Documentation
¶
Overview ¶
Package app assembles the Cloudflare module as a process of its own (docs/decisions/0071): the minter of ADR 0070 and its scheduled rotation, with the secrets store, the leases and the audit trail they need, and nothing of the issuer, the directory hub or another provider.
The on-demand exchange (a caller asks the issuer for a token) still calls the minter inside the issuer's process; that path is not here.
Index ¶
- Constants
- func Mux(s *modcall.Server, verify modcall.Verifier, issuers []string) http.Handler
- type App
- func (a *App) Close() error
- func (a *App) Flush(ctx context.Context) error
- func (a *App) RPC() *modcall.Server
- func (a *App) Run(ctx context.Context) error
- func (a *App) ServeRPC(ctx context.Context, cfg Config, verify modcall.Verifier) error
- func (a *App) Tick(ctx context.Context, target string, unsafeLocal bool) error
- func (a *App) TickAll(ctx context.Context) (failed int, summary string, err error)
- type Config
Constants ¶
const HealthPath = modserve.HealthPath
HealthPath answers 200 on the module's listener, for the probes.
const Interval = time.Minute
Interval is how often the loop looks at the presets. A look at a credential that is not due costs one read of the secrets store and nothing at Cloudflare.
Variables ¶
This section is empty.
Functions ¶
func Mux ¶
Mux is the module's listener (internal/modserve): the calls at modcall.RPCPath, which verify refuses before they reach a method and which only the issuers' subjects may make, and a health endpoint that needs no credential and tells nothing.
Types ¶
type App ¶
type App struct {
// contains filtered or unexported fields
}
App is the assembled module.
func (*App) Close ¶
Close closes the audit emitter, which delivers what its queue holds within its timeout and drops the rest, and the ports.
func (*App) Flush ¶
Flush delivers the audit records still queued: a Lambda function calls it before an invocation returns, since the process is frozen after it.
func (*App) Run ¶
Run rotates the presets that are due, every Interval, until ctx ends. It first reports the prototypes that are not usable; that is not fatal, since Cloudflare being unreachable must not stop the loop and a mint refuses the same prototype every time.
func (*App) ServeRPC ¶
ServeRPC answers other modules' calls on the document's address until ctx ends. verify checks the bearer of a call; the document's issuers are the only subjects let in.
func (*App) Tick ¶
Tick runs one preset's rotation once, under its lease, and returns: a credential that is not due costs no call to Cloudflare, and a preset another runner holds is left to it.
type Config ¶
type Config struct {
// contains filtered or unexported fields
}
Config is what the module is made of, built from the service document.
func FromService ¶
FromService builds the settings from the documents already read.
func Load ¶
Load reads the service document, and the policy document it names if any, and builds the module's settings. A document with no `cloudflare` presets is refused: there is nothing for this module to do.
Source Files