fix: grpc self-signed certs

Makefile

@@ -102,19 +102,19 @@ envs = staging prod
 $(addprefix decrypt.,${envs}): decrypt.%: \
 	.$$*.gcloud.json \
  	.$$*.env \
- 	.$$*.cacert.pem \
  	.$$*.cert.key \
  	.$$*.cert.pem \
+ 	.$$*.req.pem \
  	.$$*.db-client-cert.pem \
  	.$$*.db-client-key.pem \
- 	.$$*.db-server-ca.pem
+ 	.$$*.db-server-ca.pem	
 
 $(addprefix encrypt.,${envs}): encrypt.%: \
 	.$$*.gcloud.json.enc \
 	.$$*.env.enc \
-	.$$*.cacert.pem.enc \
 	.$$*.cert.key.enc \
 	.$$*.cert.pem.enc \
+	.$$*.req.pem.enc \
  	.$$*.db-client-cert.pem.enc \
  	.$$*.db-client-key.pem.enc \
  	.$$*.db-server-ca.pem.enc
@@ -230,10 +230,14 @@ ssl.prod: CERT_DOMAIN = logflare.app
 ssl.staging: CERT_DOMAIN = logflarestaging.com
 
 $(addprefix ssl.,${envs}): ssl.%:
-	openssl req -newkey rsa:2048 -nodes -days 365000 -keyout .$*.cert.key -out .$*.req.pem \
+	@echo "Generating self-signed certificate..."
+	@echo "Generating server private key (cert.key) and certificate signing request (req.pem)"
+	@openssl req -newkey rsa:2048 -nodes -days 365000 -keyout .$*.cert.key -out .$*.req.pem \
 		-subj  "/C=US/ST=DE/O=Supabase/OU=Logflare/CN=$(CERT_DOMAIN)"
-	openssl x509 -req -days 12783 -set_serial 1 \
-		-in .$*.req.pem -out .$*.cert.pem \
+	@echo "Signing cert.pem using private key and CSR"
+	@openssl x509 -req -days 12783 -set_serial 1 \
+		-in .$*.req.pem -signkey .$*.cert.key -out .$*.cert.pem \
 		-CA .$*.cacert.pem -CAkey .$*.cacert.key
+
 
 .PHONY: $(addprefix ssl.,${envs})

cloudbuild/prod/build-image.yaml

@@ -35,15 +35,6 @@ steps:
       - "--location=us-central1"
       - "--keyring=logflare-prod-keyring-us-central1"
       - "--key=logflare-prod-secrets-key"
-  - name: gcr.io/cloud-builders/gcloud
-    args:
-      - kms
-      - decrypt
-      - "--ciphertext-file=./cloudbuild/.prod.cacert.pem.enc"
-      - "--plaintext-file=./cacert.pem"
-      - "--location=us-central1"
-      - "--keyring=logflare-prod-keyring-us-central1"
-      - "--key=logflare-prod-secrets-key"
   - name: gcr.io/cloud-builders/gcloud
     args:
       - kms

cloudbuild/staging/build-image.yaml

@@ -35,15 +35,6 @@ steps:
       - --location=us-central1
       - --keyring=logflare-keyring-us-central1
       - --key=logflare-secrets-key
-  - name: gcr.io/cloud-builders/gcloud
-    args:
-      - kms
-      - decrypt
-      - --ciphertext-file=./cloudbuild/.staging.cacert.pem.enc
-      - --plaintext-file=./cacert.pem
-      - --location=us-central1
-      - --keyring=logflare-keyring-us-central1
-      - --key=logflare-secrets-key
   - name: gcr.io/cloud-builders/gcloud
     args:
       - kms

config/runtime.exs

@@ -225,12 +225,12 @@ cond do
 end
 
 if(
-  System.get_env("LOGFLARE_ENABLE_GRPC_SSL") == "true" && File.exists?("cacert.pem") &&
+  System.get_env("LOGFLARE_ENABLE_GRPC_SSL") == "true" &&
     File.exists?("cert.pem") && File.exists?("cert.key")
 ) do
   config :logflare,
     ssl: [
-      cacertfile: "cacert.pem",
+      cacerts: :public_key.cacerts_get(),
       certfile: "cert.pem",
       keyfile: "cert.key",
       verify: :verify_peer