Documentation
¶
Overview ¶
Package certs picks the TLS certificate of a host.
The selection is deliberately deterministic and explainable: every result carries the class it was matched by and the pattern that matched, so the log line says *why* a host ended up with a certificate.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var AutoSpec = Spec{Mode: ModeAuto, Raw: "auto"}
AutoSpec is the default: pick the best matching certificate.
Functions ¶
func Hash ¶
func Hash(list []npm.Certificate) string
Hash summarises a certificate list so a change (a new certificate, a renewal, a deletion) can trigger a reconcile run.
Types ¶
type Class ¶
type Class int
Class ranks how well a certificate fits a set of domains. Lower is better.
const ( // ClassExactOnly means the certificate covers exactly these domains. ClassExactOnly Class = iota + 1 // ClassExactExtra means every domain matches exactly, plus further SANs. ClassExactExtra // ClassMixed means every domain is covered, some exactly, some by a // wildcard. ClassMixed // ClassWildcard means every domain is covered by a wildcard. ClassWildcard // ClassNone means the certificate does not cover the domains. ClassNone )
The match classes, best first.
type Mode ¶
type Mode int
Mode is what a `certificate` label asks for.
const ( // ModeAuto picks the best matching certificate (the default). ModeAuto Mode = iota // ModeID pins a certificate id. ModeID // ModeDomain names a domain the certificate must cover. ModeDomain // ModeName names a certificate by its nice_name ("name:My wildcard"). ModeName // ModeNew requests a fresh Let's Encrypt certificate. ModeNew // ModeNone deliberately attaches no certificate. ModeNone )
The accepted certificate modes.
type Options ¶
type Options struct {
// Current is the certificate id the live resource already carries.
Current int
// Partial is the policy when no certificate covers every domain.
Partial Partial
// Now is the reference time for expiry checks (zero means time.Now).
Now time.Time
}
Options tune the automatic selection.
type Partial ¶
type Partial string
Partial is the policy for domains no single certificate covers.
const ( // PartialPrimary uses a certificate for the first domain and warns about // the rest (the default). PartialPrimary Partial = "primary" // PartialNone attaches no certificate at all. PartialNone Partial = "none" )
The partial-coverage policies.
func ParsePartial ¶
ParsePartial resolves NPM_CERTIFICATE_PARTIAL.
type Selection ¶
type Selection struct {
// ID is the certificate to attach, 0 for none.
ID int
// New requests a fresh Let's Encrypt certificate.
New bool
// Class is how the certificate matched.
Class Class
// Pattern is the certificate domain that matched the first host domain.
Pattern string
// Uncovered lists host domains the certificate does not cover.
Uncovered []string
// Kept reports that an already attached certificate was retained.
Kept bool
}
Selection is the outcome of a certificate lookup.
func Resolve ¶
Resolve turns a spec into a concrete certificate id.
For ModeAuto the candidates are ranked by class, then by remaining validity, then by id; an already attached certificate that is still valid and still covers the domains is kept unless a candidate matches in a strictly better class, so a newly imported wildcard cannot shuffle existing hosts around.
Source Files