h2c server

docs/user-guide/grpc.md

@@ -1,30 +1,10 @@
-# gRPC example
+# gRPC examples
 
-This section explains how to use Traefik as reverse proxy for gRPC application with self-signed certificates.
+## With HTTP (h2c)
 
-!!! warning
-    As gRPC needs HTTP2, we need HTTPS certificates on Træfik.
-    For exchanges with the backend, we will use h2c (HTTP2 on HTTP without TLS)
+This section explains how to use Traefik as reverse proxy for gRPC application.
 
-<p align="center">
-<img src="/img/grpc.svg" alt="gRPC architecture" title="gRPC architecture" />
-</p>
-
-## gRPC Client certificate
-
-Generate your self-signed certificate for frontend url:
-
-```bash
-openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./frontend.key -out ./frontend.cert
-```
-
-with
-
-```
-Common Name (e.g. server FQDN or YOUR name) []: frontend.local
-```
-
-## Træfik configuration
+### Træfik configuration
 
 At last, we configure our Træfik instance to use both self-signed certificates.
 
@@ -32,14 +12,9 @@ At last, we configure our Træfik instance to use both self-signed certificates.
 defaultEntryPoints = ["https"]
 
 [entryPoints]
-  [entryPoints.https]
-  address = ":4443"
-    [entryPoints.https.tls]
-     # For secure connection on frontend.local
-     [[entryPoints.https.tls.certificates]]
-     certFile = "./frontend.cert"
-     keyFile  = "./frontend.key"
-
+  [entryPoints.http]
+  address = ":80"
+    [entryPoints.http]
 
 [api]
 
@@ -62,23 +37,115 @@ defaultEntryPoints = ["https"]
 !!! warning
     For provider with label, you will have to specify the `traefik.protocol=h2c`
 
-## Conclusion
+### Conclusion
 
-We don't need specific configuration to use gRPC in Træfik, we just need to be careful that exchanges between client and Træfik are HTTPS communications.
-For exchanges between Træfik and backend, you need to use `h2c` protocol, or use HTTPS communications to have HTTP2.
+We don't need specific configuration to use gRPC in Træfik, we just need to use `h2c` protocol, or use HTTPS communications to have HTTP2 with the backend.
 
-## A gRPC example in go
+## With HTTPS
 
-We will use the gRPC greeter example in [grpc-go](https://github.com/grpc/grpc-go/tree/master/examples/helloworld)
+This section explains how to use Traefik as reverse proxy for gRPC application with self-signed certificates.
+
+<p align="center">
+<img src="/img/grpc.svg" alt="gRPC architecture" title="gRPC architecture" />
+</p>
+
+### gRPC Server certificate
+
+In order to secure the gRPC server, we generate a self-signed certificate for backend url:
+
+```bash
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./backend.key -out ./backend.cert
+```
+
+That will prompt for information, the important answer is:
+
+```
+Common Name (e.g. server FQDN or YOUR name) []: backend.local
+```
+
+### gRPC Client certificate
+
+Generate your self-signed certificate for frontend url:
+
+```bash
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./frontend.key -out ./frontend.cert
+```
+
+with
+
+```
+Common Name (e.g. server FQDN or YOUR name) []: frontend.local
+```
+
+### Træfik configuration
+
+At last, we configure our Træfik instance to use both self-signed certificates.
+
+```toml
+defaultEntryPoints = ["https"]
+
+# For secure connection on backend.local
+rootCAs = [ "./backend.cert" ]
+
+[entryPoints]
+  [entryPoints.https]
+  address = ":4443"
+    [entryPoints.https.tls]
+     # For secure connection on frontend.local
+     [[entryPoints.https.tls.certificates]]
+     certFile = "./frontend.cert"
+     keyFile  = "./frontend.key"
+
+
+[api]
+
+[file]
+
+[backends]
+  [backends.backend1]
+    [backends.backend1.servers.server1]
+    # Access on backend with HTTPS
+    url = "https://backend.local:8080"
+
+
+[frontends]
+  [frontends.frontend1]
+  backend = "backend1"
+    [frontends.frontend1.routes.test_1]
+    rule = "Host:frontend.local"
+```
+
+!!! warning
+    With some backends, the server URLs use the IP, so you may need to configure `insecureSkipVerify` instead of the `rootCAS` to activate HTTPS without hostname verification.
+
+### A gRPC example in go (modify for https)
+
+We use the gRPC greeter example in [grpc-go](https://github.com/grpc/grpc-go/tree/master/examples/helloworld)
+
+!!! warning
+    In order to use this gRPC example, we need to modify it to use HTTPS
+
+So we modify the "gRPC server example" to use our own self-signed certificate:
 
-We can keep the Server example as is with the h2c protocol
 ```go
 // ...
-lis, err := net.Listen("tcp", port)
+
+// Read cert and key file
+BackendCert, _ := ioutil.ReadFile("./backend.cert")
+BackendKey, _ := ioutil.ReadFile("./backend.key")
+
+// Generate Certificate struct
+cert, err := tls.X509KeyPair(BackendCert, BackendKey)
 if err != nil {
-    log.Fatalf("failed to listen: %v", err)
+  log.Fatalf("failed to parse certificate: %v", err)
 }
-var s *grpc.Server = grpc.NewServer()
+
+// Create credentials
+creds := credentials.NewServerTLSFromCert(&cert)
+
+// Use Credentials in gRPC server options
+serverOption := grpc.Creds(creds)
+var s *grpc.Server = grpc.NewServer(serverOption)
 defer s.Stop()
 
 pb.RegisterGreeterServer(s, &server{})
@@ -87,10 +154,6 @@ err := s.Serve(lis)
 // ...
 ```
 
-!!! warning
-    In order to use this gRPC example, we need to modify it to use HTTPS
-
-
 Next we will modify gRPC Client to use our Træfik self-signed certificate:
 
 ```go