Remove insecure acme option

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/probod/custom_domains_config.go

@@ -22,9 +22,9 @@ type customDomainsConfig struct {
 }
 
 type acmeConfig struct {
-	Directory   string `json:"directory"`
-	Email       string `json:"email"`
-	KeyType     string `json:"key-type"`
-	InsecureTLS bool   `json:"insecure-tls"`
-	AccountKey  string `json:"account-key"`
+	Directory  string `json:"directory"`
+	Email      string `json:"email"`
+	KeyType    string `json:"key-type"`
+	AccountKey string `json:"account-key"`
+	RootCA     string `json:"root-ca"`
 }

pkg/probod/probod.go

@@ -18,6 +18,7 @@ import (
 	"context"
 	"crypto"
 	"crypto/tls"
+	"crypto/x509"
 	"errors"
 	"fmt"
 	"net"
@@ -267,12 +268,20 @@ func (impl *Implm) Run(
 		l.Info("using configured ACME account key")
 	}
 
+	var rootCAs *x509.CertPool
+	if impl.cfg.CustomDomains.ACME.RootCA != "" {
+		rootCAs = x509.NewCertPool()
+		if !rootCAs.AppendCertsFromPEM([]byte(impl.cfg.CustomDomains.ACME.RootCA)) {
+			return fmt.Errorf("failed to parse ACME root CA certificate")
+		}
+	}
+
 	acmeService, err := certmanager.NewACMEService(
 		impl.cfg.CustomDomains.ACME.Email,
 		keys.Type(impl.cfg.CustomDomains.ACME.KeyType),
 		impl.cfg.CustomDomains.ACME.Directory,
-		impl.cfg.CustomDomains.ACME.InsecureTLS,
 		accountKey,
+		rootCAs,
 		l,
 	)
 	if err != nil {