certs

type ACMECertificateProvider struct {
	// AutoCertManager manages TLS certificates automatically using the ACME protocol,
	// Enables integration with Let's Encrypt or other ACME-compatible providers.
	//
	// Default: nil
	AutoCertManager *autocert.Manager `json:"auto_cert_manager"`

	// TLSMinVersion allows to set TLS minimum version.
	//
	// Default: tls.VersionTLS12
	// WARNING: TLS1.0 and TLS1.1 versions are not supported.
	TLSMinVersion uint16 `json:"tls_min_version"`
}

type ClientCertificateProvider struct {
	// Certificate is either a path to a file or the content of the file instead.
	//
	// It must contain, in order, in PEM format the certificate, key and any additional
	// intermediate CA certificate signing this certificate.
	//
	// Default: ""
	Certificate string `json:"certificate"`

	// RootCertificates is either a path to a file or the content of the file instead.
	//
	// It must contain in PEM format a list of CA certificates to add to the certificate pool,
	// permitting to authenticate a remote server.
	//
	// Default: ""
	RootCertificates string `json:"root_certificates"`

	// IncludeSystemCertificates allows to inherit CA certificates from the system.
	//
	// Default: false
	IncludeSystemCertificates bool `json:"include_system_certificates"`

	// TLSMinVersion allows to set TLS minimum version.
	//
	// Default: tls.VersionTLS12
	TLSMinVersion uint16 `json:"tls_min_version"`
}

type ClientTLSProvider interface {
	// ProvideClientTLS provides possibly a *tls.Config object to be used by a client or
	// an error if it fails to do so.
	//
	// NOTE: Implementations may return (nil, nil) if no tls.Config can be provided and no error occurred.
	// For example when no path to a certificate is provided (empty string), instead of a wrong
	// path which will generate an error.
	ProvideClientTLS() (*tls.Config, Error)
}

type MutualTLSCustomizer struct {
	// Certificate is either a path to a file or the content of the file instead.
	// It must be a PEM encoded CA certificate.
	//
	// Default: ""
	Certificate string `json:"certificate"`
}

type MutualTLSWithCRLCustomizer struct {
	// TLSProvider is an optional ClientTLSProvider to configure the HTTP client that will fetch a CRL.
	//
	// Default: nil
	TLSProvider ClientTLSProvider `json:"tls_provider"`

	// Client is an optional resty.Client to use for fetching the CRL.
	// If nil, a new resty client will be created.
	Client *resty.Client `json:"-"`

	// Certificate is either a path to a file or the content of the file instead.
	// It must be a PEM encoded CA certificate.
	//
	// Default: ""
	Certificate string `json:"certificate"`

	// RevocationList is either a URL to, a path to or a CRL directly.
	//
	// Default: ""
	RevocationList string `json:"revocation_list"`

	// Timeout specifies the HTTP request timeout when fetching a CRL.
	// Default: 10 * time.Second
	Timeout time.Duration `json:"timeout"`
}

type MutualTLSWithOCSPCustomizer struct {
	TLSProvider ClientTLSProvider `json:"tls_provider"`

	Client         *resty.Client `json:"-"`
	Certificate    string        `json:"certificate"`
	OCSPServer     string        `json:"ocsp_server"`
	Timeout        time.Duration `json:"timeout"`
	MaxResponseAge time.Duration `json:"max_response_age"`
	// contains filtered or unexported fields
}

type ServerCertificateProvider struct {
	// Certificate is either a path to a file or the content of the file instead.
	//
	// It must contain, in order, in PEM format the certificate, key and any additional
	// intermediate CA certificate signing this certificate.
	//
	// Default: ""
	Certificate string `json:"certificate"`

	// CertFile is a path of certificate file.
	// If you want to use TLS, you should enter this field or use "Certificate".
	//
	// Default: ""
	//
	// Deprecated: Use Certificate instead.
	CertFile string `json:"cert_file"`

	// KeyFile is a path of certificate's private key.
	// If you want to use TLS, you should enter this field or use "Certificate".
	//
	// Default: ""
	//
	// Deprecated: Use Certificate instead.
	CertKeyFile string `json:"cert_key_file"`

	// TLSMinVersion allows to set TLS minimum version.
	//
	// Default: tls.VersionTLS12
	// WARNING: TLS1.0 and TLS1.1 versions are not supported.
	TLSMinVersion uint16 `json:"tls_min_version"`
}

type ServerTLSCustomizer interface {
	CustomizeServerTLS(config *tls.Config) Error
}

type ServerTLSProvider interface {
	// ProvideServerTLS provides possibly a *tls.Config object to be used by a server or
	// an error if it fails to do so.
	//
	// NOTE: Implementations may return (nil, nil) if no tls.Config can be provided and no error occurred.
	// For example when no path to a certificate is provided (empty string), instead of a wrong
	// path which will generate an error.
	ProvideServerTLS() (*tls.Config, Error)
}