Documentation
¶
Overview ¶
Package servertls serves the gateway's own listener over TLS from PEM files that are re-read when they change on disk, so a rotated certificate takes effect without a restart. It covers inbound connections only; outbound trust lives in internal/httpclient.
Index ¶
Constants ¶
const DefaultCheckInterval = 5 * time.Second
DefaultCheckInterval is how often, at most, the files are checked for a change. A rotation is picked up by the first handshake after it.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Settings ¶
type Settings struct {
// CertFile and KeyFile hold the serving certificate (with any
// intermediates after it) and its private key. Both or neither.
CertFile string
KeyFile string
// ClientCAFile, when set, verifies every client certificate presented
// against the CAs in this bundle (mTLS). A handshake without one still
// completes, so the health probes can get through; the HTTP layer rejects
// every other request that lacks a verified certificate.
ClientCAFile string
}
Settings names the PEM files the listener serves from. The zero value means plain HTTP.
type Source ¶
type Source struct {
// contains filtered or unexported fields
}
Source hands each TLS handshake the configuration built from the files' current contents.
The files are polled rather than watched. A handshake that finds the last check older than the interval stats the files, and only a changed stat (another inode, size, or modification time) re-reads them. Polling needs no goroutine to stop when a reload replaces the server, follows the symlink swap Kubernetes uses to update a mounted Secret (which file watchers commonly miss once the watched link target is deleted), and costs every other handshake one atomic load. A rotation therefore lands within the interval of the next handshake, which is far inside any certificate's renewal window.
A failed reload, such as a pair caught half written, keeps the last good configuration and logs a warning; it never stops the listener.
func New ¶
New loads settings for the first time. Unlike a later reload, a missing or unusable file is an error, so a typo fails startup instead of serving nothing.
func (*Source) Leaf ¶
func (s *Source) Leaf() *x509.Certificate
Leaf returns the certificate currently served.
func (*Source) MutualTLS ¶
MutualTLS reports whether requests must carry a verified client certificate.
func (*Source) ServerConfig ¶
ServerConfig returns the configuration to wrap the listener with. It carries no certificate of its own: every handshake asks the Source.
Source Files