From 26c7364e27c766fa41e43d3791acebe0b58ecfa4 Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Fri, 3 Oct 2025 13:56:04 +0200
Subject: [PATCH] Remove insecure acme option

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 pkg/certmanager/acme.go             | 32 +++++++++++++----------------
 pkg/probod/custom_domains_config.go | 10 ++++-----
 pkg/probod/probod.go                | 11 +++++++++-
 3 files changed, 29 insertions(+), 24 deletions(-)

diff --git a/pkg/certmanager/acme.go b/pkg/certmanager/acme.go
index 7708d2473..b3a13bc3d 100644
--- a/pkg/certmanager/acme.go
+++ b/pkg/certmanager/acme.go
@@ -23,7 +23,6 @@ import (
 	"crypto/x509/pkix"
 	"errors"
 	"fmt"
-	"net/http"
 	"time"
 
 	"github.com/getprobo/probo/pkg/crypto/keys"
@@ -66,8 +65,8 @@ func NewACMEService(
 	email string,
 	keyType keys.Type,
 	directoryURL string,
-	insecureTLS bool,
 	accountKey crypto.Signer,
+	rootCAs *x509.CertPool,
 	logger *log.Logger,
 ) (*ACMEService, error) {
 	if accountKey == nil {
@@ -80,24 +79,21 @@ func NewACMEService(
 		logger.Warn("no account key provided, generating new ACME account - this will create a new account on each restart")
 	}
 
-	var httpClient *http.Client
-
-	if insecureTLS {
-		transport := &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		}
-		httpClient = &http.Client{
-			Transport: transport,
-			Timeout:   30 * time.Second,
-		}
-
-		logger.Warn("ACME service configured with insecure TLS - use only for local testing")
-	} else {
-		httpClient = httpclient.DefaultPooledClient(
-			httpclient.WithLogger(logger),
-		)
+	httpClientOpts := []httpclient.Option{
+		httpclient.WithLogger(logger),
 	}
 
+	if rootCAs != nil {
+		httpClientOpts = append(
+			httpClientOpts,
+			httpclient.WithTLSConfig(&tls.Config{RootCAs: rootCAs}),
+		)
+
+		logger.Info("ACME service configured with custom root CA")
+	}
+
+	httpClient := httpclient.DefaultPooledClient(httpClientOpts...)
+
 	client := &acme.Client{
 		Key:          accountKey,
 		DirectoryURL: directoryURL,
diff --git a/pkg/probod/custom_domains_config.go b/pkg/probod/custom_domains_config.go
index 09cc591bd..5c44724ac 100644
--- a/pkg/probod/custom_domains_config.go
+++ b/pkg/probod/custom_domains_config.go
@@ -22,9 +22,9 @@ type customDomainsConfig struct {
 }
 
 type acmeConfig struct {
-	Directory   string `json:"directory"`
-	Email       string `json:"email"`
-	KeyType     string `json:"key-type"`
-	InsecureTLS bool   `json:"insecure-tls"`
-	AccountKey  string `json:"account-key"`
+	Directory  string `json:"directory"`
+	Email      string `json:"email"`
+	KeyType    string `json:"key-type"`
+	AccountKey string `json:"account-key"`
+	RootCA     string `json:"root-ca"`
 }
diff --git a/pkg/probod/probod.go b/pkg/probod/probod.go
index cf40f4d0e..3f3d9cf56 100644
--- a/pkg/probod/probod.go
+++ b/pkg/probod/probod.go
@@ -18,6 +18,7 @@ import (
 	"context"
 	"crypto"
 	"crypto/tls"
+	"crypto/x509"
 	"errors"
 	"fmt"
 	"net"
@@ -267,12 +268,20 @@ func (impl *Implm) Run(
 		l.Info("using configured ACME account key")
 	}
 
+	var rootCAs *x509.CertPool
+	if impl.cfg.CustomDomains.ACME.RootCA != "" {
+		rootCAs = x509.NewCertPool()
+		if !rootCAs.AppendCertsFromPEM([]byte(impl.cfg.CustomDomains.ACME.RootCA)) {
+			return fmt.Errorf("failed to parse ACME root CA certificate")
+		}
+	}
+
 	acmeService, err := certmanager.NewACMEService(
 		impl.cfg.CustomDomains.ACME.Email,
 		keys.Type(impl.cfg.CustomDomains.ACME.KeyType),
 		impl.cfg.CustomDomains.ACME.Directory,
-		impl.cfg.CustomDomains.ACME.InsecureTLS,
 		accountKey,
+		rootCAs,
 		l,
 	)
 	if err != nil {