reporter: add mTLS support for remote signer connection (tellor-io#35)

* Add remote signer keyring to reporter client via --remote-signer-addr flag

* Add mTLS support for remote signer in reporter client

* fix: vendor signer api; restore grpc/rpc managers + password-file logic dropped in main merge

---------

Co-authored-by: krasi <root@ns1028910.ip-40-160-21.us>

Author: diorwave

cmd/main.go

@@ -168,6 +168,9 @@ func init() {
 	rootCmd.Flags().Duration("refresh-gas-estimates-interval", 12*time.Hour, "Interval for resetting cached gas estimates and gas-adjustment levels (<=0 disables)")
 	// Remote signer: when set, tx signing is delegated to the remote signer service instead of the local keyring
 	rootCmd.Flags().String("remote-signer-addr", "", "gRPC address of the remote signer service (e.g. localhost:9191). When set, tx signing uses the remote signer instead of the local keyring.")
+	rootCmd.Flags().String("remote-signer-ca-cert", "", "Path to the CA certificate for verifying the remote signer's TLS certificate.")
+	rootCmd.Flags().String("remote-signer-client-cert", "", "Path to the client TLS certificate presented to the remote signer.")
+	rootCmd.Flags().String("remote-signer-client-key", "", "Path to the client TLS private key.")
 
 	// Auto-bridge: keep wallet at a fixed balance by bridging the excess to Ethereum
 	rootCmd.Flags().Uint64(daemonflags.FlagAutoBalanceToKeep, 0, "Keep this amount of loya in the wallet; bridge any excess to Ethereum at --auto-balance-execution-time (0 = disabled)")

reporter/client/client.go

@@ -12,9 +12,9 @@ import (
 	"sync/atomic"
 	"time"
 
+	rpchttp "github.com/cometbft/cometbft/rpc/client/http"
 	"github.com/ethereum/go-ethereum/common"
 	"github.com/spf13/viper"
-	rpchttp "github.com/cometbft/cometbft/rpc/client/http"
 	globalfeetypes "github.com/strangelove-ventures/globalfee/x/globalfee/types"
 	customquery "github.com/tellor-io/layer-daemons/custom_query"
 	daemonflags "github.com/tellor-io/layer-daemons/flags"
@@ -183,20 +183,17 @@ type Client struct {
 	gasEstimator                *gasEstimateState
 
 	// Resources that need cleanup
-	grpcMu      sync.RWMutex
-	grpcConn    *grpc.ClientConn
-	grpcClient  daemontypes.GrpcClient
-
-	rpcClient   *rpchttp.HTTP // direct reference for WebSocket subscriptions
-	grpcManager *grpcEndpointManager
-	rpcMu       sync.RWMutex
-	rpcManager  *rpcEndpointManager
-
+	grpcMu           sync.RWMutex
+	grpcConn         *grpc.ClientConn
+	grpcClient       daemontypes.GrpcClient
+	rpcClient        *rpchttp.HTTP // direct reference for WebSocket subscriptions
+	grpcManager      *grpcEndpointManager
+	rpcMu            sync.RWMutex
+	rpcManager       *rpcEndpointManager
 	remoteSignerConn *grpc.ClientConn // non-nil when --remote-signer-addr is set
-
-	wg          sync.WaitGroup
-	broadcastWg sync.WaitGroup // Tracks goroutines in BroadcastTxMsgToChain
-	stopOnce    sync.Once
+	wg               sync.WaitGroup
+	broadcastWg      sync.WaitGroup // Tracks goroutines in BroadcastTxMsgToChain
+	stopOnce         sync.Once
 }
 
 // GetUniqueUnorderedTimeout generates a unique timeout timestamp for unordered transactions.
@@ -394,15 +391,17 @@ func (c *Client) Start(
 	}
 	c.rpcManager = rpcManager
 	c.setRPCClient(rpcClientVal)
-        c.logger.Info("CometBFT RPC client established", "endpoint", rpcEndpoint)
+	c.logger.Info("CometBFT RPC client established", "endpoint", rpcEndpoint)
 	encodingConfig := CreateEncodingConfig()
 	c.cosmosCtx = c.cosmosCtx.WithCodec(encodingConfig.Codec).WithInterfaceRegistry(encodingConfig.InterfaceRegistry).WithTxConfig(encodingConfig.TxConfig)
-
 	remoteSignerAddr := viper.GetString("remote-signer-addr")
 	if remoteSignerAddr != "" {
 		// Use remote signer for tx signing — no local private key needed.
 		c.logger.Info("Using remote signer for tx signing", "addr", remoteSignerAddr)
-		kr, signerAccAddr, signerConn, err := newKeyringFromRemoteSigner(ctx, keyName, remoteSignerAddr)
+		caCert := viper.GetString("remote-signer-ca-cert")
+		clientCert := viper.GetString("remote-signer-client-cert")
+		clientKey := viper.GetString("remote-signer-client-key")
+		kr, signerAccAddr, signerConn, err := newKeyringFromRemoteSigner(ctx, keyName, remoteSignerAddr, caCert, clientCert, clientKey)
 		if err != nil {
 			return fmt.Errorf("failed to initialize remote signer keyring: %w", err)
 		}
@@ -727,7 +726,7 @@ func (c *Client) RestorePrimaryEndpointsPeriodically(ctx context.Context, wg *sy
 			return
 		case <-ticker.C:
 			c.tryRestorePrimaryRPCEndpoint(ctx)
-                        c.tryRestorePrimaryGRPCEndpoint(ctx)
+			c.tryRestorePrimaryGRPCEndpoint(ctx)
 		}
 	}
 }

reporter/client/remote_signer_keyring.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 
 	signerv1 "github.com/tellor-io/bridge-remote-signer/api/gen/signer/v1"
+	bridgetls "github.com/tellor-io/bridge-remote-signer/api/tls"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 
@@ -184,8 +185,20 @@ var _ keyring.Keyring = (*remoteSignerKeyring)(nil)
 // newKeyringFromRemoteSigner dials the remote signer at addr, fetches the public key
 // and bech32 address, and returns a keyring backed by the remote signer along with
 // the account address. The returned grpc.ClientConn must be closed when done.
-func newKeyringFromRemoteSigner(ctx context.Context, keyName, addr string) (keyring.Keyring, sdk.AccAddress, *grpc.ClientConn, error) {
-	conn, err := grpc.NewClient(addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+// When caCert, clientCert, and clientKey are all non-empty, mTLS is used;
+// otherwise the connection falls back to insecure (for local/test use only).
+func newKeyringFromRemoteSigner(ctx context.Context, keyName, addr, caCert, clientCert, clientKey string) (keyring.Keyring, sdk.AccAddress, *grpc.ClientConn, error) {
+	var dialOpt grpc.DialOption
+	if caCert != "" && clientCert != "" && clientKey != "" {
+		creds, err := bridgetls.NewClientCredentials(caCert, clientCert, clientKey, "bridge-signer")
+		if err != nil {
+			return nil, nil, nil, fmt.Errorf("load mTLS credentials: %w", err)
+		}
+		dialOpt = grpc.WithTransportCredentials(creds)
+	} else {
+		dialOpt = grpc.WithTransportCredentials(insecure.NewCredentials())
+	}
+	conn, err := grpc.NewClient(addr, dialOpt)
 	if err != nil {
 		return nil, nil, nil, fmt.Errorf("dial remote signer at %s: %w", addr, err)
 	}