcphhC6pFv7sLvurzKd2In
-l2I/iwSHm+La5QVnkS182EMe+IAZYyIVWkP9LEHRHwIDAQABMA0GCSqGSIb3DQEB
-BQUAA4IBAQAPC/8nMuq5Gvd0Ds880jpm6NnSeU0AiRsgmIwmaawofVYOze0MT+Ix
-/i9rDxo8LxwptEZCYXO6DEZq8yjSVGGccM+VOcj7bfxh2UqAfP6j+6H836nOY7Bk
-FDs2Q1sazx+YmsxaBLyyOoBK+6qDqDm4B4Bo3cl8s4eZf2i0yC0sOuO0PYyreX7y
-jFk7ELS7uA8ch1fPqp0WPn8rYvYUZKSKa7Q2Qu0ai+bciAMLYQNkpYFwbfLLHXwN
-/EqLAYrsGGiYU+VNtjrsknF0rxQieUQhoomdia/g3NMBoXSALqJoOaETW3e2DLHQ
-usaxg3L90+kmZDjfDS4DTH4gCx5pL0L1
+MIICLTCCAZYCCQCj6GtISfdwNjANBgkqhkiG9w0BAQUFADBbMQswCQYDVQQGEwJV
+UzELMAkGA1UECBMCQ0ExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xEzARBgNVBAoT
+Ckxvb3AgUmVjdXIxEjAQBgNVBAMTCWxvY2FsaG9zdDAeFw0xNDEwMDMyMDQyNDNa
+Fw0xNTEwMDMyMDQyNDNaMFsxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQG
+A1UEBxMNU2FuIEZyYW5jaXNjbzETMBEGA1UEChMKTG9vcCBSZWN1cjESMBAGA1UE
+AxMJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5gFnTRBge
+mXdkCMD+OycujZrCWOOLIDBqRr7kDbxVXqz/TKHRVx6bz88g9egzvR2HLyA418kd
+dAu+lMmjrRv/k0Lnk/UvC1aj0huoHpOVUgOwy3qS4cE663uU5qsrgf4RDP7bLDcQ
+FDW02SQ2n5ryv8nB9TSYpvQvYPiTMMKdrwIDAQABMA0GCSqGSIb3DQEBBQUAA4GB
+AAQwkC+GSaGArAKdMIqs8/55KAjyNd11MupiCWsu1cwBJ4QJc1PxrYOMLMYnU06J
+I0v1bJ6mG06/Js0r2FHM0NXSQO+7DLPWu4LchoBgFt4ZRm2+GbLzFrfu41yn5mJN
+VeUxCBQ9hOrE8Kwe+/9IUUVPxlISF+YHOyF3DxWUViak
 -----END CERTIFICATE-----

test/test.key

@@ -1,27 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIEogIBAAKCAQEAveoymmQBbtw9CqgWRIuV4YSxqRqitew6EmGdBcrz5hiin78K
-wpB6c3U5pQknTh+eVDiifB3CBghC9ns5XiCMseXbaKaliJFo6BTyAWglkk12ckbq
-odzceBqeCiRDZnHXgA17fTnxS8igw2Ov1pv1aKdoW+FO9aSqCetKAm0xsDfzMfq9
-XBNJ4eN/aBxJCFS4vO0HFoFtWAAFUF4/fGoAZv65rNkR74Z/y26gJ58FKq6iNaUn
-BgZgZ+5Odi9ZTv+yZdIP6Abl3iC85S7vCtcRNWlcphhC6pFv7sLvurzKd2Inl2I/
-iwSHm+La5QVnkS182EMe+IAZYyIVWkP9LEHRHwIDAQABAoIBAGbG9qm9E1V2lQZO
-Xvarf+pzEF6Ozp2bgPXvo7W91u6gSGohTmZrIAmZ2B9ra70IuXukxrJavGTdVbfk
-ifBZtyqTVYE2JoFZCCgJJcsDHMonZ8GChXohd6L77KlaZKttUo23PixQDjjQE8iK
-C2AeONpxNrX6oeuoOGlzzzKu+2P8g/s3PZT0W3KjiRYYTJOeU4giPvYTrCsNiOTq
-ciaqT7XN/2tfE9xYvVTaHxFMtXRCKQ9u2yBTJ+QIGHuQaB2x0fwj4c98oQTY3ZqP
-nE58p5duG/8nWItLrOwusV9e7hxXPC/qf/vgLUmNfRd0ES4iCIjCRDISpiUsuMdt
-9i+W8cECgYEA7+4S6XLEZv/ADCxf4/ewAxcTyEt4mlRU5thrl2wONbNvyf/fiCxD
-u4NylnLFCb+5TIqgD886TTGj2qAs2q/pyDLDGeD7tsdAi77FI67nT7ady45RmsGr
-oe22M3klgYLsQbgrWOB2FVW6/Ii6wJ82zo6UICU6oAz3nQ2zHgL8sn8CgYEAyqKL
-zM612Qm+Xx6YGuwr8cq77NhXABtlZMwZjb8Q/TvOlwdvH+ERFJsU8p7NXBEXD9vU
-FXOZcHs+iCoMqOsE6V6iY3pvL3Q74PKx5UzB5kNXxdySWbIaRUZlSBFmzGC9/L6e
-zfau6zwf1mn38agxv3fWNgTJryBQQ3oR5VX4UWECgYBI4RUnii/0ZW0thXEfKwZw
-+dqNdbdNkZ40fLq5xR3P3BBx2GJK178/Px9YacZGPtGHWXhjNPwtpI10BEF7sAGg
-SSMQQlHTZFTL3ge93gvvH7ZwtWs+SePbjPxSSFNHMsCW+d1Y4t2bf24L9XBcwEAC
-oDaISSa0pRu1vgqRbDDb+wKBgAeMIFrjhCBuXXnbgNzX2Rcrbu52bF8jphYoB/eg
-mzhjZuF3NGtijalP0WrsAUghltNPY8ncwWVQIdcegdQ01L0AelnsMIH6+VP6liet
-QTebYISNH6JZoOLdqV4Sz9pi7BCi5PVU79TxK1poHgURN7Ei/IaMjRqJwJOS02HQ
-XuxhAoGAZ89zIqlWUkl1jTvUEUMUljiZpCvM3oCWfnGHoLlg5b6G5AESUCTeNVWg
-M3G7KBWJ8LzjezX1SUBP8gr1TZYlT15BXmpYAOrTGPBvsi8ajtvXWK+RO40ywAbp
-zsSgwB4J8gaggb6z6XqbQhMeuNmhzKV4hHXy2Eu08ApgXuPIp7M=
+MIICXQIBAAKBgQC5gFnTRBgemXdkCMD+OycujZrCWOOLIDBqRr7kDbxVXqz/TKHR
+Vx6bz88g9egzvR2HLyA418kddAu+lMmjrRv/k0Lnk/UvC1aj0huoHpOVUgOwy3qS
+4cE663uU5qsrgf4RDP7bLDcQFDW02SQ2n5ryv8nB9TSYpvQvYPiTMMKdrwIDAQAB
+AoGAZZD0Haub9S0b5KayXMCwnFmmEaEvvR47xATGQgGPS8LRv9sKgp9LwA4RH7/k
+imeSglD4OIdVs421XH0ExlxjBiV5EzTCgLUyKbfA//xUy9ggXD1Ks4vIHL0c1DM4
+g6/zylN7CQtt4Bb6YdWDSAUXIl3U5Dj1kG7BWuXfJTxCx7ECQQDyLxoQRNkPwKP/
+xeOqfCgwyD52rnUJ7g9UViFcCU2ZLLEYxE4b3FECcwhOfUlxYvKdOx03Qts0taow
+dPU/BEXHAkEAxBVyKwTJ0T6rQmcQEx3WuaBhSjXgZigUN4OdXMg+LSO+1MON6Nhm
+J9ociy+xvfd0Cf3yABaAEU/hZ+Pmk2DI2QJBAO/XU8F+3VQrXH7l9HSXJppBBRM1
+7HScDRRhhAIIuI+UYgJ8DjqrMpLxZu2MSBqBenHZ5DIhBMOrkVMR0PrKeWsCQCHh
+gsSkIysgpP7oSALFmSCh8a2c+ZUtP7EH8NzjTLsH/iVNVOvy2FPygBQcvZ2RcF95
+naMeQCq9nrkQy/qTMqECQQDa1WjWS2ngwqGzHovqiKRg3lQ8MFNlvlStAQl8+9h0
+KJj8Rl6h+gO8eretBIe+y5j/hCC90xlJotzwO3jJF6Hc
 -----END RSA PRIVATE KEY-----