Put SSLStatus not nullable

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/certmanager/provisioner.go

@@ -85,7 +85,7 @@ func (p *Provisioner) checkPendingDomains(ctx context.Context) error {
 			return nil
 		}
 
-		p.logger.InfoCtx(ctx, "found domains with pending challenges", log.Int("count", len(domains)))
+		p.logger.InfoCtx(ctx, "found domains needing SSL provisioning", log.Int("count", len(domains)))
 
 		for _, domain := range domains {
 			select {
@@ -94,10 +94,10 @@ func (p *Provisioner) checkPendingDomains(ctx context.Context) error {
 			default:
 			}
 
-			if err := p.completeDomainCertificate(ctx, conn, domain); err != nil {
+			if err := p.provisionDomainCertificate(ctx, conn, domain); err != nil {
 				p.logger.ErrorCtx(
 					ctx,
-					"cannot complete certificate for domain",
+					"cannot provision certificate for domain",
 					log.String("domain", domain.Domain),
 					log.Error(err),
 				)
@@ -108,11 +108,53 @@ func (p *Provisioner) checkPendingDomains(ctx context.Context) error {
 	})
 }
 
-func (p *Provisioner) completeDomainCertificate(
+func (p *Provisioner) provisionDomainCertificate(
 	ctx context.Context,
 	conn pg.Conn,
 	domain *coredata.CustomDomain,
 ) error {
+	if domain.SSLStatus == coredata.CustomDomainSSLStatusPending {
+		p.logger.InfoCtx(ctx, "initiating HTTP challenge for domain", log.String("domain", domain.Domain))
+
+		challenge, err := p.acmeService.GetHTTPChallenge(ctx, domain.Domain)
+		if err != nil {
+			p.logger.ErrorCtx(
+				ctx,
+				"failed to get HTTP challenge",
+				log.String("domain", domain.Domain),
+				log.Error(err),
+			)
+			return err
+		}
+
+		// Update domain with challenge details and set to PROVISIONING
+		scope := coredata.NewScope(domain.OrganizationID.TenantID())
+		fullDomain := &coredata.CustomDomain{}
+		if err := fullDomain.LoadByIDForUpdate(ctx, conn, scope, p.encryptionKey, domain.ID); err != nil {
+			return fmt.Errorf("cannot load domain for update: %w", err)
+		}
+
+		fullDomain.HTTPChallengeToken = &challenge.Token
+		fullDomain.HTTPChallengeKeyAuth = &challenge.KeyAuth
+		fullDomain.HTTPChallengeURL = &challenge.URL
+		fullDomain.HTTPOrderURL = &challenge.OrderURL
+		fullDomain.SSLStatus = coredata.CustomDomainSSLStatusProvisioning
+
+		if err := fullDomain.Update(ctx, conn, scope, p.encryptionKey); err != nil {
+			return fmt.Errorf("failed to update domain with challenge: %w", err)
+		}
+
+		p.logger.InfoCtx(
+			ctx,
+			"HTTP challenge initiated, will complete in next cycle",
+			log.String("domain", domain.Domain),
+			log.String("token", challenge.Token),
+		)
+
+		return nil
+	}
+
+	// Domain already has challenge details, complete it
 	challenge := &HTTPChallenge{
 		Domain:   domain.Domain,
 		Token:    *domain.HTTPChallengeToken,
@@ -151,8 +193,7 @@ func (p *Provisioner) completeDomainCertificate(
 	chainStr := string(cert.ChainPEM)
 	fullDomain.SSLCertificateChain = &chainStr
 	fullDomain.SSLExpiresAt = &cert.ExpiresAt
-	status := coredata.CustomDomainSSLStatusActive
+	fullDomain.SSLStatus = coredata.CustomDomainSSLStatusActive
-	fullDomain.SSLStatus = &status
 
 	fullDomain.HTTPChallengeToken = nil
 	fullDomain.HTTPChallengeKeyAuth = nil

pkg/certmanager/renewer.go

@@ -24,7 +24,6 @@ import (
 	"github.com/getprobo/probo/pkg/crypto/cipher"
 	"go.gearno.de/kit/log"
 	"go.gearno.de/kit/pg"
-	"go.gearno.de/x/ref"
 )
 
 type (
@@ -136,7 +135,7 @@ func (r *Renewer) renewDomain(ctx context.Context, conn pg.Conn, domain *coredat
 		return fmt.Errorf("cannot lock domain for renewal: %w", err)
 	}
 
-	if lockedDomain.SSLStatus == nil || *lockedDomain.SSLStatus != coredata.CustomDomainSSLStatusActive {
+	if lockedDomain.SSLStatus != coredata.CustomDomainSSLStatusActive {
 		r.logger.InfoCtx(
 			ctx,
 			"domain status changed, skipping renewal",
@@ -164,7 +163,7 @@ func (r *Renewer) renewDomain(ctx context.Context, conn pg.Conn, domain *coredat
 		lockedDomain.HTTPChallengeKeyAuth = &challenge.KeyAuth
 		lockedDomain.HTTPChallengeURL = &challenge.URL
 		lockedDomain.HTTPOrderURL = &challenge.OrderURL
-		lockedDomain.SSLStatus = ref.Ref(coredata.CustomDomainSSLStatusRenewing)
+		lockedDomain.SSLStatus = coredata.CustomDomainSSLStatusRenewing
 
 		if err := lockedDomain.Update(ctx, conn, scope, r.encryptionKey); err != nil {
 			return fmt.Errorf("cannot update domain with renewal challenge: %w", err)
@@ -189,7 +188,7 @@ func (r *Renewer) renewDomain(ctx context.Context, conn pg.Conn, domain *coredat
 	chainStr := string(cert.ChainPEM)
 	lockedDomain.SSLCertificateChain = &chainStr
 	lockedDomain.SSLExpiresAt = &cert.ExpiresAt
-	lockedDomain.SSLStatus = ref.Ref(coredata.CustomDomainSSLStatusActive)
+	lockedDomain.SSLStatus = coredata.CustomDomainSSLStatusActive
 
 	lockedDomain.HTTPChallengeToken = nil
 	lockedDomain.HTTPChallengeKeyAuth = nil

pkg/certmanager/selector.go

@@ -118,7 +118,7 @@ func (s *Selector) rebuildCacheEntry(ctx context.Context, conn pg.Conn, domain s
 		return fmt.Errorf("domain is not active")
 	}
 
-	if customDomain.SSLStatus == nil || *customDomain.SSLStatus != coredata.CustomDomainSSLStatusActive {
+	if customDomain.SSLStatus != coredata.CustomDomainSSLStatusActive {
 		return fmt.Errorf("domain does not have active SSL certificate")
 	}
 

pkg/coredata/custom_domain.go

@@ -43,7 +43,7 @@ type (
 		SSLPrivateKeyPEM        []byte                `db:"-"` // Decrypted PEM
 		EncryptedSSLPrivateKey  []byte                `db:"encrypted_ssl_private_key"`
 		SSLCertificateChain     *string               `db:"ssl_certificate_chain"`
-		SSLStatus               *CustomDomainSSLStatus `db:"ssl_status"`
+		SSLStatus               CustomDomainSSLStatus `db:"ssl_status"`
 		SSLExpiresAt            *time.Time            `db:"ssl_expires_at"`
 		IsActive                bool                  `db:"is_active"`
 		CreatedAt               time.Time             `db:"created_at"`
@@ -762,10 +762,10 @@ WHERE
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
 	args := pgx.NamedArgs{
-		"statuses": []CustomDomainSSLStatus{
+		"statuses": []string{
-			CustomDomainSSLStatusPending,
+			string(CustomDomainSSLStatusPending),
-			CustomDomainSSLStatusProvisioning,
+			string(CustomDomainSSLStatusProvisioning),
-			CustomDomainSSLStatusRenewing,
+			string(CustomDomainSSLStatusRenewing),
 		},
 	}
 	maps.Copy(args, scope.SQLArguments())