hooks: Add option to disable TLS verification

cmd/tusd/cli/flags.go

@@ -61,6 +61,7 @@ var Flags struct {
 	HttpHooksBackoff                 time.Duration
 	HttpHooksTimeout                 time.Duration
 	HttpHooksSizeLimit               int64
+	HttpHooksInsecure                bool
 	GrpcHooksEndpoint                string
 	GrpcHooksRetry                   int
 	GrpcHooksBackoff                 time.Duration
@@ -207,6 +208,7 @@ func ParseFlags() {
 		f.DurationVar(&Flags.HttpHooksBackoff, "hooks-http-backoff", 1*time.Second, "Wait period before retrying each retry")
 		f.DurationVar(&Flags.HttpHooksTimeout, "hooks-http-timeout", 15*time.Second, "Timeout for the HTTP hook requests")
 		f.Int64Var(&Flags.HttpHooksSizeLimit, "hooks-http-size-limit", 5*1024, "Maximum size of the response body in bytes")
+		f.BoolVar(&Flags.HttpHooksInsecure, "hooks-http-insecure", false, "Disables TLS verification for the HTTP hook requests")
 	})
 
 	fs.AddGroup("gRPC hook options", func(f *flag.FlagSet) {

cmd/tusd/cli/hooks.go

@@ -28,6 +28,7 @@ func getHookHandler(config *handler.Config) hooks.HookHandler {
 			ForwardHeaders: strings.Split(Flags.HttpHooksForwardHeaders, ","),
 			Timeout:        Flags.HttpHooksTimeout,
 			SizeLimit:      Flags.HttpHooksSizeLimit,
+			Insecure:       Flags.HttpHooksInsecure,
 		}
 	} else if Flags.GrpcHooksEndpoint != "" {
 		printStartupLog("Using '%s' as the endpoint for gRPC hooks", Flags.GrpcHooksEndpoint)

pkg/hooks/http/http.go

@@ -7,10 +7,12 @@ package http
 import (
 	"bytes"
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
 	"mime"
+	"net"
 	"net/http"
 	"time"
 
@@ -25,6 +27,7 @@ type HttpHook struct {
 	ForwardHeaders []string
 	Timeout        time.Duration
 	SizeLimit      int64
+	Insecure       bool
 
 	client *pester.Client
 }
@@ -37,6 +40,25 @@ func (h *HttpHook) Setup() error {
 	client.Backoff = func(_ int) time.Duration {
 		return h.Backoff
 	}
+	// The transport uses the same values as the http.DefaultTransport.
+	t := &http.Transport{
+		Proxy: http.ProxyFromEnvironment,
+		DialContext: (&net.Dialer{
+			Timeout:   30 * time.Second,
+			KeepAlive: 30 * time.Second,
+		}).DialContext,
+		ForceAttemptHTTP2:     true,
+		MaxIdleConns:          100,
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+	}
+	if h.Insecure {
+		t.TLSClientConfig = &tls.Config{
+			InsecureSkipVerify: true,
+		}
+	}
+	client.Transport = t
 
 	h.client = client