Refactor certmanager to worker service
Replace the Provisioner and Renewer with poll-based provision and renew workers orchestrated by a certmanager Service. Certificate operations are now hostname-centric and driven by the certificates table, decoupled from custom-domain business logic. Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
239
pkg/certmanager/service.go
Normal file
239
pkg/certmanager/service.go
Normal file
@@ -0,0 +1,239 @@
|
||||
// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
|
||||
//
|
||||
// Permission to use, copy, modify, and/or distribute this software for any
|
||||
// purpose with or without fee is hereby granted, provided that the above
|
||||
// copyright notice and this permission notice appear in all copies.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
||||
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
||||
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
// PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
package certmanager
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
"go.gearno.de/kit/log"
|
||||
"go.gearno.de/kit/pg"
|
||||
"go.gearno.de/kit/worker"
|
||||
"go.probo.inc/probo/pkg/coredata"
|
||||
"go.probo.inc/probo/pkg/crypto/cipher"
|
||||
"go.probo.inc/probo/pkg/gid"
|
||||
"golang.org/x/sync/errgroup"
|
||||
)
|
||||
|
||||
type (
|
||||
// Service owns the TLS certificate lifecycle for arbitrary hostnames. It is
|
||||
// a generic core service and knows nothing about the resources a
|
||||
// certificate protects; callers reference a certificate by its ID.
|
||||
Service struct {
|
||||
pg *pg.Client
|
||||
acmeService *ACMEService
|
||||
encryptionKey cipher.EncryptionKey
|
||||
logger *log.Logger
|
||||
provisionWorker *worker.Worker[coredata.Certificate]
|
||||
renewWorker *worker.Worker[coredata.Certificate]
|
||||
}
|
||||
|
||||
// Config holds the SSL provisioning parameters for the service workers.
|
||||
Config struct {
|
||||
CnameTarget string
|
||||
CAAIssuerDomain string
|
||||
ResolverAddr string
|
||||
ManagedBaseDomain string
|
||||
RenewalInterval time.Duration
|
||||
ProvisionInterval time.Duration
|
||||
}
|
||||
)
|
||||
|
||||
func NewService(
|
||||
pgClient *pg.Client,
|
||||
acmeService *ACMEService,
|
||||
encryptionKey cipher.EncryptionKey,
|
||||
cfg Config,
|
||||
logger *log.Logger,
|
||||
) *Service {
|
||||
provisionInterval := cfg.ProvisionInterval
|
||||
if provisionInterval <= 0 {
|
||||
provisionInterval = 30 * time.Second
|
||||
}
|
||||
|
||||
renewalInterval := cfg.RenewalInterval
|
||||
if renewalInterval <= 0 {
|
||||
renewalInterval = time.Hour
|
||||
}
|
||||
|
||||
return &Service{
|
||||
pg: pgClient,
|
||||
acmeService: acmeService,
|
||||
encryptionKey: encryptionKey,
|
||||
logger: logger,
|
||||
provisionWorker: NewProvisionWorker(
|
||||
pgClient,
|
||||
acmeService,
|
||||
encryptionKey,
|
||||
cfg.CnameTarget,
|
||||
cfg.CAAIssuerDomain,
|
||||
cfg.ResolverAddr,
|
||||
cfg.ManagedBaseDomain,
|
||||
logger.Named("provision-worker"),
|
||||
worker.WithInterval(provisionInterval),
|
||||
),
|
||||
renewWorker: NewRenewWorker(
|
||||
pgClient,
|
||||
encryptionKey,
|
||||
logger.Named("renew-worker"),
|
||||
worker.WithInterval(renewalInterval),
|
||||
),
|
||||
}
|
||||
}
|
||||
|
||||
func (s *Service) Run(ctx context.Context) error {
|
||||
g, gctx := errgroup.WithContext(ctx)
|
||||
|
||||
g.Go(
|
||||
func() error {
|
||||
return s.provisionWorker.Run(gctx)
|
||||
},
|
||||
)
|
||||
|
||||
g.Go(
|
||||
func() error {
|
||||
return s.renewWorker.Run(gctx)
|
||||
},
|
||||
)
|
||||
|
||||
return g.Wait()
|
||||
}
|
||||
|
||||
// EnsureCertificate returns the certificate for the given hostname, creating a
|
||||
// pending one within the given transaction when it does not exist yet. The
|
||||
// certificate lifecycle is then driven asynchronously by the provision worker.
|
||||
func (s *Service) EnsureCertificate(
|
||||
ctx context.Context,
|
||||
tx pg.Tx,
|
||||
scope coredata.Scoper,
|
||||
hostname string,
|
||||
) (*coredata.Certificate, error) {
|
||||
certificate := &coredata.Certificate{}
|
||||
|
||||
err := certificate.LoadByHostname(ctx, tx, scope, hostname)
|
||||
if err == nil {
|
||||
return certificate, nil
|
||||
}
|
||||
|
||||
if !errors.Is(err, coredata.ErrResourceNotFound) {
|
||||
return nil, fmt.Errorf("cannot load certificate: %w", err)
|
||||
}
|
||||
|
||||
certificate = coredata.NewCertificate(scope.GetTenantID(), hostname)
|
||||
if err := certificate.Insert(ctx, tx, scope); err != nil {
|
||||
return nil, fmt.Errorf("cannot insert certificate: %w", err)
|
||||
}
|
||||
|
||||
return certificate, nil
|
||||
}
|
||||
|
||||
// UpdateHostname renames a certificate and resets its lifecycle so a fresh
|
||||
// certificate is provisioned for the new hostname. It returns the certificate
|
||||
// unchanged when the hostname already matches.
|
||||
func (s *Service) UpdateHostname(
|
||||
ctx context.Context,
|
||||
tx pg.Tx,
|
||||
scope coredata.Scoper,
|
||||
certificateID gid.GID,
|
||||
newHostname string,
|
||||
) (*coredata.Certificate, error) {
|
||||
certificate := &coredata.Certificate{}
|
||||
if err := certificate.LoadByID(ctx, tx, scope, certificateID); err != nil {
|
||||
return nil, fmt.Errorf("cannot load certificate: %w", err)
|
||||
}
|
||||
|
||||
if certificate.Hostname == newHostname {
|
||||
return certificate, nil
|
||||
}
|
||||
|
||||
certificate.Hostname = newHostname
|
||||
certificate.Status = coredata.CertificateStatusPending
|
||||
certificate.SSLRetryCount = 0
|
||||
certificate.SSLLastAttemptAt = nil
|
||||
certificate.ProvisioningError = nil
|
||||
certificate.HTTPChallengeToken = nil
|
||||
certificate.HTTPChallengeKeyAuth = nil
|
||||
certificate.HTTPChallengeURL = nil
|
||||
certificate.HTTPOrderURL = nil
|
||||
|
||||
if err := certificate.Update(ctx, tx, scope); err != nil {
|
||||
return nil, fmt.Errorf("cannot update certificate: %w", err)
|
||||
}
|
||||
|
||||
return certificate, nil
|
||||
}
|
||||
|
||||
// Get returns a certificate by ID.
|
||||
func (s *Service) Get(
|
||||
ctx context.Context,
|
||||
scope coredata.Scoper,
|
||||
certificateID gid.GID,
|
||||
) (*coredata.Certificate, error) {
|
||||
certificate := &coredata.Certificate{}
|
||||
|
||||
err := s.pg.WithConn(
|
||||
ctx,
|
||||
func(ctx context.Context, conn pg.Querier) error {
|
||||
return certificate.LoadByID(ctx, conn, scope, certificateID)
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return certificate, nil
|
||||
}
|
||||
|
||||
// GetByHostname returns the certificate matching the given hostname. It is
|
||||
// unscoped because it powers public host resolution across all tenants.
|
||||
func (s *Service) GetByHostname(
|
||||
ctx context.Context,
|
||||
hostname string,
|
||||
) (*coredata.Certificate, error) {
|
||||
certificate := &coredata.Certificate{}
|
||||
|
||||
err := s.pg.WithConn(
|
||||
ctx,
|
||||
func(ctx context.Context, conn pg.Querier) error {
|
||||
return certificate.LoadByHostname(ctx, conn, coredata.NewNoScope(), hostname)
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return certificate, nil
|
||||
}
|
||||
|
||||
// Delete removes a certificate within the given transaction.
|
||||
func (s *Service) Delete(
|
||||
ctx context.Context,
|
||||
tx pg.Tx,
|
||||
scope coredata.Scoper,
|
||||
certificateID gid.GID,
|
||||
) error {
|
||||
certificate := &coredata.Certificate{}
|
||||
if err := certificate.LoadByID(ctx, tx, scope, certificateID); err != nil {
|
||||
return fmt.Errorf("cannot load certificate: %w", err)
|
||||
}
|
||||
|
||||
if err := certificate.Delete(ctx, tx, scope); err != nil {
|
||||
return fmt.Errorf("cannot delete certificate: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
Reference in New Issue
Block a user