rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove useless encryption key injections

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-03-10 20:00:05 +04:00
parent 3a727f53fa
commit 87415c0324
18 changed files with 42 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/certmanager/acme_challenge_handler.go
View File

@@ -22,24 +22,20 @@ import (
"go.gearno.de/kit/log"
"go.gearno.de/kit/pg"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/crypto/cipher"
)
type ACMEChallengeHandler struct {
pg *pg.Client
encryptionKey cipher.EncryptionKey
logger *log.Logger
pg *pg.Client
logger *log.Logger
}
func NewACMEChallengeHandler(
pg *pg.Client,
encryptionKey cipher.EncryptionKey,
logger *log.Logger,
) *ACMEChallengeHandler {
return &ACMEChallengeHandler{
pg: pg,
encryptionKey: encryptionKey,
logger: logger.Named("certmanager.acme-challenge-handler"),
pg: pg,
logger: logger.Named("certmanager.acme-challenge-handler"),
}
}
@@ -82,7 +78,7 @@ func (h *ACMEChallengeHandler) getKeyAuthForToken(ctx context.Context, token str
ctx,
func(conn pg.Conn) error {
domain := &coredata.CustomDomain{}
if err := domain.LoadByHTTPChallengeToken(ctx, conn, coredata.NewNoScope(), h.encryptionKey, token); err != nil {
if err := domain.LoadByHTTPChallengeToken(ctx, conn, coredata.NewNoScope(), token); err != nil {
return err
}

6
pkg/certmanager/cache_store.go
View File

@@ -53,7 +53,7 @@ func (w *CacheStore) WarmCache(ctx context.Context) error {
ctx,
func(conn pg.Conn) error {
domains := coredata.CustomDomains{}
if err := domains.LoadActiveCertificates(ctx, conn, coredata.NewNoScope(), w.encryptionKey); err != nil {
if err := domains.LoadActiveCertificates(ctx, conn, coredata.NewNoScope()); err != nil {
return fmt.Errorf("cannot load active certificates: %w", err)
}
@@ -95,7 +95,7 @@ func (w *CacheStore) WarmCache(ctx context.Context) error {
func (w *CacheStore) warmDomain(ctx context.Context, conn pg.Conn, domain *coredata.CustomDomain) error {
var loadedDomain coredata.CustomDomain
if err := loadedDomain.LoadByID(ctx, conn, coredata.NewNoScope(), w.encryptionKey, domain.ID); err != nil {
if err := loadedDomain.LoadByID(ctx, conn, coredata.NewNoScope(), domain.ID); err != nil {
return fmt.Errorf("cannot load domain with decrypted values: %w", err)
}
@@ -162,7 +162,7 @@ func (w *CacheStore) WarmSingleDomain(ctx context.Context, domainName string) er
ctx,
func(conn pg.Conn) error {
var domain coredata.CustomDomain
if err := domain.LoadByDomain(ctx, conn, coredata.NewNoScope(), w.encryptionKey, domainName); err != nil {
if err := domain.LoadByDomain(ctx, conn, coredata.NewNoScope(), domainName); err != nil {
return fmt.Errorf("cannot load domain: %w", err)
}

12
pkg/certmanager/provisioner.go
View File

@@ -224,7 +224,7 @@ func (p *Provisioner) resetStaleDomain(
domain *coredata.CustomDomain,
) error {
fullDomain := &coredata.CustomDomain{}
if err := fullDomain.LoadByIDForUpdateSkipLocked(ctx, tx, coredata.NewNoScope(), p.encryptionKey, domain.ID); err != nil {
if err := fullDomain.LoadByIDForUpdateSkipLocked(ctx, tx, coredata.NewNoScope(), domain.ID); err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return nil
}
@@ -260,7 +260,7 @@ func (p *Provisioner) resetStaleDomain(
fullDomain.SSLLastAttemptAt = nil
}
if err := fullDomain.Update(ctx, tx, coredata.NewNoScope(), p.encryptionKey); err != nil {
if err := fullDomain.Update(ctx, tx, coredata.NewNoScope()); err != nil {
return fmt.Errorf("cannot update stale domain: %w", err)
}
@@ -273,7 +273,7 @@ func (p *Provisioner) provisionDomainCertificate(
domainID gid.GID,
) error {
domain := &coredata.CustomDomain{}
if err := domain.LoadByIDForUpdateSkipLocked(ctx, tx, coredata.NewNoScope(), p.encryptionKey, domainID); err != nil {
if err := domain.LoadByIDForUpdateSkipLocked(ctx, tx, coredata.NewNoScope(), domainID); err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return nil
}
@@ -312,7 +312,7 @@ func (p *Provisioner) provisionDomainCertificate(
domain.HTTPOrderURL = &challenge.OrderURL
domain.SSLStatus = coredata.CustomDomainSSLStatusProvisioning
if err := domain.Update(ctx, tx, coredata.NewNoScope(), p.encryptionKey); err != nil {
if err := domain.Update(ctx, tx, coredata.NewNoScope()); err != nil {
return fmt.Errorf("cannot update domain with challenge: %w", err)
}
@@ -362,7 +362,7 @@ func (p *Provisioner) provisionDomainCertificate(
domain.HTTPOrderURL = nil
}
if err := domain.Update(ctx, tx, coredata.NewNoScope(), p.encryptionKey); err != nil {
if err := domain.Update(ctx, tx, coredata.NewNoScope()); err != nil {
return fmt.Errorf("cannot update domain: %w", err)
}
@@ -393,7 +393,7 @@ func (p *Provisioner) provisionDomainCertificate(
domain.HTTPChallengeURL = nil
domain.HTTPOrderURL = nil
if err := domain.Update(ctx, tx, coredata.NewNoScope(), p.encryptionKey); err != nil {
if err := domain.Update(ctx, tx, coredata.NewNoScope()); err != nil {
return fmt.Errorf("cannot update domain: %w", err)
}

4
pkg/certmanager/renewer.go
View File

@@ -130,7 +130,7 @@ func (r *Renewer) checkAndRenew(ctx context.Context) error {
func (r *Renewer) renewDomain(ctx context.Context, tx pg.Conn, domainID gid.GID) error {
domain := &coredata.CustomDomain{}
if err := domain.LoadByIDForUpdateSkipLocked(ctx, tx, coredata.NewNoScope(), r.encryptionKey, domainID); err != nil {
if err := domain.LoadByIDForUpdateSkipLocked(ctx, tx, coredata.NewNoScope(), domainID); err != nil {
if errors.Is(err, coredata.ErrResourceNotFound) {
return nil
}
@@ -149,7 +149,7 @@ func (r *Renewer) renewDomain(ctx context.Context, tx pg.Conn, domainID gid.GID)
}
domain.SSLStatus = coredata.CustomDomainSSLStatusRenewing
if err := domain.Update(ctx, tx, coredata.NewNoScope(), r.encryptionKey); err != nil {
if err := domain.Update(ctx, tx, coredata.NewNoScope()); err != nil {
return fmt.Errorf("cannot update domain status: %w", err)
}

2
pkg/certmanager/selector.go
View File

@@ -116,7 +116,7 @@ func (s *Selector) loadFromDatabase(domain string) (*tls.Certificate, error) {
func (s *Selector) rebuildCacheEntry(ctx context.Context, conn pg.Conn, domain string) error {
var customDomain coredata.CustomDomain
if err := customDomain.LoadByDomain(ctx, conn, coredata.NewNoScope(), s.encryptionKey, domain); err != nil {
if err := customDomain.LoadByDomain(ctx, conn, coredata.NewNoScope(), domain); err != nil {
return fmt.Errorf("cannot load domain: %w", err)
}