ASP.NET Core receive custom config via HTTP to configure Kestrel

ASP.NET Core abstracts configuration using IConfiguration interface. Without going into details, it collects configurations from various IConfigurationSource and layers them on top of each other, which lets us override a setting that's defined in one source in another source by defining it with the same key.

1. Implementing an IConfigurationSource

Let's implement an IConfigurationSource. We can use ConfigurationSource abstract class as our starting point. We'll use an in-memory implementation, then switch to a remote source.

class RemoteConfigurationSource : IConfigurationSource
{
    public IConfigurationProvider Build(IConfigurationBuilder builder)
    {
        return new RemoteConfigurationProvider(_options);
    }

    private class RemoteConfigurationProvider : ConfigurationProvider
    {
        public override void Load()
        {
            // TODO: fetch data from the API
            var remoteConfig = new Dictionary<string, string>
            {
                { "CertificateOptions:PfxBase64", "MIIKkQIBAz....gfQ" },
                { "CertificateOptions:Password", "secret" },
            };
            Data = remoteConfig;
        }
    }
}

Then add this to the configuration builder in the ConfigureHostConfiguration callback:

public class Program
{
    public static void Main(string[] args)
    {
        CreateHostBuilder(args).Build().Run();
    }

    public static IHostBuilder CreateHostBuilder(string[] args) =>
        Host.CreateDefaultBuilder(args)
            .ConfigureHostConfiguration(builder =>
            {
                // add new source
                builder.AddRemoteConfiguration();
            })
            .ConfigureWebHostDefaults(webBuilder =>
            {
                webBuilder.UseStartup<Startup>().UseKestrel((context, options) =>
                {
                    var certificateOptions = context.Configuration
                        .GetSection(KestrelCertificateOptions.ConfigurationKey)
                        .Get<KestrelCertificateOptions>();
                    options.ConfigureHttpsDefaults(adapterOptions =>
                        adapterOptions.ServerCertificate = certificateOptions.Certificate);
                });
            });
}

public static class ConfigurationBuilderExtensions
{
    public static IConfigurationBuilder AddRemoteConfiguration(this IConfigurationBuilder builder) =>
        builder.Add(new RemoteConfigurationSource());
}

class KestrelCertificateOptions
{
    public const string ConfigurationKey = "CertificateOptions";
    public string PfxBase64 { get; set; }
    public string Password { get; set; }
    public X509Certificate2 Certificate => new X509Certificate2(Convert.FromBase64String(PfxBase64), Password);
}

When we run the app, ASP.NET Core will load and use our in-memory configuration.

2. Fetching configuration data from an API

Now let's fetch the config from a remote API. It needs to return configuration values with sections names delimited with with a colon :. Here's the same config as JSON, filed under CertificateOptions section:

{
  "CertificateOptions:PfxBase64": "MII....oCAgfQ",
  "CertificateOptions:Password": "secret"
}

Assume the API wraps returns this data wrapped as:

{
  "Application": "MyApp",
  "LastChanged": "2021-08-09 14:38:00",
  "Data": {
    "CertificateOptions:PfxBase64": "MIIK...oCAgfQ",
    "CertificateOptions:Password": "secret"
  }
}

so we need to take only Data key into account when fetching the data.

class RemoteConfigurationSource : IConfigurationSource
{
    public IConfigurationProvider Build(IConfigurationBuilder builder)
    {
        return new RemoteConfigurationProvider();
    }

    private class RemoteConfigurationProvider : ConfigurationProvider
    {
        public override void Load()
        {
            // We cannot await this method, so have to do sync-over-async. 
            // Not an issue, because it's a one-time thing.
            var result = LoadRemoteConfig().GetAwaiter().GetResult();
            Data = result.Data;
        }

        private async Task<RemoteConfigResult> LoadRemoteConfig()
        {
            // We cannot use IHttpClientFactory here, since ServiceProvider isn't even built yet.
            using var httpClient = new HttpClient();
            // ... add headers, token to request
            return await httpClient.GetFromJsonAsync<RemoteConfigResult>("https://example.com/path/to/json");
        }
    }

    private class RemoteConfigResult
    {
        public Dictionary<string, string> Data { get; set; }
    }
}

To clean things up a bit, we can move the URL and other credentials to appsettings.json:

{
  "Logging": {
    /*...*/
  },
  "RemoteConfiguration": {
    "Url": "https://jsonkeeper.com/b/B78I",
    "ApplicationId": "myconfigappid",
    "Secret": "myconfigapisecret"
  }
}

Then build a temporary IConfiguration add as many sources as necessary, then fetch these values:

// Read credentials from appsettings.json
var remoteConfigurationOptions = new ConfigurationBuilder()
    .AddJsonFile("appsettings.json", optional: false)
    .Build()
    .GetSection(RemoteConfigurationOptions.ConfigurationKey)
    .Get<RemoteConfigurationOptions>();
    
public class RemoteConfigurationOptions
{
    public const string ConfigurationKey = "RemoteConfiguration";
    public string Url { get; set; }
    public string ApplicationId { get; set; }
    public string Secret { get; set; }
}

Then pass this object to our configuration source, which in turns passes it down to the configuration provider