serviceaccess

Oct 15, 2026

Changes in this version

+ func CheckLocalIssuer(dir string) error

+ type LocalIssuer struct

+ Dir string

+ func EnsureLocalIssuer(dir string) (*LocalIssuer, error)

+ func (i *LocalIssuer) Issue(ctx context.Context, request CertificateRequest) (IssuedCertificate, error)

+ func (i *LocalIssuer) Renew(ctx context.Context, current IssuedCertificate, request CertificateRequest) (IssuedCertificate, error)

+ func (i *LocalIssuer) Revoke(ctx context.Context, serial string) error

+ func (i *LocalIssuer) Status(ctx context.Context) (IssuerStatus, error)

+ func (i *LocalIssuer) TrustBundle(ctx context.Context) (TrustBundle, error)

Oct 8, 2026

Changes in this version

+ func ValidateSignedCSR(request CSRSigningRequest, issued IssuedCertificate, trust TrustBundle, ...) error

+ type CSRIssuer interface

+ SignCSR func(context.Context, CSRSigningRequest) (IssuedCertificate, error)

+ type CSRSigningRequest struct

+ CSRPEM []byte

+ DNSNames []string

+ Identity string

+ TTL time.Duration

+ func (r CSRSigningRequest) Validate() (*x509.CertificateRequest, error)

+ func (r CSRSigningRequest) ValidateCore() (*x509.CertificateRequest, error)

+ type CoreCSRIssuer interface

+ SignCoreCSR func(context.Context, CSRSigningRequest) (IssuedCertificate, error)

Oct 5, 2026

Changes in this version

+ func RetireTLSOverlap(ctx context.Context, issuer Issuer, policy Policy, dir string) error

type HTTPGatewayFiles

+ HealthAuthorizationEnv string

type HTTPGatewaySpec

+ CertificateNames []string

+ HealthAuthorizationEnv string

+ HealthStatus int

+ HealthURI string

+ UpstreamClientCertificate string

+ UpstreamClientKey string

+ Upstreams []string

type TCPGatewaySpec

+ BackendDirectives []string

+ Environment map[string]string

+ ServerDirectives []string

+ Upstreams []TCPGatewayUpstream

+ type TCPGatewayUpstream struct

+ Host string

+ Name string

+ Port int

Oct 1, 2026

Changes in this version

+ func VerifyBrowserRoute(ctx context.Context, client *http.Client, rawURL string) error

+ func VerifyBrowserRouteWithAllowedAuthorities(ctx context.Context, client *http.Client, rawURL string, allowedURLs ...string) error

+ func VerifyBrowserSurface(ctx context.Context, client *http.Client, rawURL string) error

+ func VerifyBrowserSurfaceWithAllowedAuthorities(ctx context.Context, client *http.Client, rawURL string, allowedURLs ...string) error

Sep 29, 2026

Changes in this version

+ func NewHTTPClientWithBasicAuth(material TLSMaterial, username, password string) (*http.Client, error)

type HTTPGatewaySpec

+ BasicAuthPassword string

+ BasicAuthUsername string

+ DenyPaths []string

+ NetworkAliases []string

+ UpstreamServerName string

+ UpstreamTrustFile string

+ type NativeTLSFiles struct

+ Dir string

+ Material TLSMaterial

+ func EnsureNativeTLS(ctx context.Context, issuer Issuer, policy Policy, providerDir string, ...) (NativeTLSFiles, error)

Sep 25, 2026

Changes in this version

+ const EnvAuthTokenFile

+ const EnvAuthentication

+ const EnvClientCertFile

+ const EnvClientKeyFile

+ const EnvIssuerRef

+ const EnvPKISource

+ const EnvServerName

+ const EnvTLSCertFile

+ const EnvTLSKeyFile

+ const EnvTrustBundle

+ const GatewayImage

+ const TCPGatewayImage

+ func HTTPGatewayComposeService(files HTTPGatewayFiles, spec HTTPGatewaySpec) string

+ func LoopbackHTTPSURL(port int) (string, error)

+ func NewHTTPClient(material TLSMaterial, requireClient bool) (*http.Client, error)

+ func NewHTTPClientForPolicy(material TLSMaterial, policy Policy) (*http.Client, error)

+ func TCPGatewayComposeService(files TCPGatewayFiles, spec TCPGatewaySpec) string

+ func WaitHTTPS(ctx context.Context, client *http.Client, endpoint, path string) error

+ type AuthenticationMode string

+ const AuthenticationExternal

+ const AuthenticationMTLS

+ const AuthenticationNative

+ const AuthenticationNone

+ const AuthenticationOAuth2

+ const AuthenticationOIDC

+ const AuthenticationToken

+ type CertificateRequest struct

+ CommonName string

+ DNSNames []string

+ IPAddresses []net.IP

+ TTL time.Duration

+ URIs []*url.URL

+ type HTTPGatewayFiles struct

+ AuthToken string

+ Caddyfile string

+ Dir string

+ Material TLSMaterial

+ func EnsureHTTPGateway(ctx context.Context, issuer Issuer, policy Policy, providerDir string, ...) (HTTPGatewayFiles, error)

+ type HTTPGatewaySpec struct

+ ContainerPort int

+ Networks []string

+ PublishedPortEnv string

+ RequireClient bool

+ ServiceName string

+ Upstream string

+ type IssuedCertificate struct

+ CAChain [][]byte

+ Certificate []byte

+ ExpiresAt time.Time

+ IssuerReference string

+ IssuingCA []byte

+ PrivateKey []byte

+ Serial string

+ type Issuer interface

+ Issue func(ctx context.Context, request CertificateRequest) (IssuedCertificate, error)

+ Renew func(ctx context.Context, current IssuedCertificate, request CertificateRequest) (IssuedCertificate, error)

+ Revoke func(ctx context.Context, serial string) error

+ Status func(ctx context.Context) (IssuerStatus, error)

+ TrustBundle func(ctx context.Context) (TrustBundle, error)

+ type IssuerStatus struct

+ IssuerReference string

+ Ready bool

+ type LifecycleObservation struct

+ ClientExpiresAt time.Time

+ Health string

+ IssuerReference string

+ LifecycleOwner string

+ RenewalMode string

+ ServerExpiresAt time.Time

+ Source PKISource

+ Warning string

+ func InspectLifecycle(dir string) (LifecycleObservation, error)

+ type PKISource string

+ const PKIBYOC

+ const PKIExternal

+ const PKIManagedLocal

+ type Policy struct

+ AuthTokenFile string

+ Authentication AuthenticationMode

+ AuthenticationRequired bool

+ ClientCertificate string

+ ClientKey string

+ Environment string

+ IssuerReference string

+ PKISource PKISource

+ Provider string

+ ServerCertificate string

+ ServerKey string

+ ServerName string

+ TLSRequired bool

+ TrustBundle string

+ func Resolve(environment, provider string, authentication AuthenticationMode) (Policy, error)

+ type TCPGatewayFiles struct

+ Config string

+ Dir string

+ Material TLSMaterial

+ PEM string

+ func EnsureTCPGateway(ctx context.Context, issuer Issuer, policy Policy, providerDir string, ...) (TCPGatewayFiles, error)

+ type TCPGatewaySpec struct

+ ContainerPort int

+ Network string

+ PublishedPortEnv string

+ ServiceName string

+ UpstreamHost string

+ UpstreamPort int

+ type TLSMaterial struct

+ CA string

+ ClientCertificate string

+ ClientKey string

+ ServerCertificate string

+ ServerKey string

+ ServerName string

+ Source PKISource

+ func EnsureTLSMaterial(ctx context.Context, issuer Issuer, policy Policy, dir string, ...) (TLSMaterial, error)

+ func ExistingTLSMaterial(policy Policy, dir string) (TLSMaterial, error)

+ type TrustBundle struct

+ IssuerReference string

+ PEM []byte