support acme (let's encrypt) (close #2) #391
Conversation
Codecov Report
@@ Coverage Diff @@
## main #391 +/- ##
==========================================
- Coverage 80.99% 80.79% -0.21%
==========================================
Files 60 60
Lines 6966 6966
==========================================
- Hits 5642 5628 -14
- Misses 1036 1047 +11
- Partials 288 291 +3
Continue to review full report at Codecov.
|
doc/controllers.md
Outdated
| | Name | Type | Description | Required | | ||
| | --------------- | ------------------------------------------ | ------------------------------------------------------------------------------------ | ---------------------------------- | | ||
| | email | string | An email address for CA account | Yes | | ||
| | directoryUrl | string | The endpoint of the CA directory | No (default to use Let's Encrypt) | |
There was a problem hiding this comment.
Propose directoryURL
https://github.com/golang/go/wiki/CodeReviewComments#initialisms
|
|
||
| const ( | ||
| // Category is the category of AutoCertManager. | ||
| // It is a business controller by now, but should be a system controller |
There was a problem hiding this comment.
| // It is a business controller by now, but should be a system controller | |
| // It is a business controller by now, but should be a system controller. |
| ) | ||
|
|
||
| type ( | ||
| //AutoCertManager is the controller for Automated Certificate Management |
There was a problem hiding this comment.
| //AutoCertManager is the controller for Automated Certificate Management | |
| //AutoCertManager is the controller for Automated Certificate Management. |
| Domains []DomainSpec `yaml:"domains" jsonschema:"required"` | ||
| } | ||
|
|
||
| // DomainSpec is the automate certificate management spec for a domain |
There was a problem hiding this comment.
| // DomainSpec is the automate certificate management spec for a domain | |
| // DomainSpec is the automated certificate management spec for a domain. |
| // HTTP-01 challenges requires HTTP server to listen on port 80, but we don't | ||
| // know which HTTP server listen on this port (consider there's an nginx sitting | ||
| // in front of Easegress), so all HTTP servers need to handle HTTP-01 challenges. | ||
| if strings.HasPrefix(stdr.URL.Path, "/.well-known/acme-challenge/") { |
There was a problem hiding this comment.
Actually, we can get the port from rules.spec.Port.
There was a problem hiding this comment.
We cannot use this configuration here. The port needs to be accessible from the CA server, so even rules.spec.Port is 80, it does not mean the CA server could send a request to this HTTP server, because other reverse proxies like Nginx could get the request and forward it to another HTTP server who does not listen on port 80.
There was a problem hiding this comment.
Oh we have discussed this topic before, sure.
No description provided.