// Copyright 2019 Oath Inc. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
package com.yahoo.vespa.model.container.http.ssl;

import com.yahoo.config.model.api.TlsSecrets;
import com.yahoo.vespa.model.container.http.ConnectorFactory;

/**
 * Component specification for {@link com.yahoo.jdisc.http.server.jetty.ConnectorFactory} with hosted specific configuration.
 *
 * @author bjorncs
 */
public class HostedSslConnectorFactory extends ConnectorFactory {

    public HostedSslConnectorFactory(String serverName, TlsSecrets tlsSecrets) {
        this(serverName, tlsSecrets, null);
    }

    public HostedSslConnectorFactory(String serverName, TlsSecrets tlsSecrets, String tlsCaCertificates) {
        super("tls4443", 4443, createSslProvider(serverName, tlsSecrets, tlsCaCertificates));
    }

    private static ConfiguredDirectSslProvider createSslProvider(
            String serverName, TlsSecrets tlsSecrets, String tlsCaCertificates) {
        return new ConfiguredDirectSslProvider(
                serverName,
                tlsSecrets.key(),
                tlsSecrets.certificate(),
                /*caCertificatePath*/null,
                tlsCaCertificates,
                "disabled");
    }

}

@@ -203,16 +203,61 @@
 ecrets;%0A
+import com.yahoo.jdisc.http.ConnectorConfig;%0A
 import c
@@ -311,16 +311,40 @@
 ctory;%0A%0A
+import java.util.List;%0A%0A
 /**%0A * C
@@ -558,16 +558,109 @@
 tory %7B%0A%0A
+    private static final List%3CString%3E INSECURE_WHITELISTED_PATHS = List.of(%22/status.html%22);%0A%0A
     publ
@@ -1390,17 +1390,415 @@
    %22
-disabled%22
+want%22);%0A    %7D%0A%0A    @Override%0A    public void getConfig(ConnectorConfig.Builder connectorBuilder) %7B%0A        super.getConfig(connectorBuilder);%0A        connectorBuilder.tlsClientAuthEnforcer(new ConnectorConfig.TlsClientAuthEnforcer.Builder()%0A                                                       .pathWhitelist(INSECURE_WHITELISTED_PATHS)%0A                                                       .enable(true)
 );%0A 

Enforce client authentication