Repository: trento-project/web
Pull request #3353: Rabbitmq explicit ssl support
Author: login: CDimonaco
Labels: name: enhancement
description: New feature or request
Created: 2025-03-03T15:10:41Z | Merged: 2025-03-03T16:15:49Z

# Description

This PR adds support for RabbitMQ TLS for development and testing purposes.

In production, the RabbitMQ connection is already configured using an environment variable that should be set to an AMQP URI. This URI can include TLS options to connect to secured RabbitMQ brokers. See [RabbitMQ URI Query Parameters](https://www.rabbitmq.com/docs/uri-query-parameters#example-b) for reference.

This PR introduces a TLS bundle—including a custom CA, server, and client certificates—to enable SSL connections in development and testing. By setting the environment variable USE_LOCAL_RABBIT_TLS, the connection switches to an amqps connection in these environments.
Example Usage

`USE_LOCAL_RABBIT_TLS=true iex -S mix`

This starts the IEx shell in development mode, using an SSL connection to the RabbitMQ instance exposed via Docker Compose. The broker supports both TLS and non-TLS connections simultaneously.

This capability will also be extended to other components of Trento. They will share the same CA, enabling interconnection between all components in development mode over SSL. Additionally, all RabbitMQ servers exposed through Docker Compose will support secure connections for all parties.

Fixes # (issue)

## Did you add the right label?

Remember to add the right labels to this PR.
- [X] **DONE**

## How was this tested?

Describe the tests that have been added/changed for this new behavior.
- [X] **DONE**
## Did you update the documentation?

Remember to ask yourself if your PR requires changes to the following documentation:

- [Manual installation guide](https://github.com/trento-project/docs/blob/main/guides/manual-installation.md)
- [Trento Ansible guide](https://github.com/trento-project/ansible/blob/main/README.md)
- [Trento Web guides](https://github.com/trento-project/web/tree/main/guides)

Add a documentation PR or write that no changes are required for the documentation.
- [X] **DONE**



Diff:
diff --git a/config/dev.exs b/config/dev.exs
index b2f0ea986f..25523ebac7 100644
--- a/config/dev.exs
+++ b/config/dev.exs
@@ -96,21 +96,28 @@ unless IEx.started?() do
     ]
 end
 
+amqp_connection =
+  if System.get_env("USE_LOCAL_RABBIT_TLS") do
+    "amqps://trento:trento@localhost:5671?certfile=container_fixtures/rabbitmq/certs/client_web.trento.local_certificate.pem&keyfile=container_fixtures/rabbitmq/certs/client_web.trento.local_key.pem&verify=verify_peer&cacertfile=container_fixtures/rabbitmq/certs/ca_certificate.pem"
+  else
+    "amqp://trento:trento@localhost:5673"
+  end
+
 config :trento, Trento.Infrastructure.Messaging.Adapter.AMQP,
   checks: [
     consumer: [
-      connection: "amqp://trento:trento@localhost:5673"
+      connection: amqp_connection
     ],
     publisher: [
-      connection: "amqp://trento:trento@localhost:5673"
+      connection: amqp_connection
     ]
   ],
   operations: [
     consumer: [
-      connection: "amqp://trento:trento@localhost:5673"
+      connection: amqp_connection
     ],
     publisher: [
-      connection: "amqp://trento:trento@localhost:5673"
+      connection: amqp_connection
     ]
   ]
 
diff --git a/config/test.exs b/config/test.exs
index 76849f67f8..ed178de6fd 100644
--- a/config/test.exs
+++ b/config/test.exs
@@ -51,6 +51,13 @@ config :trento,
   api_key_authentication_enabled: false,
   jwt_authentication_enabled: false
 
+amqp_connection =
+  if System.get_env("USE_LOCAL_RABBIT_TLS") do
+    "amqps://trento:trento@localhost:5671?certfile=container_fixtures/rabbitmq/certs/client_web.trento.local_certificate.pem&keyfile=container_fixtures/rabbitmq/certs/client_web.trento.local_key.pem&verify=verify_peer&cacertfile=container_fixtures/rabbitmq/certs/ca_certificate.pem"
+  else
+    "amqp://trento:trento@localhost:5673"
+  end
+
 config :trento, Trento.Infrastructure.Messaging.Adapter.AMQP,
   checks: [
     consumer: [
@@ -58,7 +65,7 @@ config :trento, Trento.Infrastructure.Messaging.Adapter.AMQP,
       exchange: "trento.test.checks",
       routing_key: "results",
       prefetch_count: "10",
-      connection: "amqp://trento:trento@localhost:5673",
+      connection: amqp_connection,
       queue_options: [
         durable: false,
         auto_delete: true
@@ -70,7 +77,7 @@ config :trento, Trento.Infrastructure.Messaging.Adapter.AMQP,
     ],
     publisher: [
       exchange: "trento.test.checks",
-      connection: "amqp://trento:trento@localhost:5673"
+      connection: amqp_connection
     ],
     processor: GenRMQ.Processor.Mock
   ],
@@ -80,7 +87,7 @@ config :trento, Trento.Infrastructure.Messaging.Adapter.AMQP,
       exchange: "trento.test.operations",
       routing_key: "results",
       prefetch_count: "10",
-      connection: "amqp://trento:trento@localhost:5673",
+      connection: amqp_connection,
       queue_options: [
         durable: false,
         auto_delete: true
@@ -92,7 +99,7 @@ config :trento, Trento.Infrastructure.Messaging.Adapter.AMQP,
     ],
     publisher: [
       exchange: "trento.test.operations",
-      connection: "amqp://trento:trento@localhost:5673"
+      connection: amqp_connection
     ],
     processor: GenRMQ.Processor.Mock
   ]
diff --git a/config/wanda.exs b/config/wanda.exs
index a5c58c834c..2db43b85e2 100644
--- a/config/wanda.exs
+++ b/config/wanda.exs
@@ -2,20 +2,27 @@ import Config
 
 import_config "dev.exs"
 
+amqp_connection =
+  if System.get_env("USE_LOCAL_RABBIT_TLS") do
+    "amqps://wanda:wanda@localhost:5676?certfile=container_fixtures/rabbitmq/certs/client_web.trento.local_certificate.pem&keyfile=container_fixtures/rabbitmq/certs/client_web.trento.local_key.pem&verify=verify_peer&cacertfile=container_fixtures/rabbitmq/certs/ca_certificate.pem"
+  else
+    "amqp://wanda:wanda@localhost:5674"
+  end
+
 config :trento, Trento.Infrastructure.Messaging.Adapter.AMQP,
   checks: [
     consumer: [
-      connection: "amqp://wanda:wanda@localhost:5674"
+      connection: amqp_connection
     ],
     publisher: [
-      connection: "amqp://wanda:wanda@localhost:5674"
+      connection: amqp_connection
     ]
   ],
   operations: [
     consumer: [
-      connection: "amqp://wanda:wanda@localhost:5674"
+      connection: amqp_connection
     ],
     publisher: [
-      connection: "amqp://wanda:wanda@localhost:5674"
+      connection: amqp_connection
     ]
   ]
diff --git a/container_fixtures/rabbitmq/certs/ca_certificate.pem b/container_fixtures/rabbitmq/certs/ca_certificate.pem
new file mode 100644
index 0000000000..91a7dc4a40
--- /dev/null
+++ b/container_fixtures/rabbitmq/certs/ca_certificate.pem
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDhDCCAmygAwIBAgIUT+fjcUNf2/pY0GNGRN/vWIpDSeMwDQYJKoZIhvcNAQEL
+BQAwSzE6MDgGA1UEAwwxVExTR2VuU2VsZlNpZ25lZFJvb3RDQSAyMDI1LTAzLTAz
+VDEwOjM3OjU2Ljg3OTIyMTENMAsGA1UEBwwEJCQkJDAeFw0yNTAzMDMwOTM3NTZa
+Fw0zNTAzMDEwOTM3NTZaMEsxOjA4BgNVBAMMMVRMU0dlblNlbGZTaWduZWRSb290
+Q0EgMjAyNS0wMy0wM1QxMDozNzo1Ni44NzkyMjExDTALBgNVBAcMBCQkJCQwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZgsap/8SHXve2r6JyTWnA8RbJ
+A5Y4n5aoRFinL0blWvV7cvDERH2rF/w41nmjosCbcwxHP/8FQMybBQD1AAeFy7Lo
+qcWHFBGdOCAi3nInIH/l2NSHQGpbaXL/Z/FBCyfee71ncCk4oPoE2sKkbkcr4mF7
+E2iBXS+8PGvIT1pZJqgLYnhRzrp+R8ZVepbINrbrcv+Enk2OmscW76g/u0uK/Cnb
+6vSkwHfp1JDKXBxV7iqtzYPsExoIJFWflkVDFb9alrzbbY/nAbWOnVbMCBn3x4QV
+hx5RoOz3GlvPKsyi0Kh+hd7MGZQzTnvWeNcsoRBbjGk0BzEU0wjZJo8kDHtRAgMB
+AAGjYDBeMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMB0GA1UdDgQWBBRs
+gbKvb+hOIowXdooRXurw86E/JDAfBgNVHSMEGDAWgBRsgbKvb+hOIowXdooRXurw
+86E/JDANBgkqhkiG9w0BAQsFAAOCAQEAAMrCUgWRsQhQF/qQNTzxmA3jSVQutcJB
+Osf51LCYMCP0egdK5tXe1FtpSZ8pa4ffVtEtYPBk5kah1HiBasd9dW30rChUO99j
+AhZ3dHxw6nCItMQKQ968PgsZ7HX968if7IejKK2rkNRgmTlPLUiYg9dwXd/mRPYH
+KRD6yClMMUIsJ0GFPjON6HeskFot3QPiROzBGMgH42aqf4CKNMScOwplTXR3Uxm2
+pzBHqGiHRcpfdeE8SEKeFE5uDQBvdx8RxlvGta01PP7sfTUkYe5OVSYxLYtsxI30
+8O6Zh6JoH4bsYjakWzKuiQvIbjy4BoMw/zQngMs3hmQEVs9zHtubHg==
+-----END CERTIFICATE-----
diff --git a/container_fixtures/rabbitmq/certs/ca_key.pem b/container_fixtures/rabbitmq/certs/ca_key.pem
new file mode 100644
index 0000000000..117356be86
--- /dev/null
+++ b/container_fixtures/rabbitmq/certs/ca_key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDZgsap/8SHXve2
+r6JyTWnA8RbJA5Y4n5aoRFinL0blWvV7cvDERH2rF/w41nmjosCbcwxHP/8FQMyb
+BQD1AAeFy7LoqcWHFBGdOCAi3nInIH/l2NSHQGpbaXL/Z/FBCyfee71ncCk4oPoE
+2sKkbkcr4mF7E2iBXS+8PGvIT1pZJqgLYnhRzrp+R8ZVepbINrbrcv+Enk2OmscW
+76g/u0uK/Cnb6vSkwHfp1JDKXBxV7iqtzYPsExoIJFWflkVDFb9alrzbbY/nAbWO
+nVbMCBn3x4QVhx5RoOz3GlvPKsyi0Kh+hd7MGZQzTnvWeNcsoRBbjGk0BzEU0wjZ
+Jo8kDHtRAgMBAAECggEAAkoJ0Lq4JQuXFFVjYowVh5oR+RIgV964HXPAshvBhYLw
+T/kM9yfYYb9aIHgDZjk9iTVMBQjzpGjC7oO+N5XlPl9/NcspoMsRh2PSlMNeFLLX
+HcJrNDQ1mloxA2ai56IYLJOFUgwgZu/sybXKtCPT/G6Aw6SX5jqmmLbTFJPfOc51
+IDTTyEn3re+NHoZa6bsjFrdj0TvLMEKL+mUbns1aFD95dBwSaEnpBz8dSmfPOmPZ
+IlpnwIdcWO0vfFBXIlLL/0oyweTndN1eWFTcYVjg+yf3fcjMIyvliu1gNAIT1vCz
+NUE43K/YlSbsiWiyyL/98syNeFjFbCxaeSe/uJzQhQKBgQD1qDZq0bAgSGWPaCTM
+j46a8+lBQhLTD1Gt+3MLPXMmwL5VI1UhWO0In6Jm0bjPTAhd4v142+Cdc9ZCUC41
+0ptmOFd4zX/7hIMZT4mpCgCDnJ+3fG30tEwsmymiwtwDOKTdbAKPDSLhFzEkKFVP
+H5qtTDs1htLKzXHv0jXtJUP4RQKBgQDiqzFAxMg6rO/VeOWKWgqfl/mh0jsnVwV1
+6o5Ue5CnlT16UKdy2WTmdpaLwvg+lSSbohB9xdUwS1ys91K9E4feb9ZmErFqh9wn
+oaIfERS77AQFeehK785opdRIE4imVaZ+6SffahQy4On2CYos3DWKwe6nmu3IASE0
+rKsWlmJlnQKBgQDXC0unsqu1durA4O/lyn2Rk5dLMyX7cNuVrBqHamGVOQDk0qtB
+J/FHrUajL0/S18IzPfOZixFThAW5wyrQnu6+Su/3ph009kk1LPVa7pCIpeEC5H/0
+yKguHB4UhvPGNh3MXzLWOy+fT4gLGOuk+guTTLpAHygDtFjbEW93izm26QKBgQDX
+S/XfaEoreWHgqRGWBQp8JlUlQFORfVWhd+YzFp8Cnn2jdYJnU1hEkzVRkSJMB0ub
+TCdP354sXhir7cs37poqTJ4fm/fKkTsqpZsg2Q+Ro476SJ28t+Sdf42P3IX6P/aC
+KyIFUnPXE80GNm95RrzQjH4L0tuyEmig6LUlIjhZ/QKBgQDgtn6yayu2a+Y5itt2
+/oDRpKAj0vL/XkyZJ0njj4arATjm9ePuMPm0n/bHKKbhjw4Ng0n5soD9BHbRde7F
+EH7EvTkzUsGW+7+MKc7vKK+3ncGBjWd2a8sG57LzIJueRh0O3mwvQKS6pQ6t6Xwm
+3vEF7nfSUnxKtDkss5l7ckn1Ig==
+-----END PRIVATE KEY-----
diff --git a/container_fixtures/rabbitmq/certs/client_web.trento.local_certificate.pem b/container_fixtures/rabbitmq/certs/client_web.trento.local_certificate.pem
new file mode 100644
index 0000000000..05a82e696b
--- /dev/null
+++ b/container_fixtures/rabbitmq/certs/client_web.trento.local_certificate.pem
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDxzCCAq+gAwIBAgIBAzANBgkqhkiG9w0BAQsFADBLMTowOAYDVQQDDDFUTFNH
+ZW5TZWxmU2lnbmVkUm9vdENBIDIwMjUtMDMtMDNUMTA6Mzc6NTYuODc5MjIxMQ0w
+CwYDVQQHDAQkJCQkMB4XDTI1MDMwMzA5MzkxN1oXDTM1MDMwMTA5MzkxN1owLDEZ
+MBcGA1UEAwwQd2ViLnRyZW50by5sb2NhbDEPMA0GA1UECgwGY2xpZW50MIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq3u0NeQOF5c94Eqy4lBcdYd+Cfi/
+YAPRXEVrXwk5iOGAgKb+dnUsQaTsIzA9ZzovA4eO2xf7pMvRfPapb0JtT2CFZzbp
+7JK08C1IcKYFE2BFIht+ihLsXFESqweQbKZs7E62GN/BRTRcy+s+QUGuNqsHccD6
+1yP6G+qV5+6sKX047egiWhU8a3/iDqFXslcvjlJZZBePeh/udFXZwBqDcQWKSTjC
+i9KYh8QOyDB/Uxxcnsgp37B4zdsLgAEd5I79/MfcGNVPq09fGwtQxZ7HGiGp1Mag
+h2RRn0itQPu9wNSFZhpyY+I1tHxrJOV5A1FJTQql1c678wB73fjCQufsjQIDAQAB
+o4HUMIHRMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUF
+BwMCMC8GA1UdEQQoMCaCEHdlYi50cmVudG8ubG9jYWyCB21hdHJvbmGCCWxvY2Fs
+aG9zdDAxBgNVHR8EKjAoMCagJKAihiBodHRwOi8vY3JsLXNlcnZlcjo4MDAwL2Jh
+c2ljLmNybDAdBgNVHQ4EFgQUK/hDKv+8ANVpaIcXyWTmWl/uHo0wHwYDVR0jBBgw
+FoAUbIGyr2/oTiKMF3aKEV7q8POhPyQwDQYJKoZIhvcNAQELBQADggEBAD94DQ5X
+6Bwe3gR2TVgRXU0yYx/oH7jo3hsgGJBnXhmVJXn8fLSIZ60Jt2izcN9rSAD8t35g
+8vHy0Zkk/tyyakBnko24q93pxBAO6O6xuc2wolRkkLHRULHXyav80+aBo6VMpLP+
+ahpIQk8uDqxlEY5i4tbfIpQY3r132e6yCZPVBUHGti5D+z9SImNhpWH9RhYcXk3z
+UqI9X4uAHs9E2v3hbk3lAX+vwYBB5DZakUcckATKMklxPydyEcUvUupaO/2IYeqy
+92YRr3unh7UzuB1Pv0C06N0IrSOHe1WQSLEug9FzS9/UezEe6qAPda5LXJCUbQ6i
+Et5i0JgoeroaJOY=
+-----END CERTIFICATE-----
diff --git a/container_fixtures/rabbitmq/certs/client_web.trento.local_key.pem b/container_fixtures/rabbitmq/certs/client_web.trento.local_key.pem
new file mode 100644
index 0000000000..8a37ac91e9
--- /dev/null
+++ b/container_fixtures/rabbitmq/certs/client_web.trento.local_key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCre7Q15A4Xlz3g
+SrLiUFx1h34J+L9gA9FcRWtfCTmI4YCApv52dSxBpOwjMD1nOi8Dh47bF/uky9F8
+9qlvQm1PYIVnNunskrTwLUhwpgUTYEUiG36KEuxcURKrB5BspmzsTrYY38FFNFzL
+6z5BQa42qwdxwPrXI/ob6pXn7qwpfTjt6CJaFTxrf+IOoVeyVy+OUllkF496H+50
+VdnAGoNxBYpJOMKL0piHxA7IMH9THFyeyCnfsHjN2wuAAR3kjv38x9wY1U+rT18b
+C1DFnscaIanUxqCHZFGfSK1A+73A1IVmGnJj4jW0fGsk5XkDUUlNCqXVzrvzAHvd
++MJC5+yNAgMBAAECggEAIQWgER2iwhO3kGTKGE8x0tcd5BUw4zAxBZP/pmwsFmoY
+WQ3vZAfR1y1HZMpSFLoNWiBlV9cBOD2gkHAediSkUJwNbHAUcWBZ9ANAVyL9SLsp
+7PS+9B9LQUbCcclx3B5bTNEme1lBSk6YTRN2qFHZ1sCuHQ90rm/I5s3QgrqBEDby
+ffc4qJ3Em7g/7FqB0uqKf1DncURR5cofpXU4s7Z3bhqu88z1GDVq2sgzV6MWxrBh
+L88D3gTTPdz3EPzTEr9MWeodE3WXPKwBgTMKLqpZM+CBLdyXbe+ZkhDdNqCN/7kJ
+1IR/cqxqF/BSNQFXU/qb9EJ1sSC67T6h3nn+7jEkuQKBgQDYaPbM82S/AXHj5BIp
+httvpzxmOpjelZLfkp9LaG9AjDAs12ypvKXJN7Hxhj/S78cG7WWsNRTKaiApStLk
+Qn1Rz8bnUruxzcQvvBP06tGQiZoh4J0mF7/OeccsdCLV45J+o8FcuusZPBKc7F/A
+oA5tfab/sRWPe/45NthZCUjnWQKBgQDK2rPolMsWxJ/WjD4RV3A4LKzJs5GQDe/P
+qtcVqgHDYHJ0c/RQU1iK7bAlYoyn1BQYmJ4uOvDu5YyGJVceQIwPK/cAZURT2H97
+b12bZyrKNVrbi5klRQIhwWqoHhPgVopTXSKVwBfCZLK6BpHlAggzhPnasyKAcIwB
+6VgdekR8VQKBgDAJ/N86GF8eHv4LnsyBFy0N3qaC03R1l4jxr1K5+BhIBlmt6H01
+V0f3iRSoTHqyp2euQyebEOZt8H26El6BM/h5OxoWj3vExYwjH/r6NVL0eLaUec3+
+76ER/1iq3yDDx7089Kt1AsMzRp53CjpkTU+Y2P1hffu/9osU1anOGdThAoGAG9Um
+GiNQOi+APs+/NGHq48o9au9YaYt/+95U5IQO+d+h1JiUTPEilO1H3dlHsz9GApnu
+Gim8JQsZ3M4CxgPVM7+0hDlgxqBN3YHKNihRlqz7amQc/yAYysje+XInCADXudht
+hl505Bcs7pk4K1O8DFWSco9hjH3kt95sWJ8OBoECgYBnBzZ9fuHKQPttB+rfHDCk
+xg555vZ+bXxzm/HZXcmm12+2Vi5ms6MrimNBNPeifNChyLec9q95ZDBNbS93F7tV
+5WOIKIkiFB4Yrnkvp5QNh8iqFfZYHft+DUuWcKlRJb9MvIEbeDs4IhDWKGm7vXEt
+y8U5g2ar5U6pyEjyLtOUMw==
+-----END PRIVATE KEY-----
diff --git a/container_fixtures/rabbitmq/certs/server_rabbit.trento.local_certificate.pem b/container_fixtures/rabbitmq/certs/server_rabbit.trento.local_certificate.pem
new file mode 100644
index 0000000000..fd40a19c8a
--- /dev/null
+++ b/container_fixtures/rabbitmq/certs/server_rabbit.trento.local_certificate.pem
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDzTCCArWgAwIBAgIBATANBgkqhkiG9w0BAQsFADBLMTowOAYDVQQDDDFUTFNH
+ZW5TZWxmU2lnbmVkUm9vdENBIDIwMjUtMDMtMDNUMTA6Mzc6NTYuODc5MjIxMQ0w
+CwYDVQQHDAQkJCQkMB4XDTI1MDMwMzA5Mzc1NloXDTM1MDMwMTA5Mzc1NlowLzEc
+MBoGA1UEAwwTcmFiYml0LnRyZW50by5sb2NhbDEPMA0GA1UECgwGc2VydmVyMIIB
+IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA20PhTu6/0mGDyJlsP766YCEM
+hpZtwvGIvBrR3UiQnRLP8QvI8zRzeYy4SkoL+dOwsBWmKsu08tuUuG+k8pSI5+1O
+5xzz/RcEh70De6KvJczDu4xysgEcj53K2DVGzzPISLrXjsLx/Twk3FaXimzn5m/l
+1sUi4/J7ojKakD7ZM53I90jhFVHVWsgLXveeOVE9QBdG3MyY44P/TaLjXaaQM1iM
+mPz1ZstfaJzb+y36Ov6crA2vpH63a9yp9uno2gS67Q/IbxFFkoOi51fodjbcuSr4
+s8NwcAuZ4/BOENhgcVO/lbo15B2YXn4rr3znqemPscogi/Qp2gMNRlZUIigMUwID
+AQABo4HXMIHUMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgWgMBMGA1UdJQQMMAoGCCsG
+AQUFBwMBMDIGA1UdEQQrMCmCE3JhYmJpdC50cmVudG8ubG9jYWyCB21hdHJvbmGC
+CWxvY2FsaG9zdDAdBgNVHQ4EFgQU0iOsLX+IGvvrGF3LjjGwRAVpmagwHwYDVR0j
+BBgwFoAUbIGyr2/oTiKMF3aKEV7q8POhPyQwMQYDVR0fBCowKDAmoCSgIoYgaHR0
+cDovL2NybC1zZXJ2ZXI6ODAwMC9iYXNpYy5jcmwwDQYJKoZIhvcNAQELBQADggEB
+AFtkVoQHK2RkKVT5IiLnzSPySYkAicFcUjp6exN2fG5yLdlIYnHgeGFLJLV2l4As
+ZnQbI/8BPkNXRNctGe8DHZtjf+78tt/lSv9EQrko9zjuTgnnr0CKt5Mdhp3MPz39
+gNpxD57Thy0UBC0OHDDPs9QIJbT3yihWnjxHGRRz1WJ6tt3p7yq+F5FYuDqRJLCc
+1Zm/8iFVHehrkLrCoLO9q10NdXLkOPw6A8dwmIjN6jR7wLe5VN1LJaXPkls/4YMt
+g0jAdYYyO9uvSLOmiy4qeupjHnDcW4oYTsMxTqq9BWjXKCC6LvzO9XPgHfZ2P6Db
+pmHSH98acLEUzOTfSGc7oHw=
+-----END CERTIFICATE-----
diff --git a/container_fixtures/rabbitmq/certs/server_rabbit.trento.local_key.pem b/container_fixtures/rabbitmq/certs/server_rabbit.trento.local_key.pem
new file mode 100644
index 0000000000..7c65cbb1f8
--- /dev/null
+++ b/container_fixtures/rabbitmq/certs/server_rabbit.trento.local_key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEugIBADANBgkqhkiG9w0BAQEFAASCBKQwggSgAgEAAoIBAQDbQ+FO7r/SYYPI
+mWw/vrpgIQyGlm3C8Yi8GtHdSJCdEs/xC8jzNHN5jLhKSgv507CwFaYqy7Ty25S4
+b6TylIjn7U7nHPP9FwSHvQN7oq8lzMO7jHKyARyPncrYNUbPM8hIuteOwvH9PCTc
+VpeKbOfmb+XWxSLj8nuiMpqQPtkzncj3SOEVUdVayAte9545UT1AF0bczJjjg/9N
+ouNdppAzWIyY/PVmy19onNv7Lfo6/pysDa+kfrdr3Kn26ejaBLrtD8hvEUWSg6Ln
+V+h2Nty5Kvizw3BwC5nj8E4Q2GBxU7+VujXkHZhefiuvfOep6Y+xyiCL9CnaAw1G
+VlQiKAxTAgMBAAECggEADD15VekxDyL/ctLRvqs8h0JBC0BZh0Dpg6qxnXtAC2yx
+7ABe6ui6K4ZmAUup6HvfSK0ktg3iH46Pek5NNHeDPwM53N/6ZN4ElDlCeQPnaCJK
+qO0ZuAMk34WM/c3XkpiO7TR09RS/4oWZfy1cT09uEKideYROws/WBAN0Kmo/wMhL
+K/Ah0ad1gHMLP11CLeZ3YECjyYWsYLIk0IAFoHx+8TbtVPwmko+Pd/xcVE5tYdms
+exg0YKDWhWkYz6sTgZ9QNeSNaYiuhhiq7JMEwImUXQzu616+YnT5C8w4vZC5rxaa
+x1DmeTjjXBoSeuDdoeWDWmENtIIM6MoRoF9wM3ADSQKBgQDwBkjYrTXuI2ocCGok
+512OrcK6Ll1Z70s2dytD9bYLvfllOlgQBrsVH7M8v0oYjOH/EQJRWnvyJuvCdZM7
+yVqEthK1htVGIl7KUpNWnxy6Oo/iocsP9yyO4WnCWjmQDLLMNfxnq9ZvzeVAmVp7
+GUEoWMnIozs2c0i8z4256GwNuwKBgQDp2+G3UlzUA8r5xUk/BUj+9NpEYwpQvI5T
+ueTyvpgBWO+3hbnQcC7vzh6+x9H9cL2aTE+GZVsISXsoUU8tNWnzy4ZpWqKlSsOv
+hkCTaSZRMXBMl/57VAFCldZQQBY1EFMmHFgLBMlozTwOmgvbUMvc8lIsEOeYIaFE
+/gnz+dVGSQKBgEnOJOg7mrG3QhGMpNbkLeiJla8aQqo84qvEyREEpQ3HRMDTx/Bl
+oXFFZh/v0iDqcTO1Tzkk0agMP8Jz1Oo1aBgWxHn9E+eU+gDMk3G3S2YYS9YsWfx2
+zMTCm3qfs8OPpAsXLp3SQQXwEeZjQWdIxLhbVPDVAIgluuAUEkhwJ4mxAn9Oj49E
+Bmco0h1dyujQQvZCr/6i+qJ8fNtTRR+kbGKkETx2anYBj6404QlzDa19dmI7c2dD
+vsjV/9lfsfDnPwpY3AZLXidFX9hdHrySyMAWhoUzNdxHkfDabXuRefX73YARTXRG
+P1Vp34hNX3KcOohBsSXpp8QlVybWBoFRdJwxAoGAa+XpAG8tQi8aVJIXMB0S9IWG
+X742QYup0ztlGpgrkA8bRWmPrccnByhrsOZn8kIxY/McVSQ+C5RB2K4uYBgiYRy/
+p+l6zQbZQyrkvOjwitpzTmVuCl2nGXi0os6U5j+2oD4xs0z6kdQ/eAs4NuuhxA8B
+R90hQlTplI1AI9KKzLA=
+-----END PRIVATE KEY-----
diff --git a/container_fixtures/rabbitmq/rabbitmq.conf b/container_fixtures/rabbitmq/rabbitmq.conf
new file mode 100644
index 0000000000..e74b693112
--- /dev/null
+++ b/container_fixtures/rabbitmq/rabbitmq.conf
@@ -0,0 +1,6 @@
+ssl_options.cacertfile           = /etc/ssl/certs/ca_certificate.pem
+ssl_options.certfile             = /var/lib/rabbitmq/server_rabbit.trento.local_certificate.pem
+ssl_options.keyfile              = /var/lib/rabbitmq/server_rabbit.trento.local_key.pem
+ssl_options.verify               = verify_peer
+ssl_options.fail_if_no_peer_cert = true
+listeners.ssl.default            = 5671
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 31033e258d..586f269411 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -65,8 +65,14 @@ services:
       - pg_data:/var/lib/postgresql/data
       - ./container_fixtures/keycloak/init_keycloak_db.sh:/docker-entrypoint-initdb.d/init_keycloak_db.sh
   rabbitmq:
+    volumes:
+      - ./container_fixtures/rabbitmq/certs/ca_certificate.pem:/etc/ssl/certs/ca_certificate.pem
+      - ./container_fixtures/rabbitmq/certs/server_rabbit.trento.local_key.pem:/var/lib/rabbitmq/server_rabbit.trento.local_key.pem
+      - ./container_fixtures/rabbitmq/certs/server_rabbit.trento.local_certificate.pem:/var/lib/rabbitmq/server_rabbit.trento.local_certificate.pem
+      - ./container_fixtures/rabbitmq/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf
     image: rabbitmq:3.12.6-management-alpine
     ports:
+      - 5671:5671
       - 5673:5672
       - 15673:15672
     environment:


Reviews:
user: login: arbulu89
body: Nice!
I think we should update the connection in `wanda.exs` as well. At the end, this is when we will have the communication working. When we use this config, we tell `web` to connect to `wanda` rabbitmq installation. I think the easiest thing will be to copy the server and ca certificates to wanda docker installation, and simply create only wanda specific client certs.
What do you think?
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-03T15:48:27Z
user: login: CDimonaco
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-03T15:55:19Z
user: login: arbulu89
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-03T15:57:25Z
user: login: CDimonaco
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-03T16:00:40Z
user: login: arbulu89
body: :green_heart: 
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-03T16:03:35Z

Review comments:
diff_hunk: @@ -96,21 +96,28 @@ unless IEx.started?() do
     ]
 end
 
+amqp_connection =
+  if System.get_env("USE_LOCAL_RABBIT_TLS") do
path: config/dev.exs
user: login: arbulu89
body: No need for a `if`. We put the default value as 2nd parameter, so if the env value is not set it will be used
created_at: 2025-03-03T15:40:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -51,14 +51,21 @@ config :trento,
   api_key_authentication_enabled: false,
   jwt_authentication_enabled: false
 
+amqp_connection =
+  if System.get_env("USE_LOCAL_RABBIT_TLS") do
path: config/test.exs
user: login: arbulu89
body: same, no need for `if`
created_at: 2025-03-03T15:41:11Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,6 @@
+ssl_options.cacertfile           = /etc/ssl/certs/ca_certificate.pem
+ssl_options.certfile             = /var/lib/rabbitmq/server_rabbit.trento.local_certificate.pem
+ssl_options.keyfile              = /var/lib/rabbitmq/server_rabbit.trento.local_key.pem
+ssl_options.verify               = verify_peer
+ssl_options.fail_if_no_peer_cert = true
+listeners.ssl.default = 5671
path: container_fixtures/rabbitmq/rabbitmq.conf
user: login: arbulu89
body: nitpick: we could indent the value to be the same as the others :see_no_evil: 
created_at: 2025-03-03T15:43:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -96,21 +96,28 @@ unless IEx.started?() do
     ]
 end
 
+amqp_connection =
+  if System.get_env("USE_LOCAL_RABBIT_TLS") do
path: config/dev.exs
user: login: CDimonaco
body: Do you mean provide the whole connection string as default argument? My idea was to have a simple "switch" without passing explicitly the whole string but just a boolean thing to switch between the two
created_at: 2025-03-03T15:55:19Z
author_association: CONTRIBUTOR
diff_hunk: @@ -96,21 +96,28 @@ unless IEx.started?() do
     ]
 end
 
+amqp_connection =
+  if System.get_env("USE_LOCAL_RABBIT_TLS") do
path: config/dev.exs
user: login: arbulu89
body: Yes, my fault. I read it to fast. I didn't realize that this is just a boolean.
All good!
created_at: 2025-03-03T15:57:25Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,6 @@
+ssl_options.cacertfile           = /etc/ssl/certs/ca_certificate.pem
+ssl_options.certfile             = /var/lib/rabbitmq/server_rabbit.trento.local_certificate.pem
+ssl_options.keyfile              = /var/lib/rabbitmq/server_rabbit.trento.local_key.pem
+ssl_options.verify               = verify_peer
+ssl_options.fail_if_no_peer_cert = true
+listeners.ssl.default = 5671
path: container_fixtures/rabbitmq/rabbitmq.conf
user: login: CDimonaco
body: done!
created_at: 2025-03-03T16:00:40Z
author_association: CONTRIBUTOR

PR comments:
user: login: CDimonaco
created_at: 2025-03-03T15:54:23Z
body: > Nice! I think we should update the connection in `wanda.exs` as well. At the end, this is when we will have the communication working. When we use this config, we tell `web` to connect to `wanda` rabbitmq installation. I think the easiest thing will be to copy the server and ca certificates to wanda docker installation, and simply create only wanda specific client certs. What do you think?

That's exactly what I will do, copy to all the components the same ca and the same server certificates, each client will have different client certificates built with the same ca in order to work with all the rabbitmqs we have!

I will also update wanda conf
author_association: CONTRIBUTOR
user: login: arbulu89
created_at: 2025-03-03T15:59:49Z
body: > > Nice! I think we should update the connection in `wanda.exs` as well. At the end, this is when we will have the communication working. When we use this config, we tell `web` to connect to `wanda` rabbitmq installation. I think the easiest thing will be to copy the server and ca certificates to wanda docker installation, and simply create only wanda specific client certs. What do you think?
> 
> That's exactly what I will do, copy to all the components the same ca and the same server certificates, each client will have different client certificates built with the same ca in order to work with all the rabbitmqs we have!
> 
> I will also update wanda conf

Ok! Considering that, could we change the `wanda.exs` entry to do the same `if` that we do in `dev`? Just to point to `wanda` rabbitmq as it does now. I guess we will need to "save" other port for wanda SSL connection. 
Just not to open a new PR only with that
author_association: CONTRIBUTOR
user: login: CDimonaco
created_at: 2025-03-03T16:02:23Z
body: > > > Nice! I think we should update the connection in `wanda.exs` as well. At the end, this is when we will have the communication working. When we use this config, we tell `web` to connect to `wanda` rabbitmq installation. I think the easiest thing will be to copy the server and ca certificates to wanda docker installation, and simply create only wanda specific client certs. What do you think?
> > 
> > 
> > That's exactly what I will do, copy to all the components the same ca and the same server certificates, each client will have different client certificates built with the same ca in order to work with all the rabbitmqs we have!
> > I will also update wanda conf
> 
> Ok! Considering that, could we change the `wanda.exs` entry to do the same `if` that we do in `dev`? Just to point to `wanda` rabbitmq as it does now. I guess we will need to "save" other port for wanda SSL connection. Just not to open a new PR only with that

Yep done, I chose the port 5676 I will make sure that will be the tls port on wanda
author_association: CONTRIBUTOR