feat: add ca option to allow specifying a ca cert

README.md

@@ -40,12 +40,13 @@ The config.yaml is made up of sections:
  - tests - the actual endpoints to test
 
 ```
-    test-name: 
+    test-name:
         path: Path to test
         secure: Is this using HTTPS?
-        hosts: List of hosts to use 
+        hosts: List of hosts to use
         certificate: Path to keypair to use for mTLS - must be un-encrypted
-        discovery: discovery block for this test - merged with top level block 
+        ca: Path to CA certificate file for verifying server certificates
+        discovery: discovery block for this test - merged with top level block
 ```
 
  - discovery - optional top level discovery config shared across tests

hemApp/__init__.py

@@ -79,6 +79,7 @@ class Check(object):
     auth = {}
     token = None
     certificate = None
+    ca = None
 
     def __init__(self, name, test, metrics=None, storage=None):
         #path, secure=False, verify=True, metrics=None):
@@ -100,6 +101,11 @@ def __init__(self, name, test, metrics=None, storage=None):
         if 'certificate' in test:
             self.logger.info("Setting certificate to %s", test['certificate'])
             self.certificate = test['certificate']
+        if 'ca' in test:
+            self.logger.info("Setting CA certificate to %s", test['ca'])
+            self.ca = test['ca']
+            # If CA is specified, use it for verification instead of True/False
+            self.verify = test['ca']
         if 'headers' in test:
             for header in test['headers']:
               self.headers[header] = test['headers'][header]

requirements.txt

@@ -1,14 +1,13 @@
-click
-dnspython
-pike
-requests
-PyYAML
-pike
-setuptools_scm
-pytest
-coverage
-requests-mock
-pyjwt
-pykafka
-prometheus_client
-setuptools>=70.0.0 # not directly required, pinned by Snyk to avoid a vulnerability
+click>=8.1.0
+dnspython>=2.6.0
+pike>=0.1.1
+requests>=2.32.0
+PyYAML>=6.0.0
+setuptools_scm>=8.0.0
+pytest>=8.0.0
+coverage>=7.0.0
+requests-mock>=1.12.0
+pyjwt>=2.9.0
+pykafka>=2.8.0
+prometheus_client>=0.20.0
+setuptools>=75.0.0

setup.py

@@ -13,9 +13,9 @@ def read(fname):
     author = "Ricky Moorhouse",
     author_email = "hem@rickymoorhouse.uk",
     description = ("HTTP Endpoint Monitor - keeping the loose ends tied up"),
-    setup_requires = ['setuptools_scm', 'pytest', 'pytest-cov>=2.4.0', 'requests-mock'],
+    setup_requires = ['setuptools_scm', 'pytest>=8.0.0', 'pytest-cov>=5.0.0', 'requests-mock>=1.12.0'],
     use_scm_version=True,
-    install_requires = ['PyYaml', 'pike', 'click', 'requests', 'dnspython', 'pyjwt'],
+    install_requires = ['PyYaml>=6.0.0', 'pike>=0.1.1', 'click>=8.1.0', 'requests>=2.32.0', 'dnspython>=2.6.0', 'pyjwt>=2.9.0'],
     license = "MIT",
     keywords = "monitor, http",
     url = "https://rickymoorhouse.uk/blog/2018/introducing-hem/",

test_requires.txt

@@ -1,17 +1,15 @@
-pytest
-click
-dnspython
-pike
-requests
-PyYAML
-pike
-setuptools_scm
-mock
-pytest>=4.6
-pytest-cov
-pytest-mock
-requests-mock
-coverage
-python-coveralls
-pykafka
-prometheus_client
+pytest>=8.0.0
+click>=8.1.0
+dnspython>=2.6.0
+pike>=0.1.1
+requests>=2.32.0
+PyYAML>=6.0.0
+setuptools_scm>=8.0.0
+mock>=5.0.0
+pytest-cov>=5.0.0
+pytest-mock>=3.14.0
+requests-mock>=1.12.0
+coverage>=7.0.0
+python-coveralls>=2.9.0
+pykafka>=2.8.0
+prometheus_client>=0.20.0

tests/test_cli_ca.yaml

@@ -0,0 +1,17 @@
+settings:
+  frequency: 10
+discovery:
+  type: dns
+metrics:
+  type: graphite
+  server: nonexistent.graphite
+tests:
+  homepage:
+    path: /index.html
+    secure: true
+    ca: /path/to/ca-cert.pem
+    hosts: 
+       - rickymoorhouse.uk
+       - rickymoorhouse.co.uk
+
+# Made with Bob

tests/test_hem.py

@@ -56,6 +56,19 @@ def test_check_mtls_invoke():
         assert results is not None
         assert response == 200
         assert type(timing) is datetime.timedelta
+
+def test_check_ca_invoke():
+    with requests_mock.mock() as m:
+        m.get('https://1.1.1.1/', text="")
+        test = {'path':'/', 'secure':True, 'verify':True, 'ca': '/path/to/ca-cert.pem'}
+        check = hemApp.Check('test', test)
+        results = check.test_list(["1.1.1.1"])
+        (response, timing) = results[0]
+        assert results is not None
+        assert response == 200
+        assert type(timing) is datetime.timedelta
+        assert check.verify == '/path/to/ca-cert.pem'
+        assert check.ca == '/path/to/ca-cert.pem'
 def test_check_jwt_invoke():
     hemstore = hemApp.HemStore()
     with requests_mock.mock() as m: