Add TLS provider registry with pluggable cert loaders

Replace the inline TLS config (insecure bool + optional cert/key paths)
with a tagged-union YAML schema (`type: insecure | file | directory`)
and a factory-based TLS provider registry that decouples config
resolution from concrete TLS implementations.

Key changes:

Config schema (parsed_config.h):
- Replace flat ParsedTlsConfig with ParsedTlsInsecure, ParsedTlsFile,
  and ParsedTlsDirectory variants inside an rfl::TaggedUnion keyed on
  "type".

TLS provider hierarchy (include/o_rly/tls/, src/tls/):
- TlsCertProvider: base interface producing a FizzServerContext
- TlsCertLoader: convenience base for providers that load certs upfront
- InsecureCertProvider: compiled-in self-signed cert for development
- FileCertLoader: single cert+key pair from PEM files
- DirectoryCertLoader: SNI-based selection from a directory of pairs
- FizzContext factory helpers (ALPN building, cert manager assembly)
- TlsProviderRegistry: string-keyed factory map for provider plugins
- registerBuiltinTlsProviders: registers the three built-in factories

Config resolution (config_resolver.cpp):
- resolveConfig() now takes a TlsProviderRegistry reference
- Extracts type tag from the variant via rfl::Literal Tag, looks up
  the factory, invokes it, and stores the resulting shared_ptr<TlsCertProvider>
  in ListenerConfig (replacing the old TlsMode variant)

ORelayServer:
- Collapsed two constructors (insecure vs cert/key) into one that
  accepts a pre-built FizzServerContext

main.cpp:
- Creates registry, registers builtins, passes to config init pipeline
- Calls tlsProvider->createContext() to get FizzServerContext before
  constructing the server

Author: michalhosna

CMakeLists.txt

@@ -74,6 +74,11 @@ add_library(o_rly_core STATIC
   src/ORelayServer.cpp
   src/admin/AdminServer.cpp
   src/admin/BuiltinRoutes.cpp
+  src/tls/tls_cert_loader.cpp
+  src/tls/insecure_cert_provider.cpp
+  src/tls/file_cert_loader.cpp
+  src/tls/directory_cert_loader.cpp
+  src/tls/fizz_context_factory.cpp
 )
 
 target_include_directories(o_rly_core
@@ -87,6 +92,9 @@ target_link_libraries(o_rly_core PUBLIC
   moxygen::moxygen_moq_relay_session
   moxygen::moxygen_moq_server
   proxygen::proxygenhttpserver
+  proxygen::proxygen_hq_server
+  fizz::fizz
+  Folly::folly_file_util
   # Workaround: wangle::wangle_acceptor_acceptor_core uses AsyncFdSocket from
   # FizzAcceptorHandshakeHelper but omits this dep from its cmake config.
   Folly::folly_io_async_fdsock_async_fd_socket
@@ -118,6 +126,7 @@ add_library(o_rly_config_loader STATIC
   src/config/loader.cpp
   src/config/config_resolver.cpp
   src/config/config_init.cpp
+  src/tls/tls_provider_registry.cpp
 )
 
 target_include_directories(o_rly_config_loader
@@ -138,6 +147,7 @@ target_compile_options(o_rly_config_loader PRIVATE -Wall -Wextra -Wpedantic)
 
 add_executable(o_rly
   src/main.cpp
+  src/tls/builtin_tls_providers.cpp
 )
 
 target_link_libraries(o_rly PRIVATE o_rly_core o_rly_config_loader)
@@ -189,6 +199,7 @@ if(ORLY_BUILD_TESTS)
   )
   target_link_libraries(o_rly_config_resolver_test PRIVATE
     o_rly_config_loader
+    o_rly_core
     GTest::gtest_main
     GTest::gmock
     "$<LINK_LIBRARY:WHOLE_ARCHIVE,gflags_nothreads_static>"
@@ -198,6 +209,27 @@ if(ORLY_BUILD_TESTS)
   )
   gtest_discover_tests(o_rly_config_resolver_test)
 
+  add_executable(o_rly_tls_test
+    tests/tls/file_cert_loader_test.cpp
+    tests/tls/directory_cert_loader_test.cpp
+    tests/tls/fizz_context_factory_test.cpp
+    tests/tls/insecure_cert_provider_test.cpp
+    tests/tls/tls_provider_registry_test.cpp
+  )
+  target_link_libraries(o_rly_tls_test PRIVATE
+    o_rly_core
+    o_rly_config
+    o_rly_config_loader
+    Folly::folly_testing_test_util
+    GTest::gtest_main
+    GTest::gmock
+    "$<LINK_LIBRARY:WHOLE_ARCHIVE,gflags_nothreads_static>"
+  )
+  set_property(TARGET o_rly_tls_test PROPERTY
+    LINK_LIBRARY_OVERRIDE "WHOLE_ARCHIVE,gflags_nothreads_static"
+  )
+  gtest_discover_tests(o_rly_tls_test)
+
   add_test(
     NAME admin_info_endpoint
     COMMAND bash ${PROJECT_SOURCE_DIR}/tests/test_admin_info.sh $<TARGET_FILE:o_rly>

config.example.yaml

@@ -8,9 +8,15 @@ listeners:
         address: "::"        # Bind address (default: "::" = all interfaces)
         port: 9668            # Listen port (1-65535)
     tls:
-      # cert_file: /path/to/cert.pem   # Required when insecure: false
-      # key_file: /path/to/key.pem     # Required when insecure: false
-      insecure: true          # Skip TLS for local development
+      type: insecure          # Skip TLS for local development
+      # --- OR single cert+key pair ---
+      # type: file
+      # cert_file: /path/to/cert.pem
+      # key_file: /path/to/key.pem
+      # --- OR directory with multiple certs (SNI selection) ---
+      # type: directory
+      # cert_dir: /etc/ssl/certs.d/     # contains <name>.crt + <name>.key pairs
+      # default_cert: example.com        # optional: SNI identity for default fallback
     endpoint: "/moq-relay"    # WebTransport endpoint path
     # moqt_versions: [14, 16] # MOQT draft versions (empty = all supported)
 

deps/moxygen

@@ -7,20 +7,9 @@ namespace openmoq::o_rly {
 
 class ORelayServer : public moxygen::MoQServer {
 public:
-  // Used when the insecure flag is false
   ORelayServer(
-      const std::string& cert,
-      const std::string& key,
+      std::shared_ptr<const fizz::server::FizzServerContext> fizzContext,
       const std::string& endpoint,
-      const std::string& versions,
-      size_t maxCachedTracks,
-      size_t maxCachedGroupsPerTrack
-  );
-
-  // Used when the insecure flag is true
-  ORelayServer(
-      const std::string& endpoint,
-      const std::string& versions,
       size_t maxCachedTracks,
       size_t maxCachedGroupsPerTrack
   );

include/o_rly/ORelayServer.h

@@ -2,21 +2,16 @@
 
 #include <cstddef>
 #include <cstdint>
+#include <memory>
 #include <string>
-#include <variant>
 
 #include <folly/SocketAddress.h>
 
-namespace openmoq::o_rly::config {
-
-struct TlsConfig {
-  std::string certFile;
-  std::string keyFile;
-};
+namespace openmoq::o_rly::tls {
+class TlsCertProvider;
+} // namespace openmoq::o_rly::tls
 
-struct Insecure {};
-
-using TlsMode = std::variant<Insecure, TlsConfig>;
+namespace openmoq::o_rly::config {
 
 struct CacheConfig {
   size_t maxCachedTracks; // 0 when cache disabled
@@ -26,7 +21,7 @@ struct CacheConfig {
 struct ListenerConfig {
   std::string name;
   folly::SocketAddress address;
-  TlsMode tlsMode;
+  std::shared_ptr<tls::TlsCertProvider> tlsProvider;
   std::string endpoint;
   std::string moqtVersions; // comma-separated string
 };

include/o_rly/config/config.h

@@ -7,6 +7,10 @@
 
 #include "o_rly/config/resolved_config.h"
 
+namespace openmoq::o_rly::tls {
+class TlsProviderRegistry;
+} // namespace openmoq::o_rly::tls
+
 namespace openmoq::o_rly::config {
 
 constexpr std::string_view kDumpConfigSchemaCommand = "dump-config-schema";
@@ -21,7 +25,8 @@ folly::Expected<ResolvedConfig, int> handleConfigSubcommand(
     std::string_view subcommand,
     std::string_view configPath,
     bool strictConfig,
-    const char* programName
+    const char* programName,
+    const tls::TlsProviderRegistry& registry
 );
 
 } // namespace openmoq::o_rly::config

include/o_rly/config/loader/config_init.h

@@ -7,11 +7,16 @@
 #include "o_rly/config/loader/parsed_config.h"
 #include "o_rly/config/resolved_config.h"
 
+namespace openmoq::o_rly::tls {
+class TlsProviderRegistry;
+} // namespace openmoq::o_rly::tls
+
 namespace openmoq::o_rly::config {
 
 /// Validate and resolve a ParsedConfig into concrete Config types.
 /// Returns warnings alongside the config on success.
 /// On validation failure, returns a combined error string.
-folly::Expected<ResolvedConfig, std::string> resolveConfig(const ParsedConfig& config);
+folly::Expected<ResolvedConfig, std::string>
+resolveConfig(const ParsedConfig& config, const tls::TlsProviderRegistry& registry);
 
 } // namespace openmoq::o_rly::config

include/o_rly/config/loader/config_resolver.h

@@ -25,16 +25,39 @@ struct ParsedUdpConfig {
   rfl::Description<"Socket configuration", ParsedSocketConfig> socket;
 };
 
-struct ParsedTlsConfig {
-  rfl::Description<"Path to TLS certificate file", std::optional<std::string>> cert_file;
-  rfl::Description<"Path to TLS private key file", std::optional<std::string>> key_file;
-  rfl::Description<"Insecure mode, use default compiled-in cert", bool> insecure;
+// rfl::ExtraFields absorbs the "type" discriminator key that the TaggedUnion
+// parser has already consumed but that would otherwise be rejected by the
+// NoExtraFields processor in strict mode.
+struct ParsedTlsInsecure {
+  using Tag = rfl::Literal<"insecure">;
+  rfl::ExtraFields<rfl::Generic> extra_;
 };
 
+struct ParsedTlsFile {
+  using Tag = rfl::Literal<"file">;
+  rfl::Description<"Path to TLS certificate file (PEM)", std::string> cert_file;
+  rfl::Description<"Path to TLS private key file (PEM)", std::string> key_file;
+  rfl::ExtraFields<rfl::Generic> extra_;
+};
+
+struct ParsedTlsDirectory {
+  using Tag = rfl::Literal<"directory">;
+  rfl::Description<"Directory containing cert/key pairs (<name>.crt + <name>.key)", std::string>
+      cert_dir;
+  rfl::Description<
+      "SNI identity of the default certificate (optional, first cert if omitted)",
+      std::optional<std::string>>
+      default_cert;
+  rfl::ExtraFields<rfl::Generic> extra_;
+};
+
+using ParsedTlsMode =
+    rfl::TaggedUnion<"type", ParsedTlsInsecure, ParsedTlsFile, ParsedTlsDirectory>;
+
 struct ParsedListenerConfig {
   rfl::Description<"Listener name", std::string> name;
   rfl::Description<"UDP/QUIC transport config", ParsedUdpConfig> udp;
-  rfl::Description<"TLS configuration", ParsedTlsConfig> tls;
+  ParsedTlsMode tls;
   rfl::Description<"WebTransport endpoint path", std::string> endpoint;
   rfl::Description<
       "MOQT draft versions (empty = all supported)",

include/o_rly/config/loader/parsed_config.h

@@ -0,0 +1,9 @@
+#pragma once
+
+namespace openmoq::o_rly::tls {
+
+class TlsProviderRegistry;
+
+void registerBuiltinTlsProviders(TlsProviderRegistry& registry);
+
+} // namespace openmoq::o_rly::tls

include/o_rly/tls/builtin_tls_providers.h

@@ -0,0 +1,19 @@
+#pragma once
+
+#include <string>
+
+#include "o_rly/tls/tls_cert_loader.h"
+
+namespace openmoq::o_rly::tls {
+
+class DirectoryCertLoader : public TlsCertLoader {
+public:
+  DirectoryCertLoader(std::string certDir, std::string defaultCertIdentity);
+  folly::Expected<LoadedCerts, std::string> load() const override;
+
+private:
+  std::string certDir_;
+  std::string defaultCertIdentity_;
+};
+
+} // namespace openmoq::o_rly::tls