Documentation
¶
Overview ¶
Package server runs MyOwnPKI (PHASE1 step 12): the admin listener with TLS, the public listener for CRLs and CA certificates, and the background jobs (audit delivery and checkpoints, CRL renewal, clean-ups).
The server starts sealed. It refuses to start before init and without the auth key. Shutting down seals the keyring – with a last checkpoint – within ShutdownBudget, before a container runtime sends SIGKILL.
Index ¶
- Constants
- Variables
- func AdminCertFiles(cfg config.Config) []string
- func AgentCAProblem(ctx context.Context, db pkidb.DBTX, name string) (string, error)
- func AgentCAProblems(ctx context.Context, cfg config.Config) ([]string, error)
- func Fingerprint(der []byte) string
- func IssuerProblem(ctx context.Context, db pkidb.DBTX, issuer, setting string) (string, error)
- func NotifyChannels(cfg config.Config, hostname, release string) []notify.Channel
- func TLSIssuerProblems(ctx context.Context, cfg config.Config) ([]string, error)
- type CertInfo
- type Options
- type Server
- func (s *Server) ACME() *acme.Server
- func (s *Server) ACMEAddr() string
- func (s *Server) AdminAddr() string
- func (s *Server) AgentAddr() string
- func (s *Server) Agents() *agents.Service
- func (s *Server) Alerts() *monitor.Store
- func (s *Server) Listen(ctx context.Context) error
- func (s *Server) Notifier() *notify.Tester
- func (s *Server) PublicAddr() string
- func (s *Server) Sealed() bool
- func (s *Server) Serve(ctx context.Context) error
- func (s *Server) ServedAdminCertificate() CertInfo
- func (s *Server) Shutdown(ctx context.Context) error
- func (s *Server) Unseal(ctx context.Context, passphrase []byte, who keys.Who) error
Constants ¶
const ShutdownBudget = 8 * time.Second
ShutdownBudget: everything – requests, the last checkpoint, the seal – is done within this time. Docker and Podman send SIGKILL after 10 s (owner 2026-10-16).
Variables ¶
var ErrNotInitialized = errors.New("this instance is not initialized – run myownpki init first")
ErrNotInitialized: serve before myownpki init.
Functions ¶
func AdminCertFiles ¶ added in v0.2.2
AdminCertFiles are the files of the certificates the admin listener may serve: the operator's file, or the bootstrap certificate – and with admin.tls_issuer the issued one, which replaces the bootstrap certificate without a restart. `myownpki healthcheck` pins the served certificate to one of them.
func AgentCAProblem ¶ added in v0.3.0
AgentCAProblem says what is wrong with the CA that agent.ca names; "" = nothing. The agent CA must be an active intermediate whose EKU limit is exactly clientAuth (docs/PHASE3.md §1.1): then nothing it signs can ever act as a server, whatever a preset or a bug would put into a certificate. The listener accepts client certificates from this CA only.
func AgentCAProblems ¶ added in v0.3.0
AgentCAProblems is AgentCAProblem for cfg, read from the CA database without changing it (`config check`); nothing while the agent listener is off. An error means the database couldn't be read.
func Fingerprint ¶
Fingerprint is the SHA-256 of der as colon-separated upper-case hex.
func IssuerProblem ¶ added in v0.2.2
IssuerProblem says why the CA named in admin.tls_issuer or acme.tls_issuer (setting) must not issue a listener certificate; "" = it may, or there is no CA of that name (the engine names that problem when it refuses).
A root CA is refused (owner 2026-10-24): a root usually carries no name constraints, so a listener certificate straight from it would bypass the ones of the intermediate. The engine signs no end-entity certificate with a root anyway (CA/B BR §6.1.7); this check names the fix before the first refusal, at the start and in `config check`.
func NotifyChannels ¶ added in v0.3.3
NotifyChannels are the configured channels (also for `myownpki notify test`).
func TLSIssuerProblems ¶ added in v0.2.2
TLSIssuerProblems is IssuerProblem for both settings of cfg, read from the CA database without changing it (`config check`). An error means the database couldn't be read (not there yet, no permission, an older schema) – the check is then skipped, not failed.
Types ¶
type CertInfo ¶
type CertInfo struct {
Source string // "operator" or "bootstrap"
Fingerprint string // SHA-256, colon-separated hex – as browsers show it
NotAfter time.Time
DNSNames []string
IPs []netip.Addr
// Created: a new bootstrap certificate was made at this start (first
// start, renewal or new names) – its fingerprint changed.
Created bool
Reason string // why it was created
}
CertInfo describes the admin certificate for the log.
type Options ¶
type Options struct {
Config config.Config
Log *slog.Logger
Clock clock.Clock // nil = clock.System
Hostname string // "" = os.Hostname
// Version is the full version line ("myownpki v0.3.2 (commit …)") for the
// start log and the API status.
Version string
// Release is the bare release version ("v0.3.2"): it names the agent
// packages the agent listener serves and the version agents are compared
// with. Version would never match a package name.
Release string
}
Options configure a server.
type Server ¶
type Server struct {
CertInfo CertInfo
// contains filtered or unexported fields
}
Server is one running MyOwnPKI.
func (*Server) ACMEAddr ¶ added in v0.2.0
ACMEAddr is "" when ACME is off; else the listener's address (tests use port 0).
func (*Server) AgentAddr ¶ added in v0.3.0
AgentAddr is "" while the agent listener is off; else its address (tests use port 0).
func (*Server) Listen ¶
Listen opens both listeners. A warning goes out when the admin listener is reachable from other machines without an allowlist.
func (*Server) Notifier ¶ added in v0.3.3
Notifier sends the test message for the REST API; nil without monitoring.
func (*Server) PublicAddr ¶
PublicAddr is "" when the public listener is off.
func (*Server) Serve ¶
Serve runs listeners and jobs until ctx ends, then shuts down within ShutdownBudget: no new connections, in-flight requests get a few seconds, then the seal with its last checkpoint, then the databases close.
func (*Server) ServedAdminCertificate ¶ added in v0.2.2
ServedAdminCertificate describes the certificate the admin listener serves now: with admin.tls_issuer the issued one while it is valid.
Source Files