ingressproxy

type ACMEBudgetReserver ¶ added in v0.3.1

type ACMEBudgetReserver interface {
	Reserve(sandboxID, hostname string) (bool, time.Duration)
}

ACMEBudgetReserver is the daemon-wide brake on new ACME orders. A nil implementation is fine: the handler treats nil as "no brake" so the hot path stays one-branch when the feature is off. The handler calls Reserve only when the ask would actually allow issuance — base-domain fast-fail and negative-cache hits don't consume budget.

Returns (true, 0) to permit, (false, retryAfter) to refuse. The retryAfter is surfaced as the HTTP Retry-After header on the 429 response so Caddy backs off coherently with the budget window.

type CustomDomainResolver ¶ added in v0.3.1

type CustomDomainResolver interface {
	ResolveCustomDomain(ctx context.Context, hostname string) (string, error)
}

CustomDomainResolver is the narrow lookup the ask handler needs. In PR #2 it is backed by store.ResolveCustomDomain (single PK lookup); PR #3 swaps in the local Raft FSM's hostname → sandbox map so the hot path stays fully in-process across the cluster. The interface intentionally returns store.ErrNotFound on miss so the handler treats both backends the same.

type Deps ¶

type Deps struct {
	Resolver             PortResolver
	Logger               *slog.Logger
	MaxBufferBytes       int64
	UpstreamReadyTimeout time.Duration
	MaxPendingPerSandbox int
	MaxPendingGlobal     int
	MaxBufferBytesGlobal int64
}

Deps wires the ingress proxy to the rest of the daemon. Resolver is required; MaxBufferBytes caps how much request body is buffered while a cold-start wake is in flight; UpstreamReadyTimeout bounds the post-wake TCP-readiness probe (zero → defaultUpstreamReadyTimeout).

MaxPendingPerSandbox / MaxPendingGlobal / MaxBufferBytesGlobal cap how many cold-start requests can simultaneously hold the wake window and how much memory their buffered bodies may pin. Zero on any of them disables that specific cap (intended for tests; production wiring in cmd/sandboxd/main.go always sets all three).

type IssuanceObserver ¶ added in v0.3.1

type IssuanceObserver interface {
	Started(hostname string)
}

IssuanceObserver lets the handler signal the issuance lifecycle without depending on the concrete tracker — kept minimal so tests can stub it without dragging in expvar state.

func DefaultIssuanceTracker() IssuanceObserver

type PortResolver ¶

type PortResolver interface {
	WakeAwarePortTarget(ctx context.Context, id string, port int) (service.PortEndpoint, error)
	TouchSandbox(ctx context.Context, id string) error
	IsSandboxStarted(ctx context.Context, id string) (bool, error)
}

PortResolver is the narrow slice of *service.Service the ingress handler needs. Kept as an interface so the package is testable without standing up a real Service + Docker + store stack.

TouchSandbox bumps last_active_at so the lifecycle idle sweep does not stop a sandbox that is currently serving a long-lived request (WebSocket, SSE, long-poll). The handler calls it at request start AND on a 30s ticker for as long as the upstream proxy is running.

IsSandboxStarted is the fast preflight check used to bypass request-body buffering for warm sandboxes. Buffering exists so the body survives the cold-start wait (and to enforce MaxBufferBytes against unbounded uploads during wake), but it has no purpose when the upstream is already running — paying that cost on every warm request would cap normal POST uploads at MaxBufferBytes and add avoidable memory pressure under load. Returns store.ErrNotFound when no sandbox row matches id so the handler can surface 404 without a second store hit.

type TLSAskDeps ¶ added in v0.3.1

type TLSAskDeps struct {
	Resolver    CustomDomainResolver
	BaseDomain  string
	NegCacheTTL time.Duration
	NegCacheCap int
	Logger      *slog.Logger
	// Budget is the daemon-wide ACME issuance brake (OV5A). Nil disables
	// the brake — single-node deployments and tests that don't care
	// about LE rate limits pass nil and Reserve is skipped entirely.
	Budget ACMEBudgetReserver
	// Tracker observes the issuance lifecycle for the
	// aerolvm_acme_lock_held_seconds gauge. Nil disables tracking. Wired
	// to the package-global tracker in production via the helpers in
	// metrics.go; tests can substitute a stub.
	Tracker IssuanceObserver
}

TLSAskDeps wires the ask handler. BaseDomain is the wildcard zone served out of cfg.Domain — when set, requests for the apex or any subdomain pass through with 200 as defense in depth (Caddy's wildcard policy should already match first, but a stray on-demand fallthrough must never trigger per-host issuance for a hostname covered by the wildcard).

NegCacheTTL and NegCacheCap bound the negative-cache footprint. Zero on either disables the cache (intended for tests).

type TLSAskHandler ¶ added in v0.3.1

type TLSAskHandler struct {
	// contains filtered or unexported fields
}

TLSAskHandler answers Caddy's on-demand TLS `ask` callback for custom hostnames. Hot path: PK-style lookup with an LRU negative cache so an SNI flood from an internet-facing scanner does not turn into per-request store traffic.

func NewTLSAskHandler(d TLSAskDeps) *TLSAskHandler

func (h *TLSAskHandler) EvictNegativeCache(host string)

func (h *TLSAskHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)