Documentation
¶
Overview ¶
Package mtls serves the app over TLS and only accepts requests from proxies that present a client certificate issued by the internal CA.
Certificates are short-lived and re-rendered by Nomad, so they are re-read on SIGHUP rather than only at start-up.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// CertFile holds the server certificate (and any intermediates).
CertFile string
// KeyFile holds the server's private key; empty means it is in CertFile.
KeyFile string
// ClientCAFile holds the CA certificates client certificates must chain to.
ClientCAFile string
// AllowedClients are the DNS names a client certificate must carry one of.
AllowedClients []string
}
Config says where the certificates live and which clients may connect.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server holds the current certificates and checks incoming requests.
func (*Server) Middleware ¶
func (s *Server) Middleware(skipPaths ...string) echo.MiddlewareFunc
Middleware rejects requests that did not present a verified client certificate for one of the allowed names. Requests for skipPaths (the health check) are let through so the orchestrator can probe without a certificate.
func (*Server) Reload ¶
Reload re-reads the certificates from disk. On error the previous ones stay in use.
func (*Server) ReloadOnSIGHUP ¶
func (s *Server) ReloadOnSIGHUP() (stop func())
ReloadOnSIGHUP reloads the certificates whenever the process gets SIGHUP, which is what Nomad sends when it re-renders them. Call stop to stop listening.
Source Files
Directories