Documentation
¶
Overview ¶
Package ingress reconciles the local Caddy ingress to match desired state.
The agent is the only thing that talks to Caddy: it pushes the full runtime config (per-Egg routes and the on-demand TLS policy) through Caddy's admin API, and it serves the "ask" endpoint that Caddy calls before issuing a certificate for any hostname. The ask endpoint says yes only for hostnames currently in the desired state, so a certificate is never minted for a domain that is not ours to serve. Nothing configures Caddy by rewriting files and nothing reaches in from the control plane; this mirrors the pull-based model of the rest of the agent.
Locally Caddy uses its INTERNAL CA (its own issuer), so certificates are real TLS but need no Let's Encrypt, which cannot issue for these test hostnames.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Reconciler ¶
type Reconciler struct {
// contains filtered or unexported fields
}
Reconciler owns the connection to Caddy's admin API and the ask allow-list.
func New ¶
func New(adminURL, upstreamHost, askEndpoint string, localTLS bool, log *slog.Logger) *Reconciler
New builds a Reconciler. adminURL is the Caddy admin API base; upstreamHost is how Caddy dials Egg containers; askEndpoint is the URL (reachable from Caddy) of this agent's ask handler; localTLS selects the internal CA for local dev instead of Let's Encrypt.
func (*Reconciler) Allowed ¶
func (r *Reconciler) Allowed(host string) bool
Allowed reports whether a hostname is currently permitted a certificate.
func (*Reconciler) AskHandler ¶
func (r *Reconciler) AskHandler() http.HandlerFunc
AskHandler answers Caddy's on-demand TLS ask: 200 for an allowed hostname, 403 otherwise. Caddy passes the hostname as ?domain=.
Source Files