Obtain and renew certificates automatically with ACME

Aperta
  • Qualcosa non va?
#439 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
go
Ambito
backend-api-design, security

Direzione di ricerca

Start with cmd/fanout/main.go, internal/server/http.go, and internal/config/config.go to trace TLS configuration and how the HTTP, MCP, OTLP/HTTP, and gRPC services share the listener. Check the existing TLS tests and identify how to run a local ACME test server. Done means the acceptance criteria pass, including renewal, error handling, and the documentation updates.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

What

Direct TLS requires bringing your own certificate today, so most public installs need Caddy or nginx in front. Add built-in ACME so one setting gives a single binary real HTTPS.

Use golang.org/x/crypto/acme/autocert with the TLS-ALPN-01 challenge, which runs on the existing port 443 listener and needs no port 80. Settings are something like FANOUT_TLS_ACME_DOMAIN and FANOUT_TLS_ACME_EMAIL. Certificates are cached under the data directory.

Acceptance criteria

  • With the ACME settings and a publicly reachable :443, Fanout obtains a certificate and serves HTTPS, API, MCP, OTLP/HTTP, and gRPC on the one listener
  • Certificates renew with no restart and no dropped connections
  • The host policy accepts only the configured domain
  • The cached account key and certificates are stored with owner-only permissions and survive restarts
  • Startup fails with an error naming the settings when ACME is combined with FANOUT_TLS_CERT_FILE, FANOUT_TLS_KEY_FILE, or FANOUT_TLS_CLIENT_CA_FILE; requiring client certificates would fail the ACME challenge handshake
  • Startup fails with a clear error when the listener is not on port 443
  • A failed issuance is logged with the reason and retried with backoff, without rate-limit loops
  • Tests run against a local ACME test server, with no calls to a public certificate authority
  • Configuration reference, TLS guide, and backup docs updated, including that the cache belongs to the data directory

References

  • cmd/fanout/main.go
  • internal/server/http.go
  • internal/config/config.go
  • site/src/content/docs/docs/guides/tls.mdx
  • RFC 8737: ACME TLS-ALPN-01

One pull request. Use the latest stable version of any dependency added, verified against its registry and pinned exactly.

Lingua principale
Go
Stelle
11
Fork
0
Merge medio
7h 5m
PR unite (30g)
112

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di labstack/fanout

Tutte le issue di labstack/fanout

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.