scertecd

package

v0.0.0-...-ebecaac Latest Latest Go to latest Published: Mar 21, 2024 License: BSD-3-Clause Imports: 31 Imported by: 0

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/tailscale/scertec

Links

Open Source Insights

Documentation ¶

Overview ¶

The scertecd package provides the code that fetches new TLS certs from LetsEncrypt as needed and puts them in setec before they expire. The code can run either in the foreground once, or most commonly as an HTTP server daemon.

It populates the following setec keys:

{prefix}acme-key: the private key for the ACME account, as a PEM-encoded ECDSA key
{prefix}domains/{domain-name}/rsa: PEM of private key, domain cert, LetsEncrypt cert
{prefix}domains/{domain-name}/ecdsa: PEM of private key, domain cert, LetsEncrypt cert

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type CertType ¶

type CertType string

CertType is the algorithm type for the cert, either RSA or ECDSA.

const (
	RSACert   CertType = "RSA"
	ECDSACert CertType = "ECDSA"
)

type Server ¶

type Server struct {
	SetecClient setec.Client                     // required client for setec
	Domains     []string                         // domains to maintain certs for
	Now         func() time.Time                 // if nil, initialized to time.Now
	ACMEContact string                           // optional email address for ACME registration
	Prefix      string                           // setec secret prefix ("prod/scertec/")
	Logf        func(format string, args ...any) // if nil, initialized to log.Printf
	// contains filtered or unexported fields
}

Server is the scertec updater server.

Despite the name "server", it can also be used in a single-shot foreground mode via its UpdateAll method.

All exported fields must be initialized before calling an exported method on the Server: either UpdateAll or Start.

func (*Server) ServeHTTP ¶

func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)

func (*Server) Start ¶

func (s *Server) Start(ctx context.Context) error

Start starts a background renewal goroutine for each cert domain and algorithm type. The context is used only for the initial ACME registration check and not used thereafter.

func (*Server) UpdateAll ¶

func (s *Server) UpdateAll() error

UpdateAll checks or updates all certs once and returns.

If all certs are either fine or successfully updated, it returns nil.

It is not necessary to call Start before UpdateAll.

Source Files ¶

View all Source files

scertecd.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL