rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Limit TLS cache warming to live domains

Browse Source 
After the certificates split, WarmCache loaded every ACTIVE
certificate. Org deletes cascade-remove custom_domains but leave
certificates behind, so orphans could regain a usable SNI cache
entry on rebuild. Warm and serve only certs still referenced by a
domain, and purge unreferenced cache rows.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-07-17 14:08:35 +02:00
parent e7df6f6b2a
commit 4cec74c1a1
4 changed files with 67 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/certmanager/cache_store.go
View File

@@ -59,8 +59,13 @@ func (w *CacheStore) WarmCache(ctx context.Context) error {
err := w.pg.WithConn(
ctx,
func(ctx context.Context, conn pg.Querier) error {
var caches coredata.CachedCertificates
if err := caches.DeleteUnreferenced(ctx, conn); err != nil {
return fmt.Errorf("cannot delete unreferenced certificate cache: %w", err)
}
certificates := coredata.Certificates{}
if err := certificates.LoadActive(ctx, conn, coredata.NewNoScope()); err != nil {
if err := certificates.LoadActiveReferenced(ctx, conn, coredata.NewNoScope()); err != nil {
return fmt.Errorf("cannot load active certificates: %w", err)
}