Documentation
¶
Overview ¶
Package certstore keeps the edge's certificates, ACME account, and challenge data where several edges can share them: a Vault KV v2 path, with the edge's own disk as the copy it serves from when Vault cannot be reached (Shared).
Index ¶
- type Remote
- type Shared
- func (s *Shared) Delete(ctx context.Context, key string) error
- func (s *Shared) Exists(ctx context.Context, key string) bool
- func (s *Shared) List(ctx context.Context, prefix string, recursive bool) ([]string, error)
- func (s *Shared) Load(ctx context.Context, key string) ([]byte, error)
- func (s *Shared) Lock(ctx context.Context, name string) error
- func (s *Shared) Run(ctx context.Context)
- func (s *Shared) Seed(ctx context.Context)
- func (s *Shared) Stat(ctx context.Context, key string) (certmagic.KeyInfo, error)
- func (s *Shared) Status() map[string]any
- func (s *Shared) Store(ctx context.Context, key string, value []byte) error
- func (s *Shared) Unlock(ctx context.Context, name string) error
- func (s *Shared) WriteMetrics(w *metrics.Writer)
- type Vault
- func (v *Vault) Delete(ctx context.Context, key string) error
- func (v *Vault) Exists(ctx context.Context, key string) bool
- func (v *Vault) List(ctx context.Context, prefix string, recursive bool) ([]string, error)
- func (v *Vault) Load(ctx context.Context, key string) ([]byte, error)
- func (v *Vault) Lock(ctx context.Context, name string) error
- func (v *Vault) Stat(ctx context.Context, key string) (certmagic.KeyInfo, error)
- func (v *Vault) Store(ctx context.Context, key string, value []byte) error
- func (v *Vault) Unlock(ctx context.Context, name string) error
- type VaultConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Shared ¶
type Shared struct {
// contains filtered or unexported fields
}
Shared is certmagic.Storage on the edge's disk and a store the edges share. The shared store is the truth: every read asks it first, so a certificate another edge obtained or renewed is used, and keeps a copy on disk; every write goes to disk, then to the shared store. A key the shared store does not have is not there, unless this edge wrote it while the store was down and has not got it there yet (pending).
When the shared store cannot be reached, the disk serves alone: the edge keeps its certificates, renews them by itself (the shared lock falls back to the disk's), and writes what the store missed once it is back. An unreachable store is not asked again for downFor, so boot does not wait on it call after call. Run first writes what the disk has and the store does not: an edge that kept its certificates on disk before shares them, rather than order them again.
func (*Shared) List ¶
List is what the shared store has under prefix, and the pending keys there; the disk's, when the store is down.
func (*Shared) Lock ¶
Lock takes the shared lock, so two edges do not order the same certificate at once; with the store down, the disk's.
func (*Shared) Seed ¶
Seed marks the keys on disk that the shared store lacks as pending, once, when the store answers.
func (*Shared) WriteMetrics ¶
type Vault ¶
type Vault struct {
// contains filtered or unexported fields
}
Vault is certmagic.Storage on a KV v2 path. Each key is a secret at <path>/<key> holding the value; a lock is a secret at <path>/_locks/<name>, created only where none is (check-and-set 0), so two edges cannot both take it.
func NewVault ¶
func NewVault(cfg VaultConfig) (*Vault, error)
func (*Vault) List ¶
List lists keys under prefix, as FileStorage does: with recursive, "directories" and everything under them.
func (*Vault) Lock ¶
Lock takes the lock name, waiting while another edge holds it and has refreshed it within lockTTL.
type VaultConfig ¶
type VaultConfig struct {
URL string // https://vault.example.com:8200
CA []byte // PEM: the only roots the connection trusts; empty is the system's
Mount string // the KV v2 mount, such as edge-certs
Path string // the edges' path in it, such as test/private
RoleID string // AppRole
SecretID string
}
VaultConfig is how the edge reaches its Vault path.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package vaulttest is a Vault server for tests: AppRole login and token renewal, and one KV v2 mount with check-and-set, metadata, and lists, answering as Vault does, behind TLS.
|
Package vaulttest is a Vault server for tests: AppRole login and token renewal, and one KV v2 mount with check-and-set, metadata, and lists, answering as Vault does, behind TLS. |