Figure out a TLS solution for the JSON RPC API

[mvines]

These days browsers complain loudly when https is not used:

1. A webapp loaded over http is declared insecure
2. A webapp loaded over https cannot access http-based resources

This spells trouble for our http-only JSON RPC API. Ideally we provide the ability to run the API over https, but we may have to build an RPC proxy if the Rust crates we're using for JSON RPC can't be TLSed.

[mvines]

Apache's mod_proxy provides a reasonable workaround for now. For now we can configure one of our web servers with TLS (perhaps even solana.com) to proxy JSON RPC traffic to/from the desired network:

Setup

Create the file /etc/apache2/conf-available/solana-json-rpc-https-proxy.conf,
with the following content:

ProxyPass /api/edge http://master.testnet.solana.com:8899
ProxyPassReverse /api/edge http://master.testnet.solana.com:8899

ProxyPass /api/stable http://testnet.solana.com:8899
ProxyPassReverse /api/stable http://testnet.solana.com:8899

Then activate the reverse proxy with:

$ sudo a2enmod headers proxy_http
$ sudo a2enconf solana-json-rpc-https-proxy
$ sudo service apache2 restart

[mvines]

My plan here is to create/publish a docker image that fullnodes wanting to run the RPC service can use to easily setup a TLS reverse proxy

[mvines]

• https://github.com/solana-labs/solana-json-rpc-https-proxy
• solana-labs/obsolete-dontuse-example-webwallet@f89edad