Documentation
¶
Overview ¶
Package publiccert gives the router of a public identity origin its publicly trusted certificate (homelab identity target §5, §14 decision 2): one certificate for *.<name> and <name> (id.<name>, base.<name>, ...) obtained by ACME DNS-01 with the same client that obtains the LAN-name certificate (internal/lancert, profile Public). kombify.me names answer DNS-01 through kombify Me's responder; an own domain answers it in the owner's Cloudflare zone with the owner's DNS token from Owner custody (a token file copied into custody, or a Wallet item delivered to the node). A local-only homelab keeps the step-ca certificates and never issues one.
Index ¶
- Constants
- Variables
- func Configured(workspace string) bool
- func DefaultProvider(domain string) string
- func Domain(workspace string) (string, error)
- func Issue(ctx context.Context, workspace, directory string, ...) (lancert.State, error)
- func RefreshRouter(ctx context.Context, workspace string) error
- func Remove(ctx context.Context, workspace string) error
- func Renew(ctx context.Context, workspace string) (bool, error)
- func RenewalFailing(workspace string, now time.Time, window time.Duration) (time.Time, bool)
- func SaveProvider(workspace, provider string, token DNSToken) error
- func TLSOptions(workspace string, fallback []string) []byte
- func WriteRouterPolicy(workspace string, create bool) error
- type DNSToken
Constants ¶
const ( ProviderMe = "kombify-me" ProviderCloudflare = "cloudflare" )
DNS providers of the DNS-01 challenge.
const BaseTLSOptions = "tls:\n options:\n stackkit-komodo:\n minVersion: VersionTLS13\n sniStrict: true\n"
BaseTLSOptions is the router's TLS policy (the Komodo control listener's minimum version); the public certificate is added to it.
Variables ¶
var ErrRouterNotRefreshed = errors.New("publiccert: the router policy was not refreshed")
ErrRouterNotRefreshed marks a policy refresh that could not read the router's routes; the existing policy stays in place and the signer retries.
Functions ¶
func Configured ¶
Configured reports whether a DNS-01 provider is already recorded.
func DefaultProvider ¶
DefaultProvider is the DNS-01 provider for a domain: kombify Me for a kombify.me name, Cloudflare for an own domain.
func Issue ¶
func Issue(ctx context.Context, workspace, directory string, eab *acme.ExternalAccountBinding, contact string) (lancert.State, error)
Issue obtains or renews the public-names certificate and rewrites the router's policy file.
func RefreshRouter ¶
RefreshRouter rewrites the router's policy file once the Basement core was applied; before that the apply writes it. When the certificate no longer serves, it reads the running routes from the router's API and adds the step-ca fallback for the covered hosts whose routes name no resolver. When the API cannot be read (the router is stopped or restarting), the existing policy stays as it is, so an installed fallback router is never dropped without its replacement, and the error carries ErrRouterNotRefreshed, so the signer retries soon.
func Remove ¶
Remove deletes the certificate, its key, the ACME account and the DNS token copy and returns the router policy to its step-ca certificates: the routes the certificate covered fall back to step-ca at once. A Wallet item stays in the node's Wallet custody.
func Renew ¶
Renew renews the certificate within 30 days of its expiry with the ACME account in custody, on the identity signer's cadence. A node that never issued one, or a local-only one, renews nothing. The router policy is refreshed after every attempt, not only after a renewal: a certificate that stops serving (it expires after failed renewals) leaves the policy here, and the routes it covered fall back to step-ca, instead of at the next apply.
func RenewalFailing ¶
RenewalFailing is the installed certificate's expiry when it is within window of it although the node renews 30 days ahead: renewals kept failing. A node without one, or a local-only one, reports nothing.
func SaveProvider ¶
SaveProvider records which DNS answers the DNS-01 challenge. A Cloudflare token file goes to Owner custody (0600) and is never printed; a Wallet item is recorded by reference and must already be in this node's custody.
func TLSOptions ¶
TLSOptions is the router's policy file: the base policy plus the public certificate while it serves the identity host (the same decision that moves the router's ACME store), or, once it no longer serves, the step-ca fallback router for the hosts whose running routes still name no resolver. A certificate the router cannot load is never listed. The digest line makes a renewal (same paths, new certificate) a content change the router reloads on.
func WriteRouterPolicy ¶
WriteRouterPolicy writes the policy the apply renders with: the apply names the step-ca resolver on every route the certificate does not serve, so it needs no fallback router.
Types ¶
type DNSToken ¶
DNSToken names where the Cloudflare DNS token comes from: exactly one of a token read from the Owner's file or a Wallet item in this node's custody (stackkit wallet-item import), the pattern of reach enable. Either is copied into the public-tls custody, where the identity signer renews with it; a rotated Wallet item takes effect with the next issue.
Source Files