Documentation
¶
Overview ¶
Package server runs MyOwnPKI (PHASE1 step 12): the admin listener with TLS, the public listener for CRLs and CA certificates, and the background jobs (audit delivery and checkpoints, CRL renewal, clean-ups).
The server starts sealed. It refuses to start before init and without the auth key. Shutting down seals the keyring – with a last checkpoint – within ShutdownBudget, before a container runtime sends SIGKILL.
Index ¶
- Constants
- Variables
- func AdminCertFile(cfg config.Config) string
- func Fingerprint(der []byte) string
- type CertInfo
- type Options
- type Server
- func (s *Server) ACME() *acme.Server
- func (s *Server) ACMEAddr() string
- func (s *Server) AdminAddr() string
- func (s *Server) Listen(ctx context.Context) error
- func (s *Server) PublicAddr() string
- func (s *Server) Sealed() bool
- func (s *Server) Serve(ctx context.Context) error
- func (s *Server) Shutdown(ctx context.Context) error
- func (s *Server) Unseal(ctx context.Context, passphrase []byte, who keys.Who) error
Constants ¶
const ShutdownBudget = 8 * time.Second
ShutdownBudget: everything – requests, the last checkpoint, the seal – is done within this time. Docker and Podman send SIGKILL after 10 s (owner 2026-10-16).
Variables ¶
var ErrNotInitialized = errors.New("this instance is not initialized – run myownpki init first")
ErrNotInitialized: serve before myownpki init.
Functions ¶
func AdminCertFile ¶
AdminCertFile is the file of the certificate the admin listener serves: the operator's file or the bootstrap certificate. `myownpki healthcheck` pins it.
func Fingerprint ¶
Fingerprint is the SHA-256 of der as colon-separated upper-case hex.
Types ¶
type CertInfo ¶
type CertInfo struct {
Source string // "operator" or "bootstrap"
Fingerprint string // SHA-256, colon-separated hex – as browsers show it
NotAfter time.Time
DNSNames []string
IPs []netip.Addr
// Created: a new bootstrap certificate was made at this start (first
// start, renewal or new names) – its fingerprint changed.
Created bool
Reason string // why it was created
}
CertInfo describes the admin certificate for the log.
type Options ¶
type Options struct {
Config config.Config
Log *slog.Logger
Clock clock.Clock // nil = clock.System
Hostname string // "" = os.Hostname
Version string
}
Options configure a server.
type Server ¶
type Server struct {
CertInfo CertInfo
// contains filtered or unexported fields
}
Server is one running MyOwnPKI.
func (*Server) ACMEAddr ¶ added in v0.2.0
ACMEAddr is "" when ACME is off; else the listener's address (tests use port 0).
func (*Server) Listen ¶
Listen opens both listeners. A warning goes out when the admin listener is reachable from other machines without an allowlist.
func (*Server) PublicAddr ¶
PublicAddr is "" when the public listener is off.
func (*Server) Serve ¶
Serve runs listeners and jobs until ctx ends, then shuts down within ShutdownBudget: no new connections, in-flight requests get a few seconds, then the seal with its last checkpoint, then the databases close.
Source Files