Documentation
¶
Overview ¶
Package webtls resolves and runs Ken's TLS posture. Three modes, chosen by KEN_TLS:
- off — plain HTTP. Valid ONLY behind a reverse proxy that terminates TLS.
- acme — in-process Let's Encrypt via autocert: automatic issuance AND renewal, certs cached on disk. Needs KEN_TLS_DOMAINS (+ KEN_TLS_EMAIL).
- file — an operator-supplied PEM cert/key (KEN_TLS_CERT/KEN_TLS_KEY), hot-reloaded when the files change on disk (so a renewal needs no restart).
In the two TLS modes it also runs a plain-HTTP listener (default :80) that serves ACME HTTP-01 challenges and 301-redirects everything else to HTTPS, so a user who types http:// still lands on the encrypted site.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
Mode Mode
Addr string // main app listener: plain HTTP in off mode, HTTPS otherwise
HTTPAddr string // plain-HTTP redirect + ACME HTTP-01 listener (TLS modes; "" disables)
Domains []string // cert host allowlist (acme mode; also gates the HTTPS redirect)
Email string // ACME account email (acme mode; recommended, optional)
CacheDir string // ACME certificate cache directory (acme mode)
CertFile string // PEM certificate (file mode)
KeyFile string // PEM private key (file mode)
QuietHandshake bool // suppress benign "TLS handshake error" scanner noise in the log
}
Config is the resolved TLS configuration.
func FromEnv ¶
FromEnv resolves the TLS configuration from KEN_TLS* environment variables. addr is the main listen address already resolved from --addr / KEN_ADDR (empty accepts the mode default: :8080 plain, :443 with TLS). dataDir seeds the default ACME cache directory (<dataDir>/acme). It fails fast on an invalid combination.
func (Config) Build ¶
func (c Config) Build(appHandler http.Handler, tune func(*http.Server), acmeDomains func() []string) (*Servers, error)
Build constructs the server(s) for c. appHandler is the application mux; tune (if non-nil) is applied to the main server (timeouts, etc.). Build performs the fail-fast checks: it loads the cert/key in file mode and creates the ACME cache directory in acme mode, so a misconfiguration is caught at startup. acmeDomains, when non-nil, supplies the live ACME host allowlist (from settings) so domains can change without a restart; nil uses the static c.Domains.
type Servers ¶
type Servers struct {
// contains filtered or unexported fields
}
Servers holds the running listeners so the caller keeps control of shutdown.
Source Files