add env vars to configure auth and ssl for ES instance

.github/workflows/cicd.yml

@@ -65,11 +65,13 @@ jobs:
           cd stac_fastapi/elasticsearch && pipenv run pytest -svvv
         env:
           ENVIRONMENT: testing
-          ES_USER: dev
-          ES_PASS: stac
+#          ES_USER: dev
+#          ES_PASS: stac
           ES_PORT: 9200
           ES_HOST: 172.17.0.1
-#
+          ES_USE_SSL: false
+          ES_VERIFY_CERTS: false
+
 #      - name: Run test suite against Elasticsearch 8.x
 #        run: |
 #          cd stac_fastapi/elasticsearch && pipenv run pytest -svvv

Makefile

@@ -3,6 +3,10 @@ APP_HOST ?= 0.0.0.0
 APP_PORT ?= 8080
 EXTERNAL_APP_PORT ?= ${APP_PORT}
 
+APP_PORT ?= 8080
+ES_HOST ?= docker.for.mac.localhost
+ES_PORT ?= 9200
+
 run_es = docker-compose \
 	run \
 	-p ${EXTERNAL_APP_PORT}:${APP_PORT} \
@@ -11,18 +15,17 @@ run_es = docker-compose \
 	-e APP_PORT=${APP_PORT} \
 	app-elasticsearch
 
-.PHONY: image
-image:
+.PHONY: image-deploy
+image-deploy:
 	docker build -f Dockerfile.deploy -t stac-fastapi-elasticsearch:latest .
 
-.PHONY: run
-run:
+.PHONY: run-deploy-locally
+run-deploy-locally:
 	 docker run -it -p 8080:8080 \
-		-e ENVIRONMENT=local \
-		-e ES_HOST=docker.for.mac.localhost \
-		-e ES_PORT=9200 \
-		-e ES_USER=dev \
-		-e ES_PASS=stac \
+		-e ES_HOST=${ES_HOST} \
+		-e ES_PORT=${ES_PORT} \
+		-e ES_USER=${ES_USER} \
+		-e ES_PASS=${ES_PASS} \
 		stac-fastapi-elasticsearch:latest
 
 .PHONY: image-dev

docker-compose.yml

@@ -14,10 +14,12 @@ services:
       - RELOAD=false
       - ENVIRONMENT=local
       - WEB_CONCURRENCY=10
-      - ES_USER=dev
-      - ES_PASS=stac
-      - ES_PORT=9200
       - ES_HOST=172.17.0.1
+      - ES_PORT=9200
+#      - ES_USER=dev
+#      - ES_PASS=stac
+      - ES_USE_SSL=false
+      - ES_VERIFY_CERTS=false
     ports:
       - "8080:8080"
     volumes:

stac_fastapi/elasticsearch/stac_fastapi/elasticsearch/config.py

@@ -1,40 +1,57 @@
 """API configuration."""
 import os
-from typing import Set
+from typing import Any, Dict, Set
 
 from elasticsearch import AsyncElasticsearch, Elasticsearch
 
 from stac_fastapi.types.config import ApiSettings
 
-DOMAIN = os.getenv("ES_HOST")
-PORT = os.getenv("ES_PORT")
+
+def _es_config() -> Dict[str, Any]:
+    config = {
+        "hosts": [{"host": os.getenv("ES_HOST"), "port": os.getenv("ES_PORT")}],
+        "headers": {"accept": "application/vnd.elasticsearch+json; compatible-with=7"},
+        "use_ssl": True,
+        "verify_certs": True,
+    }
+
+    if (u := os.getenv("ES_USER")) and (p := os.getenv("ES_PASS")):
+        config["http_auth"] = (u, p)
+
+    if (v := os.getenv("ES_USE_SSL")) and v == "false":
+        config["use_ssl"] = False
+
+    if (v := os.getenv("ES_VERIFY_CERTS")) and v == "false":
+        config["verify_certs"] = False
+
+    if v := os.getenv("CURL_CA_BUNDLE"):
+        config["ca_certs"] = v
+
+    return config
+
+
+_forbidden_fields: Set[str] = {"type"}
 
 
 class ElasticsearchSettings(ApiSettings):
     """API settings."""
 
     # Fields which are defined by STAC but not included in the database model
-    forbidden_fields: Set[str] = {"type"}
+    forbidden_fields: Set[str] = _forbidden_fields
 
     @property
     def create_client(self):
         """Create es client."""
-        return Elasticsearch(
-            [{"host": str(DOMAIN), "port": str(PORT)}],
-            headers={"accept": "application/vnd.elasticsearch+json; compatible-with=7"},
-        )
+        return Elasticsearch(**_es_config())
 
 
 class AsyncElasticsearchSettings(ApiSettings):
     """API settings."""
 
     # Fields which are defined by STAC but not included in the database model
-    forbidden_fields: Set[str] = {"type"}
+    forbidden_fields: Set[str] = _forbidden_fields
 
     @property
     def create_client(self):
         """Create async elasticsearch client."""
-        return AsyncElasticsearch(
-            [{"host": str(DOMAIN), "port": str(PORT)}],
-            headers={"accept": "application/vnd.elasticsearch+json; compatible-with=7"},
-        )
+        return AsyncElasticsearch(**_es_config())

stac_fastapi/elasticsearch/stac_fastapi/elasticsearch/indexes.py

@@ -16,7 +16,6 @@ class IndexesClient:
     """Elasticsearch client to handle index creation."""
 
     session: Session = attr.ib(default=attr.Factory(Session.create_from_env))
-    client = AsyncElasticsearchSettings().create_client
 
     ES_MAPPINGS_DYNAMIC_TEMPLATES = [
         # Common https://github.com/radiantearth/stac-spec/blob/master/item-spec/common-metadata.md
@@ -103,12 +102,13 @@ class IndexesClient:
 
     async def create_indexes(self):
         """Create the index for Items and Collections."""
-        await self.client.indices.create(
+        client = AsyncElasticsearchSettings().create_client
+        await client.indices.create(
             index=ITEMS_INDEX,
             mappings=self.ES_ITEMS_MAPPINGS,
             ignore=400,  # ignore 400 already exists code
         )
-        await self.client.indices.create(
+        await client.indices.create(
             index=COLLECTIONS_INDEX,
             mappings=self.ES_COLLECTIONS_MAPPINGS,
             ignore=400,  # ignore 400 already exists code