initial POC for grpc tls

[jhawk28]

Initial concept for gRPC tls support

[a26nine]

I was able to sync a light node with:

[Core]
  IP = "xxx.celestia-mainnet.quiknode.pro"
  RPCPort = "443"
  GRPCPort = "9090"
  EnableTLS = true

using this build.

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 57.89474% with 8 lines in your changes missing coverage. Please review.

Project coverage is 45.42%. Comparing base (2469e7a) to head (d187ddd).
Report is 376 commits behind head on main.

Files with missing lines	Patch %	Lines
nodebuilder/core/flags.go	55.55%	3 Missing and 1 partial ⚠️
state/core_access.go	66.66%	1 Missing and 2 partials ⚠️
nodebuilder/state/core.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3917      +/-   ##
==========================================
+ Coverage   44.83%   45.42%   +0.58%     
==========================================
  Files         265      307      +42     
  Lines       14620    21849    +7229     
==========================================
+ Hits         6555     9924    +3369     
- Misses       7313    10855    +3542     
- Partials      752     1070     +318     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[vgonkivs]

Without specifying valid certificates in the tls.Config object will not secure gRPC connection. By default, an empty tls.Config{} means that no certificate or private key is provided, which leads to an insecure setup.

Node already has TLS certificates handling logic here for web socket, so you can reuse the certificate for the grpc connection.

[jhawk28]

This was a proof of concept to get the Light node working against a Quicknode celestia endpoint. QN doesn't support client certs. gRPC auth for a QN endpoint occurs over the x-token header

[vgonkivs]

One more point here is the solution is not generic. You may not support the certificates but if someone does, the connection won't be established. Also, it is recommended to manually specify the MinTLSVersion(linter confirmed it)

[vgonkivs]

let's avoid growing the node's config. We have an env variable that signals that TLS should be enabled.

[jhawk28]

I just wanted to create a POC. My recommended approach would be to have a RPC url and gRPC url.