Documentation
¶
Index ¶
- type CertLockMethod
- type Manager
- func (mgr *Manager) AddDomain(d domain.Domain, accountID types.AccountID, serviceID types.ServiceID) (wildcardHit bool)
- func (mgr *Manager) FailedDomains() map[string]string
- func (mgr *Manager) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)
- func (mgr *Manager) PendingCerts() int
- func (mgr *Manager) PendingDomains() []string
- func (mgr *Manager) ReadyDomains() []string
- func (mgr *Manager) RemoveDomain(d domain.Domain)
- func (mgr *Manager) TotalDomains() int
- func (mgr *Manager) WatchWildcards(ctx context.Context)
- func (mgr *Manager) WildcardPatterns() []string
- type ManagerConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CertLockMethod ¶
type CertLockMethod string
CertLockMethod controls how ACME certificate locks are coordinated.
const ( // CertLockAuto detects the environment and selects k8s-lease if running // in a Kubernetes pod, otherwise flock. CertLockAuto CertLockMethod = "auto" // CertLockFlock uses advisory file locks via flock(2). CertLockFlock CertLockMethod = "flock" // CertLockK8sLease uses Kubernetes coordination Leases. CertLockK8sLease CertLockMethod = "k8s-lease" )
type Manager ¶
Manager wraps autocert.Manager with domain tracking and cross-replica coordination via a pluggable locking strategy. The locker prevents duplicate ACME requests when multiple replicas share a certificate cache.
func NewManager ¶
func NewManager(cfg ManagerConfig, notifier certificateNotifier, logger *log.Logger, metrics metricsRecorder) (*Manager, error)
NewManager creates a new ACME certificate manager.
func (*Manager) AddDomain ¶
func (mgr *Manager) AddDomain(d domain.Domain, accountID types.AccountID, serviceID types.ServiceID) (wildcardHit bool)
AddDomain registers a domain for certificate management. Domains that match a loaded wildcard are marked ready immediately (they use the static wildcard certificate) and the method returns true. All other domains go through ACME prefetch and the method returns false.
When AddDomain returns true the caller is responsible for sending any certificate-ready notifications after the surrounding operation (e.g. mapping update) has committed successfully.
func (*Manager) FailedDomains ¶
FailedDomains returns domain names that failed certificate prefetch, mapped to their error.
func (*Manager) GetCertificate ¶ added in v0.67.0
func (mgr *Manager) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)
GetCertificate returns the TLS certificate for the given ClientHello. If the requested domain matches a loaded wildcard, the static wildcard certificate is returned. Otherwise, the ACME autocert manager handles the request.
func (*Manager) PendingCerts ¶
PendingCerts returns the number of certificates currently being prefetched.
func (*Manager) PendingDomains ¶
PendingDomains returns the domain names currently being prefetched.
func (*Manager) ReadyDomains ¶
ReadyDomains returns domain names that have successfully obtained certificates.
func (*Manager) RemoveDomain ¶
RemoveDomain removes a domain from tracking.
func (*Manager) TotalDomains ¶
TotalDomains returns the total number of registered domains.
func (*Manager) WatchWildcards ¶ added in v0.67.0
WatchWildcards starts watching all wildcard certificate files for changes. It blocks until ctx is cancelled. It is a no-op if no wildcards are loaded.
func (*Manager) WildcardPatterns ¶ added in v0.67.0
WildcardPatterns returns the wildcard patterns that are currently loaded.
type ManagerConfig ¶ added in v0.67.0
type ManagerConfig struct {
// CertDir is the directory used for caching ACME certificates.
CertDir string
// ACMEURL is the ACME directory URL (e.g. Let's Encrypt).
ACMEURL string
// EABKID and EABHMACKey are optional External Account Binding credentials
// required by some CAs (e.g. ZeroSSL). EABHMACKey is the base64
// URL-encoded string provided by the CA.
EABKID string
EABHMACKey string
// LockMethod controls the cross-replica coordination strategy.
LockMethod CertLockMethod
// WildcardDir is an optional path to a directory containing wildcard
// certificate pairs (<name>.crt / <name>.key). Wildcard patterns are
// extracted from the certificates' SAN lists. Domains matching a
// wildcard are served from disk; all others go through ACME.
WildcardDir string
}
ManagerConfig holds the configuration values for the ACME certificate manager.
Source Files