Repository: dask/distributed

Issue:
TLS configuration for dask scheduler via CLI options is broken
Hi,

when configuring TLS for distributed schedulers via the command line, the CLI options are ignored, but setting a DASK_CONFIG works.

```
vagrant@base-jessie /vagrant % dask-scheduler --tls-ca-file /vagrant/ca-cert.crt --tls-cert /vagrant/server2.crt --tls-key /vagrant/server2.key
distributed.scheduler - INFO - -----------------------------------------------
distributed.scheduler - INFO - Clear task state
distributed.scheduler - INFO -   Scheduler at:      tcp://10.0.2.15:8786
distributed.scheduler - INFO - Local Directory:      /tmp/scheduler-SRqPuw
distributed.scheduler - INFO - -----------------------------------------------
^Cdistributed.scheduler - INFO - End scheduler at 'tcp://:8786'
vagrant@base-jessie /vagrant % DASK_CONFIG=config-scheduler.yaml dask-scheduler
distributed.scheduler - INFO - -----------------------------------------------
distributed.scheduler - INFO - Clear task state
distributed.scheduler - INFO -   Scheduler at:      tls://10.0.2.15:8786
distributed.scheduler - INFO - Local Directory:      /tmp/scheduler-eZbsAo
distributed.scheduler - INFO - -----------------------------------------------
distributed.scheduler - INFO - Register tls://10.0.2.15:51975
distributed.scheduler - INFO - Starting worker compute stream, tls://10.0.2.15:51975
^Cdistributed.scheduler - INFO - End scheduler at 'tls://:8786'
vagrant@base-jessie /vagrant %
```

and config-scheduler.yaml contains
```
logging:
    distributed: info
    distributed.client: warning
    bokeh: critical

default-scheme: tls
tls:
    ca-file: /vagrant/ca-cert.crt
    scheduler:
        cert: /vagrant/server2.crt
        key: /vagrant/server2.key

```

As can be seen, the first server starts in tcp mode, while the second starts in tls mode, with the options being essentially the same.
If needed, I can provide the certificates and keys, as this is a test installation anyways.


Discussion:
Isn't the difference the "default scheme"? Does it work if you supply the CLI with the address you want it to start the scheduler on, e.g. with:

`dask-scheduler --tls-ca-file /vagrant/ca-cert.crt --tls-cert /vagrant/server2.crt --tls-key /vagrant/server2.key --host tls://10.0.2.15:8786`
This in fact works, thanks!
Maybe the documentation could be a bit improved here?
Alongside with the specification which certificate in the TLS setup needs which capabilities, in my findings worker and scheduler certs need to be able to clientAuth and serverAuth, and the client certificate just needs to be able to do clientAuth.
In my experience, the maintainers are very welcoming of people contributing PRs to either the code or the documentation.
Yes, contributions here would be *very* welcome if you have the time @Corni 

Resolving patch:
diff --git a/distributed/cli/dask_scheduler.py b/distributed/cli/dask_scheduler.py
--- a/distributed/cli/dask_scheduler.py
+++ b/distributed/cli/dask_scheduler.py
@@ -75,6 +75,9 @@ def main(host, port, bokeh_port, show, _bokeh, bokeh_whitelist, bokeh_prefix,
                    tls_scheduler_key=tls_key,
                    )
 
+    if not host and (tls_ca_file or tls_cert or tls_key):
+        host = 'tls://'
+
     if pid_file:
         with open(pid_file, 'w') as f:
             f.write(str(os.getpid()))


Test patch:
diff --git a/distributed/cli/tests/test_tls_cli.py b/distributed/cli/tests/test_tls_cli.py
--- a/distributed/cli/tests/test_tls_cli.py
+++ b/distributed/cli/tests/test_tls_cli.py
@@ -28,7 +28,7 @@ def wait_for_cores(c, ncores=1):
 
 
 def test_basic(loop):
-    with popen(['dask-scheduler', '--no-bokeh', '--host', 'tls://'] + tls_args) as s:
+    with popen(['dask-scheduler', '--no-bokeh'] + tls_args) as s:
         with popen(['dask-worker', '--no-bokeh', 'tls://127.0.0.1:8786'] + tls_args) as w:
             with Client('tls://127.0.0.1:8786', loop=loop,
                         security=tls_security()) as c:
@@ -36,7 +36,7 @@ def test_basic(loop):
 
 
 def test_nanny(loop):
-    with popen(['dask-scheduler', '--no-bokeh', '--host', 'tls://'] + tls_args) as s:
+    with popen(['dask-scheduler', '--no-bokeh'] + tls_args) as s:
         with popen(['dask-worker', '--no-bokeh', '--nanny', 'tls://127.0.0.1:8786'] + tls_args) as w:
             with Client('tls://127.0.0.1:8786', loop=loop,
                         security=tls_security()) as c:
@@ -44,7 +44,7 @@ def test_nanny(loop):
 
 
 def test_separate_key_cert(loop):
-    with popen(['dask-scheduler', '--no-bokeh', '--host', 'tls://'] + tls_args_2) as s:
+    with popen(['dask-scheduler', '--no-bokeh'] + tls_args_2) as s:
         with popen(['dask-worker', '--no-bokeh', 'tls://127.0.0.1:8786'] + tls_args_2) as w:
             with Client('tls://127.0.0.1:8786', loop=loop,
                         security=tls_security()) as c: