rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove decrypt key by default

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2025-10-02 00:32:48 +02:00
parent 17ea259d8d
commit a2485ec6fa
6 changed files with 94 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/coredata/cached_certificate.go
View File

@@ -19,6 +19,7 @@ import (
"fmt"
"time"
"github.com/getprobo/probo/pkg/crypto/cipher"
"github.com/getprobo/probo/pkg/gid"
"github.com/jackc/pgx/v5"
"go.gearno.de/kit/pg"
@@ -169,7 +170,7 @@ WHERE
return nil
}
func (cc *CachedCertificate) RefreshFromDomain(ctx context.Context, conn pg.Conn, domain *CustomDomain) error {
func (cc *CachedCertificate) RefreshFromDomain(ctx context.Context, conn pg.Conn, domain *CustomDomain, encryptionKey cipher.EncryptionKey) error {
if domain.SSLCertificate == nil {
return fmt.Errorf("domain has no parsed certificate")
}
@@ -178,7 +179,12 @@ func (cc *CachedCertificate) RefreshFromDomain(ctx context.Context, conn pg.Conn
return fmt.Errorf("domain has no certificate PEM")
}
if len(domain.SSLPrivateKeyPEM) == 0 {
privateKeyPEM, err := domain.DecryptPrivateKey(encryptionKey)
if err != nil {
return fmt.Errorf("cannot decrypt private key: %w", err)
}
if len(privateKeyPEM) == 0 {
return fmt.Errorf("domain has no private key PEM")
}
@@ -189,7 +195,7 @@ func (cc *CachedCertificate) RefreshFromDomain(ctx context.Context, conn pg.Conn
cache := &CachedCertificate{
Domain: domain.Domain,
CertificatePEM: string(domain.SSLCertificatePEM),
PrivateKeyPEM: string(domain.SSLPrivateKeyPEM),
PrivateKeyPEM: string(privateKeyPEM),
CertificateChain: domain.SSLCertificateChain,
ExpiresAt: *domain.SSLExpiresAt,
CachedAt: time.Now(),