# Backtesting Service TLS Quick Start

## Enable TLS in Docker

Edit `.env` or `docker-compose.yml`:

```bash
TLS_ENABLED=true
TLS_CERT_PATH=/tmp/foxhunt/certs/server-cert.pem
TLS_KEY_PATH=/tmp/foxhunt/certs/server-key.pem
TLS_CA_PATH=/tmp/foxhunt/certs/ca/ca-cert.pem
TLS_REQUIRE_CLIENT_CERT=true
```

## Generate Development Certificates

```bash
# Create certificate directory
mkdir -p /tmp/foxhunt/certs/ca

# Generate CA key and certificate
openssl genrsa -out /tmp/foxhunt/certs/ca/ca-key.pem 4096
openssl req -new -x509 -days 365 -key /tmp/foxhunt/certs/ca/ca-key.pem \
  -out /tmp/foxhunt/certs/ca/ca-cert.pem \
  -subj "/CN=Foxhunt CA/O=Foxhunt Trading/OU=Infrastructure"

# Generate server key and CSR
openssl genrsa -out /tmp/foxhunt/certs/server-key.pem 2048
openssl req -new -key /tmp/foxhunt/certs/server-key.pem \
  -out /tmp/foxhunt/certs/server.csr \
  -subj "/CN=backtesting_service/O=Foxhunt Trading/OU=trading"

# Sign server certificate with CA
openssl x509 -req -in /tmp/foxhunt/certs/server.csr \
  -CA /tmp/foxhunt/certs/ca/ca-cert.pem \
  -CAkey /tmp/foxhunt/certs/ca/ca-key.pem \
  -CAcreateserial -out /tmp/foxhunt/certs/server-cert.pem \
  -days 365 -sha256

# Generate client key and CSR
openssl genrsa -out /tmp/foxhunt/certs/client-key.pem 2048
openssl req -new -key /tmp/foxhunt/certs/client-key.pem \
  -out /tmp/foxhunt/certs/client.csr \
  -subj "/CN=api_gateway/O=Foxhunt Trading/OU=trading"

# Sign client certificate with CA
openssl x509 -req -in /tmp/foxhunt/certs/client.csr \
  -CA /tmp/foxhunt/certs/ca/ca-cert.pem \
  -CAkey /tmp/foxhunt/certs/ca/ca-key.pem \
  -CAcreateserial -out /tmp/foxhunt/certs/client-cert.pem \
  -days 365 -sha256

# Set permissions
chmod 644 /tmp/foxhunt/certs/*.pem
chmod 600 /tmp/foxhunt/certs/*-key.pem
```

## Start Service

```bash
docker-compose up -d backtesting_service
```

## Verify TLS

```bash
# Check logs for TLS initialization
docker logs foxhunt-backtesting-service | grep "TLS"

# Expected output:
# TLS Configuration:
#   TLS Enabled: true
#   Certificate Path: /tmp/foxhunt/certs/server-cert.pem
#   Key Path: /tmp/foxhunt/certs/server-key.pem
#   CA Cert Path: /tmp/foxhunt/certs/ca/ca-cert.pem
#   Require Client Cert: true
# ✅ TLS enabled - configuring mTLS for gRPC server
```

## Test Connection

```bash
# Test with grpcurl (requires client certificates)
grpcurl \
  -cacert /tmp/foxhunt/certs/ca/ca-cert.pem \
  -cert /tmp/foxhunt/certs/client-cert.pem \
  -key /tmp/foxhunt/certs/client-key.pem \
  localhost:50053 \
  grpc.health.v1.Health/Check
```

## Disable TLS (Development Only)

```bash
TLS_ENABLED=false
```

---

**Security Warning**: Development certificates are for testing only. Use proper CA-signed certificates in production.