func federationServer(name string, h http.Handler) (*http.Server, string, string, error) {
	var derBytes []byte
	srv := &http.Server{
		Addr:    ":8448",
		Handler: h,
	}
	tlsCertPath := path.Join(os.TempDir(), "complement.crt")
	tlsKeyPath := path.Join(os.TempDir(), "complement.key")
	certificateDuration := time.Hour
	priv, err := rsa.GenerateKey(rand.Reader, 4096)
	if err != nil {
		return nil, "", "", err
	}
	notBefore := time.Now()
	notAfter := notBefore.Add(certificateDuration)
	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	if err != nil {
		return nil, "", "", err
	}

	template := x509.Certificate{
		SerialNumber:          serialNumber,
		NotBefore:             notBefore,
		NotAfter:              notAfter,
		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
		Subject: pkix.Name{
			Organization:  []string{"matrix.org"},
			Country:       []string{"GB"},
			Province:      []string{"London"},
			Locality:      []string{"London"},
			StreetAddress: []string{"123 Street"},
			PostalCode:    []string{"12345"},
		},
	}
	host := docker.HostnameRunningComplement
	if ip := net.ParseIP(host); ip != nil {
		template.IPAddresses = append(template.IPAddresses, ip)
	} else {
		template.DNSNames = append(template.DNSNames, host)
	}

	if os.Getenv("COMPLEMENT_CA") == "true" {
		// Gate COMPLEMENT_CA
		var ca *x509.Certificate
		var caPrivKey *rsa.PrivateKey
		ca, caPrivKey, err = GetOrCreateCaCert()
		if err != nil {
			return nil, "", "", err
		}
		derBytes, err = x509.CreateCertificate(rand.Reader, &template, ca, &priv.PublicKey, caPrivKey)
		if err != nil {
			return nil, "", "", err
		}
	} else {
		derBytes, err = x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
		if err != nil {
			return nil, "", "", err
		}
	}

	certOut, err := os.Create(tlsCertPath)
	if err != nil {
		return nil, "", "", err
	}
	defer certOut.Close() // nolint: errcheck
	if err = pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
		return nil, "", "", err
	}

	keyOut, err := os.OpenFile(tlsKeyPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
	if err != nil {
		return nil, "", "", err
	}
	defer keyOut.Close() // nolint: errcheck
	err = pem.Encode(keyOut, &pem.Block{
		Type:  "RSA PRIVATE KEY",
		Bytes: x509.MarshalPKCS1PrivateKey(priv),
	})
	if err != nil {
		return nil, "", "", err
	}

	return srv, tlsCertPath, tlsKeyPath, nil
}
// federationServer creates a federation server with the given handler
federationServer creates a federation server with the given handler
// federationServer creates a federation server with the given handler
func federationServer(name string, h http.Handler) (*http.Server, string, string, error) {
	var derBytes []byte
	srv := &http.Server{
		Addr:    ":8448",
		Handler: h,
	}
	tlsCertPath := path.Join(os.TempDir(), "complement.crt")
	tlsKeyPath := path.Join(os.TempDir(), "complement.key")
	certificateDuration := time.Hour
	priv, err := rsa.GenerateKey(rand.Reader, 4096)
	if err != nil {
		return nil, "", "", err
	}
	notBefore := time.Now()
	notAfter := notBefore.Add(certificateDuration)
	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	if err != nil {
		return nil, "", "", err
	}
	template := x509.Certificate{
		SerialNumber:          serialNumber,
		NotBefore:             notBefore,
		NotAfter:              notAfter,
		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
		Subject: pkix.Name{
			Organization:  []string{"matrix.org"},
			Country:       []string{"GB"},
			Province:      []string{"London"},
			Locality:      []string{"London"},
			StreetAddress: []string{"123 Street"},
			PostalCode:    []string{"12345"},
		},
	}
	host := docker.HostnameRunningComplement
	if ip := net.ParseIP(host); ip != nil {
		template.IPAddresses = append(template.IPAddresses, ip)
	} else {
		template.DNSNames = append(template.DNSNames, host)
	}
	if os.Getenv("COMPLEMENT_CA") == "true" {
		var ca *x509.Certificate
		var caPrivKey *rsa.PrivateKey
		ca, caPrivKey, err = GetOrCreateCaCert()
		if err != nil {
			return nil, "", "", err
		}
		derBytes, err = x509.CreateCertificate(rand.Reader, &template, ca, &priv.PublicKey, caPrivKey)
		if err != nil {
			return nil, "", "", err
		}
	} else {
		derBytes, err = x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
		if err != nil {
			return nil, "", "", err
		}
	}
	certOut, err := os.Create(tlsCertPath)
	if err != nil {
		return nil, "", "", err
	}
	defer certOut.Close() 
	if err = pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
		return nil, "", "", err
	}
	keyOut, err := os.OpenFile(tlsKeyPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
	if err != nil {
		return nil, "", "", err
	}
	defer keyOut.Close() 
	err = pem.Encode(keyOut, &pem.Block{
		Type:  "RSA PRIVATE KEY",
		Bytes: x509.MarshalPKCS1PrivateKey(priv),
	})
	if err != nil {
		return nil, "", "", err
	}
	return srv, tlsCertPath, tlsKeyPath, nil
}
func federationServer ( name string , h http . Handler ) ( * http . Server , string , string , error ) { var derBytes [ ] byte srv := & http . Server { Addr : " " , Handler : h , } tlsCertPath := path . Join ( os . TempDir ( ) , " " ) tlsKeyPath := path . Join ( os . TempDir ( ) , " " ) certificateDuration := time . Hour priv , err := rsa . GenerateKey ( rand . Reader , 4096 ) if err != nil { return nil , " " , " " , err } notBefore := time . Now ( ) notAfter := notBefore . Add ( certificateDuration ) serialNumberLimit := new ( big . Int ) . Lsh ( big . NewInt ( 1 ) , 128 ) serialNumber , err := rand . Int ( rand . Reader , serialNumberLimit ) if err != nil { return nil , " " , " " , err } template := x509 . Certificate { SerialNumber : serialNumber , NotBefore : notBefore , NotAfter : notAfter , KeyUsage : x509 . KeyUsageKeyEncipherment | x509 . KeyUsageDigitalSignature , ExtKeyUsage : [ ] x509 . ExtKeyUsage { x509 . ExtKeyUsageServerAuth } , BasicConstraintsValid : true , Subject : pkix . Name { Organization : [ ] string { " " } , Country : [ ] string { " " } , Province : [ ] string { " " } , Locality : [ ] string { " " } , StreetAddress : [ ] string { " " } , PostalCode : [ ] string { " " } , } , } host := docker . HostnameRunningComplement if ip := net . ParseIP ( host ) ; ip != nil { template . IPAddresses = append ( template . IPAddresses , ip ) } else { template . DNSNames = append ( template . DNSNames , host ) } if os . Getenv ( " " ) == " " { var ca * x509 . Certificate var caPrivKey * rsa . PrivateKey ca , caPrivKey , err = GetOrCreateCaCert ( ) if err != nil { return nil , " " , " " , err } derBytes , err = x509 . CreateCertificate ( rand . Reader , & template , ca , & priv . PublicKey , caPrivKey ) if err != nil { return nil , " " , " " , err } } else { derBytes , err = x509 . CreateCertificate ( rand . Reader , & template , & template , & priv . PublicKey , priv ) if err != nil { return nil , " " , " " , err } } certOut , err := os . Create ( tlsCertPath ) if err != nil { return nil , " " , " " , err } defer certOut . Close ( ) if err = pem . Encode ( certOut , & pem . Block { Type : " " , Bytes : derBytes } ) ; err != nil { return nil , " " , " " , err } keyOut , err := os . OpenFile ( tlsKeyPath , os . O_WRONLY | os . O_CREATE | os . O_TRUNC , 0600 ) if err != nil { return nil , " " , " " , err } defer keyOut . Close ( ) err = pem . Encode ( keyOut , & pem . Block { Type : " " , Bytes : x509 . MarshalPKCS1PrivateKey ( priv ) , } ) if err != nil { return nil , " " , " " , err } return srv , tlsCertPath , tlsKeyPath , nil }
federationServer creates a federation server with the given handler
federationServer creates a federation server with the given handler
// Gate COMPLEMENT_CA // nolint: errcheck // nolint: errcheck