Documentation
¶
Index ¶
- Variables
- func BrowserStoresMissingCA() []string
- func BrowserTrustAvailable() bool
- func CAPresentButUntrusted() bool
- func CARoot() (string, error)
- func CATrusted() bool
- func EnsureCA() error
- func EnsureCert(site config.Site) error
- func InstallBrowserTrust() []error
- func IssueCert(primaryDomain string, allDomains []string, certsDir string) error
- func IssueCertForce(primaryDomain string, allDomains []string, certsDir string) error
- func ReissueCertForWorktree(site config.Site) error
- func RemoveBrowserTrust()
- func RemoveSiteCerts(domain string)
- func SecureSite(site config.Site) error
- func SystemTrustAnchorPresent() bool
- func TrustCAInSystemStore(caPEM []byte) error
- func UnsecureSite(site config.Site) error
- func UntrustCAFromSystemStore(caPEM []byte) error
- func WorktreeCertDomains(siteDomains []string, worktreeDomains []string) []string
Constants ¶
This section is empty.
Variables ¶
var ErrDNSDisabled = fmt.Errorf("HTTPS requires lerd-managed DNS, set dns.enabled: true and re-run lerd install")
ErrDNSDisabled signals that the operation requires the lerd-managed DNS / mkcert CA stack, which the user has opted out of. Surfaces through the CLI `lerd secure` command and the dashboard HTTPS toggle.
var ErrNoSystemTrustStore = errors.New("no system CA trust store found")
ErrNoSystemTrustStore reports that no known CA anchor directory exists on this system, as on NixOS and other distros where trust is declarative.
var RegenerateHostProxyWorktreeVhost func(site config.Site, wtPath, wtDomain string, secured bool) error
RegenerateHostProxyWorktreeVhost regenerates the proxy vhost for a single worktree of a host-proxy site, switching it between HTTP and HTTPS. It is populated by the cli package (which owns host-proxy port allocation) so certs can do this without importing cli. nil in builds that don't link cli, in which case host-proxy worktree vhosts are left untouched.
Functions ¶
func BrowserStoresMissingCA ¶ added in v1.32.0
func BrowserStoresMissingCA() []string
BrowserStoresMissingCA returns the NSS databases that do not hold the root CA lerd signs with. A browser reading one of those warns on every .test site even though curl, PHP and openssl are happy, which is the state certutil's mere presence on PATH says nothing about.
Empty when every store has it, and equally empty when the question could not be asked: no certutil to ask with, no CA generated yet, or no browser store on the machine. An unanswered check is not a finding. The exported certificate is compared as DER rather than trusted for carrying the right nickname, so a CA regenerated after a store imported the old one reports as missing.
func BrowserTrustAvailable ¶ added in v1.29.0
func BrowserTrustAvailable() bool
BrowserTrustAvailable reports whether certutil (nss-tools) is there to put the root CA into the browser NSS stores. Without it only the system store trusts .test, so curl and PHP are fine but Firefox and Chrome warn.
func CAPresentButUntrusted ¶ added in v1.32.0
func CAPresentButUntrusted() bool
CAPresentButUntrusted reports the drifted state that let a reinstall silently skip re-establishing trust (see ca_trust_darwin.go): mkcert's root CA sits in a platform certificate store — so mkcert's own "already installed" self-check may treat it as already handled — but the store no longer trusts it. Always false when CATrusted() already reports true, when the trust state could not be read (an unanswered check is not a finding, and acting on one would prompt for the repair on every run), or on a platform with no platformPresenceCheck wired (only darwin has a presence/trust gap to detect; a Linux bundle hit is the trust decision).
func CARoot ¶ added in v1.31.0
CARoot returns mkcert's CAROOT directory, so a caller escalating to root can name the user's real CA location instead of assuming the default.
func CATrusted ¶ added in v1.28.0
func CATrusted() bool
CATrusted reports whether mkcert's root CA is already trusted by the system: actually configured as a trusted root, not merely present in a keychain or store. Callers use it to skip the sudo announcement (and mkcert's chatty banner) on a reinstall where the CA is already trusted.
A platform store that could not be read is not a store that said "untrusted": same rule as CAPresentButUntrusted, and without it a host whose export keeps failing is walked through the privileged reinstall on every run.
func EnsureCA ¶ added in v1.38.0
func EnsureCA() error
EnsureCA generates the root CA unless CAROOT already holds one. A CAROOT with only one of the two files is refused: generating over it would orphan every certificate the missing half signed or verified.
func EnsureCert ¶ added in v1.28.0
EnsureCert reuses the site's existing certificate when it is still valid and clear of the reissue window, otherwise reissues one covering the site's own domains plus every current worktree domain. Unlike ReissueCertForWorktree it never forces, so it is cheap to call on every boot/watcher pass as the routine self-heal that keeps a long-lived secured site's leaf cert from expiring.
func InstallBrowserTrust ¶ added in v1.38.0
func InstallBrowserTrust() []error
InstallBrowserTrust imports the root CA, under mkcert's nickname, into every NSS database that does not trust it as an SSL CA, which also restores trust flags cleared on a stored copy. Returns the stores that refused.
func IssueCert ¶
IssueCert issues a certificate named after primaryDomain covering every domain and its wildcard. An existing pair is reused only while it is valid and clear of certReissueWindow, so a start or watcher pass self-heals an aging cert.
func IssueCertForce ¶ added in v1.20.0
IssueCertForce regenerates the certificate even if files exist, renaming atomically so a failure keeps the previous pair: a missing cert trips RepairVhosts into flipping the site to plain HTTP.
func ReissueCertForWorktree ¶ added in v1.20.0
ReissueCertForWorktree reissues the site's TLS certificate to include wildcard SANs for all current worktree domains (*.branch.domain.test). Call this after a new worktree is created on a secured site so that subdomains like app.branch.domain.test are covered by the certificate.
func RemoveBrowserTrust ¶ added in v1.38.0
func RemoveBrowserTrust()
RemoveBrowserTrust deletes the root CA from every NSS database holding it.
func RemoveSiteCerts ¶ added in v1.33.0
func RemoveSiteCerts(domain string)
RemoveSiteCerts deletes a domain's certificate pair. Site certs live in the sites/ subdirectory, so a caller building the path from CertsDir alone silently removes nothing.
func SecureSite ¶ added in v0.1.29
SecureSite issues a TLS certificate for the site and switches its nginx vhost to HTTPS.
func SystemTrustAnchorPresent ¶ added in v1.31.0
func SystemTrustAnchorPresent() bool
SystemTrustAnchorPresent reports whether an anchor lerd put there is on disk, so an uninstall only escalates to root when there is something to remove.
func TrustCAInSystemStore ¶ added in v1.31.0
TrustCAInSystemStore installs the given mkcert root CA PEM into whichever system trust store this distro uses. The caller must be root. Idempotent: a byte-identical CA already in place is a no-op, so re-running on every package upgrade is cheap.
mkcert normally does this itself via an interactive sudo, which a package maintainer script cannot answer. `lerd bootstrap --trust-ca` runs as root and installs the user-generated CA directly instead.
func UnsecureSite ¶ added in v0.1.29
UnsecureSite regenerates a plain HTTP vhost for the site, removing TLS.
func UntrustCAFromSystemStore ¶ added in v1.31.0
UntrustCAFromSystemStore removes, as root, the anchor TrustCAInSystemStore wrote and any other holding caPEM's certificate, since installs before #1194 let mkcert write its own under a name only mkcert knew.
func WorktreeCertDomains ¶ added in v1.20.0
WorktreeCertDomains builds the full domain list for a certificate that covers the site's own domains plus all worktree domains. Each domain gets a wildcard entry via IssueCert, so worktree domains like branch.myapp.test produce *.branch.myapp.test SANs for deep subdomain coverage.
Types ¶
This section is empty.
Source Files