use hot_reload to update certificates

Cargo.toml

@@ -35,6 +35,8 @@ tokio = { version = "1.29.1", default-features = false, features = [
   "sync",
   "macros",
 ] }
+async-trait = "0.1.71"
+hot_reload = "0.1.2" # reloading certs
 
 # http and tls
 hyper = { version = "0.14.27", default-features = false, features = [

src/backend/mod.rs

@@ -13,26 +13,10 @@ pub use self::{
   upstream::{ReverseProxy, Upstream, UpstreamGroup, UpstreamGroupBuilder},
   upstream_opts::UpstreamOption,
 };
-use crate::{
+use crate::utils::{BytesName, PathNameBytesExp, ServerNameBytesExp};
-  log::*,
-  utils::{BytesName, PathNameBytesExp, ServerNameBytesExp},
-};
 use derive_builder::Builder;
-use rustc_hash::{FxHashMap as HashMap, FxHashSet as HashSet};
+use rustc_hash::FxHashMap as HashMap;
-use rustls::{OwnedTrustAnchor, RootCertStore};
+use std::{borrow::Cow, path::PathBuf};
-use std::{
-  borrow::Cow,
-  fs::File,
-  io::{self, BufReader, Cursor, Read},
-  path::PathBuf,
-  sync::Arc,
-};
-use tokio_rustls::rustls::{
-  server::ResolvesServerCertUsingSni,
-  sign::{any_supported_type, CertifiedKey},
-  Certificate, PrivateKey, ServerConfig,
-};
-use x509_parser::prelude::*;
 
 /// Struct serving information to route incoming connections, like server name to be handled and tls certs/keys settings.
 #[derive(Builder)]
@@ -79,265 +63,9 @@ fn opt_string_to_opt_pathbuf(input: &Option<String>) -> Option<PathBuf> {
   input.to_owned().as_ref().map(PathBuf::from)
 }
 
-impl Backend {
-  pub fn read_certs_and_key(&self) -> io::Result<CertifiedKey> {
-    debug!("Read TLS server certificates and private key");
-    let (Some(certs_path), Some(certs_keys_path)) = (self.tls_cert_path.as_ref(), self.tls_cert_key_path.as_ref()) else {
-      return Err(io::Error::new(io::ErrorKind::Other, "Invalid certs and keys paths"));
-    };
-    let certs: Vec<_> = {
-      let certs_path_str = certs_path.display().to_string();
-      let mut reader = BufReader::new(File::open(certs_path).map_err(|e| {
-        io::Error::new(
-          e.kind(),
-          format!("Unable to load the certificates [{certs_path_str}]: {e}"),
-        )
-      })?);
-      rustls_pemfile::certs(&mut reader)
-        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "Unable to parse the certificates"))?
-    }
-    .drain(..)
-    .map(Certificate)
-    .collect();
-    let certs_keys: Vec<_> = {
-      let certs_keys_path_str = certs_keys_path.display().to_string();
-      let encoded_keys = {
-        let mut encoded_keys = vec![];
-        File::open(certs_keys_path)
-          .map_err(|e| {
-            io::Error::new(
-              e.kind(),
-              format!("Unable to load the certificate keys [{certs_keys_path_str}]: {e}"),
-            )
-          })?
-          .read_to_end(&mut encoded_keys)?;
-        encoded_keys
-      };
-      let mut reader = Cursor::new(encoded_keys);
-      let pkcs8_keys = rustls_pemfile::pkcs8_private_keys(&mut reader).map_err(|_| {
-        io::Error::new(
-          io::ErrorKind::InvalidInput,
-          "Unable to parse the certificates private keys (PKCS8)",
-        )
-      })?;
-      reader.set_position(0);
-      let mut rsa_keys = rustls_pemfile::rsa_private_keys(&mut reader)?;
-      let mut keys = pkcs8_keys;
-      keys.append(&mut rsa_keys);
-      if keys.is_empty() {
-        return Err(io::Error::new(
-          io::ErrorKind::InvalidInput,
-          "No private keys found - Make sure that they are in PKCS#8/PEM format",
-        ));
-      }
-      keys.drain(..).map(PrivateKey).collect()
-    };
-    let signing_key = certs_keys
-      .iter()
-      .find_map(|k| {
-        if let Ok(sk) = any_supported_type(k) {
-          Some(sk)
-        } else {
-          None
-        }
-      })
-      .ok_or_else(|| {
-        io::Error::new(
-          io::ErrorKind::InvalidInput,
-          "Unable to find a valid certificate and key",
-        )
-      })?;
-    Ok(CertifiedKey::new(certs, signing_key))
-  }
-
-  fn read_client_ca_certs(&self) -> io::Result<(Vec<OwnedTrustAnchor>, HashSet<Vec<u8>>)> {
-    debug!("Read CA certificates for client authentication");
-    // Reads client certificate and returns client
-    let client_ca_cert_path = {
-      let Some(c) = self.client_ca_cert_path.as_ref() else {
-        return Err(io::Error::new(io::ErrorKind::Other, "Invalid certs and keys paths"));
-      };
-      c
-    };
-    let certs: Vec<_> = {
-      let certs_path_str = client_ca_cert_path.display().to_string();
-      let mut reader = BufReader::new(File::open(client_ca_cert_path).map_err(|e| {
-        io::Error::new(
-          e.kind(),
-          format!("Unable to load the client certificates [{certs_path_str}]: {e}"),
-        )
-      })?);
-      rustls_pemfile::certs(&mut reader)
-        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "Unable to parse the client certificates"))?
-    }
-    .drain(..)
-    .map(Certificate)
-    .collect();
-
-    let owned_trust_anchors: Vec<_> = certs
-      .iter()
-      .map(|v| {
-        // let trust_anchor = tokio_rustls::webpki::TrustAnchor::try_from_cert_der(&v.0).unwrap();
-        let trust_anchor = webpki::TrustAnchor::try_from_cert_der(&v.0).unwrap();
-        rustls::OwnedTrustAnchor::from_subject_spki_name_constraints(
-          trust_anchor.subject,
-          trust_anchor.spki,
-          trust_anchor.name_constraints,
-        )
-      })
-      .collect();
-
-    // TODO: SKID is not used currently
-    let subject_key_identifiers: HashSet<_> = certs
-      .iter()
-      .filter_map(|v| {
-        // retrieve ca key id (subject key id)
-        let cert = parse_x509_certificate(&v.0).unwrap().1;
-        let subject_key_ids = cert
-          .iter_extensions()
-          .filter_map(|ext| match ext.parsed_extension() {
-            ParsedExtension::SubjectKeyIdentifier(skid) => Some(skid),
-            _ => None,
-          })
-          .collect::<Vec<_>>();
-        if !subject_key_ids.is_empty() {
-          Some(subject_key_ids[0].0.to_owned())
-        } else {
-          None
-        }
-      })
-      .collect();
-
-    Ok((owned_trust_anchors, subject_key_identifiers))
-  }
-}
-
 #[derive(Default)]
 /// HashMap and some meta information for multiple Backend structs.
 pub struct Backends {
   pub apps: HashMap<ServerNameBytesExp, Backend>, // hyper::uriで抜いたhostで引っ掛ける
   pub default_server_name_bytes: Option<ServerNameBytesExp>, // for plaintext http
 }
-
-pub type SniServerCryptoMap = HashMap<ServerNameBytesExp, Arc<ServerConfig>>;
-pub struct ServerCrypto {
-  // For Quic/HTTP3, only servers with no client authentication
-  pub inner_global_no_client_auth: Arc<ServerConfig>,
-  // For TLS over TCP/HTTP2 and 1.1, map of SNI to server_crypto for all given servers
-  pub inner_local_map: Arc<SniServerCryptoMap>,
-}
-
-impl Backends {
-  pub async fn generate_server_crypto(&self) -> Result<ServerCrypto, anyhow::Error> {
-    let mut resolver_global = ResolvesServerCertUsingSni::new();
-    let mut server_crypto_local_map: SniServerCryptoMap = HashMap::default();
-
-    for (server_name_bytes_exp, backend) in self.apps.iter() {
-      if backend.tls_cert_key_path.is_some() && backend.tls_cert_path.is_some() {
-        match backend.read_certs_and_key() {
-          Ok(certified_key) => {
-            let mut resolver_local = ResolvesServerCertUsingSni::new();
-            let mut client_ca_roots_local = RootCertStore::empty();
-
-            // add server certificate and key
-            if let Err(e) = resolver_local.add(backend.server_name.as_str(), certified_key.to_owned()) {
-              error!(
-                "{}: Failed to read some certificates and keys {}",
-                backend.server_name.as_str(),
-                e
-              )
-            }
-
-            if backend.client_ca_cert_path.is_none() {
-              // aggregated server config for no client auth server for http3
-              if let Err(e) = resolver_global.add(backend.server_name.as_str(), certified_key) {
-                error!(
-                  "{}: Failed to read some certificates and keys {}",
-                  backend.server_name.as_str(),
-                  e
-                )
-              }
-            } else {
-              // add client certificate if specified
-              match backend.read_client_ca_certs() {
-                Ok((owned_trust_anchors, _subject_key_ids)) => {
-                  client_ca_roots_local.add_server_trust_anchors(owned_trust_anchors.into_iter());
-                }
-                Err(e) => {
-                  warn!(
-                    "Failed to add client CA certificate for {}: {}",
-                    backend.server_name.as_str(),
-                    e
-                  );
-                }
-              }
-            }
-
-            let mut server_config_local = if client_ca_roots_local.is_empty() {
-              // with no client auth, enable http1.1 -- 3
-              #[cfg(not(feature = "http3"))]
-              {
-                ServerConfig::builder()
-                  .with_safe_defaults()
-                  .with_no_client_auth()
-                  .with_cert_resolver(Arc::new(resolver_local))
-              }
-              #[cfg(feature = "http3")]
-              {
-                let mut sc = ServerConfig::builder()
-                  .with_safe_defaults()
-                  .with_no_client_auth()
-                  .with_cert_resolver(Arc::new(resolver_local));
-                sc.alpn_protocols = vec![b"h3".to_vec(), b"hq-29".to_vec()]; // TODO: remove hq-29 later?
-                sc
-              }
-            } else {
-              // with client auth, enable only http1.1 and 2
-              // let client_certs_verifier = rustls::server::AllowAnyAnonymousOrAuthenticatedClient::new(client_ca_roots);
-              let client_certs_verifier = rustls::server::AllowAnyAuthenticatedClient::new(client_ca_roots_local);
-              ServerConfig::builder()
-                .with_safe_defaults()
-                .with_client_cert_verifier(Arc::new(client_certs_verifier))
-                .with_cert_resolver(Arc::new(resolver_local))
-            };
-            server_config_local.alpn_protocols.push(b"h2".to_vec());
-            server_config_local.alpn_protocols.push(b"http/1.1".to_vec());
-
-            server_crypto_local_map.insert(server_name_bytes_exp.to_owned(), Arc::new(server_config_local));
-          }
-          Err(e) => {
-            warn!("Failed to add certificate for {}: {}", backend.server_name.as_str(), e);
-          }
-        }
-      }
-    }
-    // debug!("Load certificate chain for {} server_name's", cnt);
-
-    //////////////
-    let mut server_crypto_global = ServerConfig::builder()
-      .with_safe_defaults()
-      .with_no_client_auth()
-      .with_cert_resolver(Arc::new(resolver_global));
-
-    //////////////////////////////
-
-    #[cfg(feature = "http3")]
-    {
-      server_crypto_global.alpn_protocols = vec![
-        b"h3".to_vec(),
-        b"hq-29".to_vec(), // TODO: remove later?
-        b"h2".to_vec(),
-        b"http/1.1".to_vec(),
-      ];
-    }
-    #[cfg(not(feature = "http3"))]
-    {
-      server_crypto_global.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
-    }
-
-    Ok(ServerCrypto {
-      inner_global_no_client_auth: Arc::new(server_crypto_global),
-      inner_local_map: Arc::new(server_crypto_local_map),
-    })
-  }
-}

src/cert_reader.rs

@@ -0,0 +1,93 @@
+use crate::{log::*, proxy::CertsAndKeys};
+use rustls::{Certificate, PrivateKey};
+use std::{
+  fs::File,
+  io::{self, BufReader, Cursor, Read},
+  path::PathBuf,
+};
+
+/// Read certificates and private keys from file
+pub(crate) fn read_certs_and_keys(
+  cert_path: &PathBuf,
+  cert_key_path: &PathBuf,
+  client_ca_cert_path: Option<&PathBuf>,
+) -> Result<CertsAndKeys, io::Error> {
+  debug!("Read TLS server certificates and private key");
+
+  let certs: Vec<_> = {
+    let certs_path_str = cert_path.display().to_string();
+    let mut reader = BufReader::new(File::open(cert_path).map_err(|e| {
+      io::Error::new(
+        e.kind(),
+        format!("Unable to load the certificates [{certs_path_str}]: {e}"),
+      )
+    })?);
+    rustls_pemfile::certs(&mut reader)
+      .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "Unable to parse the certificates"))?
+  }
+  .drain(..)
+  .map(Certificate)
+  .collect();
+
+  let cert_keys: Vec<_> = {
+    let cert_key_path_str = cert_key_path.display().to_string();
+    let encoded_keys = {
+      let mut encoded_keys = vec![];
+      File::open(cert_key_path)
+        .map_err(|e| {
+          io::Error::new(
+            e.kind(),
+            format!("Unable to load the certificate keys [{cert_key_path_str}]: {e}"),
+          )
+        })?
+        .read_to_end(&mut encoded_keys)?;
+      encoded_keys
+    };
+    let mut reader = Cursor::new(encoded_keys);
+    let pkcs8_keys = rustls_pemfile::pkcs8_private_keys(&mut reader).map_err(|_| {
+      io::Error::new(
+        io::ErrorKind::InvalidInput,
+        "Unable to parse the certificates private keys (PKCS8)",
+      )
+    })?;
+    reader.set_position(0);
+    let mut rsa_keys = rustls_pemfile::rsa_private_keys(&mut reader)?;
+    let mut keys = pkcs8_keys;
+    keys.append(&mut rsa_keys);
+    if keys.is_empty() {
+      return Err(io::Error::new(
+        io::ErrorKind::InvalidInput,
+        "No private keys found - Make sure that they are in PKCS#8/PEM format",
+      ));
+    }
+    keys.drain(..).map(PrivateKey).collect()
+  };
+
+  let client_ca_certs = if let Some(path) = client_ca_cert_path {
+    debug!("Read CA certificates for client authentication");
+    // Reads client certificate and returns client
+    let certs: Vec<_> = {
+      let certs_path_str = path.display().to_string();
+      let mut reader = BufReader::new(File::open(path).map_err(|e| {
+        io::Error::new(
+          e.kind(),
+          format!("Unable to load the client certificates [{certs_path_str}]: {e}"),
+        )
+      })?);
+      rustls_pemfile::certs(&mut reader)
+        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "Unable to parse the client certificates"))?
+    }
+    .drain(..)
+    .map(Certificate)
+    .collect();
+    Some(certs)
+  } else {
+    None
+  };
+
+  Ok(CertsAndKeys {
+    certs,
+    cert_keys,
+    client_ca_certs,
+  })
+}

src/constants.rs

@@ -8,6 +8,7 @@ pub const TLS_HANDSHAKE_TIMEOUT_SEC: u64 = 15; // default as with firefox browse
 pub const MAX_CLIENTS: usize = 512;
 pub const MAX_CONCURRENT_STREAMS: u32 = 64;
 pub const CERTS_WATCH_DELAY_SECS: u32 = 60;
+pub const LOAD_CERTS_ONLY_WHEN_UPDATED: bool = true;
 
 // #[cfg(feature = "http3")]
 // pub const H3_RESPONSE_BUF_SIZE: usize = 65_536; // 64KB

src/main.rs

@@ -6,6 +6,7 @@ use tikv_jemallocator::Jemalloc;
 static GLOBAL: Jemalloc = Jemalloc;
 
 mod backend;
+mod cert_reader;
 mod config;
 mod constants;
 mod error;

src/proxy/crypto_service.rs

@@ -0,0 +1,253 @@
+use crate::{
+  cert_reader::read_certs_and_keys, // TODO: Trait defining read_certs_and_keys and add struct implementing the trait to backend when build backend
+  globals::Globals,
+  log::*,
+  utils::ServerNameBytesExp,
+};
+use async_trait::async_trait;
+use hot_reload::*;
+use rustc_hash::{FxHashMap as HashMap, FxHashSet as HashSet};
+use rustls::{
+  server::ResolvesServerCertUsingSni,
+  sign::{any_supported_type, CertifiedKey},
+  Certificate, OwnedTrustAnchor, PrivateKey, RootCertStore, ServerConfig,
+};
+use std::{io, sync::Arc};
+use x509_parser::prelude::*;
+
+#[derive(Clone)]
+/// Reloader service for certificates and keys for TLS
+pub struct CryptoReloader {
+  globals: Arc<Globals>,
+}
+
+/// Certificates and private keys in rustls loaded from files
+#[derive(Debug, PartialEq, Eq, Clone)]
+pub struct CertsAndKeys {
+  pub certs: Vec<Certificate>,
+  pub cert_keys: Vec<PrivateKey>,
+  pub client_ca_certs: Option<Vec<Certificate>>,
+}
+
+pub type SniServerCryptoMap = HashMap<ServerNameBytesExp, Arc<ServerConfig>>;
+pub struct ServerCrypto {
+  // For Quic/HTTP3, only servers with no client authentication
+  pub inner_global_no_client_auth: Arc<ServerConfig>,
+  // For TLS over TCP/HTTP2 and 1.1, map of SNI to server_crypto for all given servers
+  pub inner_local_map: Arc<SniServerCryptoMap>,
+}
+
+/// Reloader target for the certificate reloader service
+#[derive(Debug, PartialEq, Eq, Clone, Default)]
+pub struct ServerCryptoBase {
+  inner: HashMap<ServerNameBytesExp, CertsAndKeys>,
+}
+
+#[async_trait]
+impl Reload<ServerCryptoBase> for CryptoReloader {
+  type Source = Arc<Globals>;
+  async fn new(source: &Self::Source) -> Result<Self, ReloaderError<ServerCryptoBase>> {
+    Ok(Self {
+      globals: source.clone(),
+    })
+  }
+
+  async fn reload(&self) -> Result<Option<ServerCryptoBase>, ReloaderError<ServerCryptoBase>> {
+    let mut certs_and_keys_map = ServerCryptoBase::default();
+
+    for (server_name_bytes_exp, backend) in self.globals.backends.apps.iter() {
+      if backend.tls_cert_key_path.is_some() && backend.tls_cert_path.is_some() {
+        let tls_cert_key_path = backend.tls_cert_key_path.as_ref().unwrap();
+        let tls_cert_path = backend.tls_cert_path.as_ref().unwrap();
+        let tls_client_ca_cert_path = backend.client_ca_cert_path.as_ref();
+        let certs_and_keys = read_certs_and_keys(tls_cert_path, tls_cert_key_path, tls_client_ca_cert_path)
+          .map_err(|_e| ReloaderError::<ServerCryptoBase>::Reload("Failed to reload cert, key or ca cert"))?;
+
+        certs_and_keys_map
+          .inner
+          .insert(server_name_bytes_exp.to_owned(), certs_and_keys);
+      }
+    }
+
+    Ok(Some(certs_and_keys_map))
+  }
+}
+
+impl CertsAndKeys {
+  fn parse_server_certs_and_keys(&self) -> Result<CertifiedKey, anyhow::Error> {
+    // for (server_name_bytes_exp, certs_and_keys) in self.inner.iter() {
+    let signing_key = self
+      .cert_keys
+      .iter()
+      .find_map(|k| {
+        if let Ok(sk) = any_supported_type(k) {
+          Some(sk)
+        } else {
+          None
+        }
+      })
+      .ok_or_else(|| {
+        io::Error::new(
+          io::ErrorKind::InvalidInput,
+          "Unable to find a valid certificate and key",
+        )
+      })?;
+    Ok(CertifiedKey::new(self.certs.clone(), signing_key))
+  }
+
+  pub fn parse_client_ca_certs(&self) -> Result<(Vec<OwnedTrustAnchor>, HashSet<Vec<u8>>), anyhow::Error> {
+    let certs = self.client_ca_certs.as_ref().ok_or(anyhow::anyhow!("No client cert"))?;
+
+    let owned_trust_anchors: Vec<_> = certs
+      .iter()
+      .map(|v| {
+        // let trust_anchor = tokio_rustls::webpki::TrustAnchor::try_from_cert_der(&v.0).unwrap();
+        let trust_anchor = webpki::TrustAnchor::try_from_cert_der(&v.0).unwrap();
+        rustls::OwnedTrustAnchor::from_subject_spki_name_constraints(
+          trust_anchor.subject,
+          trust_anchor.spki,
+          trust_anchor.name_constraints,
+        )
+      })
+      .collect();
+
+    // TODO: SKID is not used currently
+    let subject_key_identifiers: HashSet<_> = certs
+      .iter()
+      .filter_map(|v| {
+        // retrieve ca key id (subject key id)
+        let cert = parse_x509_certificate(&v.0).unwrap().1;
+        let subject_key_ids = cert
+          .iter_extensions()
+          .filter_map(|ext| match ext.parsed_extension() {
+            ParsedExtension::SubjectKeyIdentifier(skid) => Some(skid),
+            _ => None,
+          })
+          .collect::<Vec<_>>();
+        if !subject_key_ids.is_empty() {
+          Some(subject_key_ids[0].0.to_owned())
+        } else {
+          None
+        }
+      })
+      .collect();
+
+    Ok((owned_trust_anchors, subject_key_identifiers))
+  }
+}
+
+impl TryInto<Arc<ServerCrypto>> for &ServerCryptoBase {
+  type Error = anyhow::Error;
+
+  fn try_into(self) -> Result<Arc<ServerCrypto>, Self::Error> {
+    let mut resolver_global = ResolvesServerCertUsingSni::new();
+    let mut server_crypto_local_map: SniServerCryptoMap = HashMap::default();
+
+    for (server_name_bytes_exp, certs_and_keys) in self.inner.iter() {
+      let server_name: String = server_name_bytes_exp.try_into()?;
+
+      // Parse server certificates and private keys
+      let Ok(certified_key): Result<CertifiedKey, _> = certs_and_keys.parse_server_certs_and_keys() else {
+        warn!("Failed to add certificate for {}", server_name);
+        continue;
+      };
+
+      let mut resolver_local = ResolvesServerCertUsingSni::new();
+      let mut client_ca_roots_local = RootCertStore::empty();
+
+      // add server certificate and key
+      if let Err(e) = resolver_local.add(server_name.as_str(), certified_key.to_owned()) {
+        error!(
+          "{}: Failed to read some certificates and keys {}",
+          server_name.as_str(),
+          e
+        )
+      }
+
+      // add client certificate if specified
+      if certs_and_keys.client_ca_certs.is_none() {
+        // aggregated server config for no client auth server for http3
+        if let Err(e) = resolver_global.add(server_name.as_str(), certified_key) {
+          error!(
+            "{}: Failed to read some certificates and keys {}",
+            server_name.as_str(),
+            e
+          )
+        }
+      } else {
+        // add client certificate if specified
+        match certs_and_keys.parse_client_ca_certs() {
+          Ok((owned_trust_anchors, _subject_key_ids)) => {
+            client_ca_roots_local.add_server_trust_anchors(owned_trust_anchors.into_iter());
+          }
+          Err(e) => {
+            warn!(
+              "Failed to add client CA certificate for {}: {}",
+              server_name.as_str(),
+              e
+            );
+          }
+        }
+      }
+
+      let mut server_config_local = if client_ca_roots_local.is_empty() {
+        // with no client auth, enable http1.1 -- 3
+        #[cfg(not(feature = "http3"))]
+        {
+          ServerConfig::builder()
+            .with_safe_defaults()
+            .with_no_client_auth()
+            .with_cert_resolver(Arc::new(resolver_local))
+        }
+        #[cfg(feature = "http3")]
+        {
+          let mut sc = ServerConfig::builder()
+            .with_safe_defaults()
+            .with_no_client_auth()
+            .with_cert_resolver(Arc::new(resolver_local));
+          sc.alpn_protocols = vec![b"h3".to_vec(), b"hq-29".to_vec()]; // TODO: remove hq-29 later?
+          sc
+        }
+      } else {
+        // with client auth, enable only http1.1 and 2
+        // let client_certs_verifier = rustls::server::AllowAnyAnonymousOrAuthenticatedClient::new(client_ca_roots);
+        let client_certs_verifier = rustls::server::AllowAnyAuthenticatedClient::new(client_ca_roots_local);
+        ServerConfig::builder()
+          .with_safe_defaults()
+          .with_client_cert_verifier(Arc::new(client_certs_verifier))
+          .with_cert_resolver(Arc::new(resolver_local))
+      };
+      server_config_local.alpn_protocols.push(b"h2".to_vec());
+      server_config_local.alpn_protocols.push(b"http/1.1".to_vec());
+
+      server_crypto_local_map.insert(server_name_bytes_exp.to_owned(), Arc::new(server_config_local));
+    }
+
+    //////////////
+    let mut server_crypto_global = ServerConfig::builder()
+      .with_safe_defaults()
+      .with_no_client_auth()
+      .with_cert_resolver(Arc::new(resolver_global));
+
+    //////////////////////////////
+
+    #[cfg(feature = "http3")]
+    {
+      server_crypto_global.alpn_protocols = vec![
+        b"h3".to_vec(),
+        b"hq-29".to_vec(), // TODO: remove later?
+        b"h2".to_vec(),
+        b"http/1.1".to_vec(),
+      ];
+    }
+    #[cfg(not(feature = "http3"))]
+    {
+      server_crypto_global.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
+    }
+
+    Ok(Arc::new(ServerCrypto {
+      inner_global_no_client_auth: Arc::new(server_crypto_global),
+      inner_local_map: Arc::new(server_crypto_local_map),
+    }))
+  }
+}

src/proxy/mod.rs

@@ -1,7 +1,9 @@
+mod crypto_service;
 mod proxy_client_cert;
 #[cfg(feature = "http3")]
 mod proxy_h3;
 mod proxy_main;
 mod proxy_tls;
 
+pub use crypto_service::CertsAndKeys;
 pub use proxy_main::{Proxy, ProxyBuilder, ProxyBuilderError};

src/proxy/proxy_tls.rs

@@ -1,11 +1,9 @@
-use super::proxy_main::{LocalExecutor, Proxy};
+use super::{
-use crate::{
+  crypto_service::{CryptoReloader, ServerCrypto, ServerCryptoBase, SniServerCryptoMap},
-  backend::{ServerCrypto, SniServerCryptoMap},
+  proxy_main::{LocalExecutor, Proxy},
-  constants::*,
-  error::*,
-  log::*,
-  utils::BytesName,
 };
+use crate::{constants::*, error::*, log::*, utils::BytesName};
+use hot_reload::{ReloaderReceiver, ReloaderService};
 use hyper::{client::connect::Connect, server::conn::Http};
 #[cfg(feature = "http3")]
 use quinn::{crypto::rustls::HandshakeData, Endpoint, ServerConfig as QuicServerConfig, TransportConfig};
@@ -14,34 +12,18 @@ use rustls::ServerConfig;
 use std::sync::Arc;
 use tokio::{
   net::TcpListener,
-  sync::watch,
+  time::{timeout, Duration},
-  time::{sleep, timeout, Duration},
 };
 
 impl<T> Proxy<T>
 where
   T: Connect + Clone + Sync + Send + 'static,
 {
-  async fn cert_service(&self, server_crypto_tx: watch::Sender<Option<Arc<ServerCrypto>>>) {
-    info!("Start cert watch service");
-    loop {
-      if let Ok(server_crypto) = self.globals.backends.generate_server_crypto().await {
-        if let Err(_e) = server_crypto_tx.send(Some(Arc::new(server_crypto))) {
-          error!("Failed to populate server crypto");
-          break;
-        }
-      } else {
-        error!("Failed to update certs");
-      }
-      sleep(Duration::from_secs(CERTS_WATCH_DELAY_SECS.into())).await;
-    }
-  }
-
   // TCP Listener Service, i.e., http/2 and http/1.1
   async fn listener_service(
     &self,
     server: Http<LocalExecutor>,
-    mut server_crypto_rx: watch::Receiver<Option<Arc<ServerCrypto>>>,
+    mut server_crypto_rx: ReloaderReceiver<ServerCryptoBase>,
   ) -> Result<()> {
     let tcp_listener = TcpListener::bind(&self.listening_on).await?;
     info!("Start TCP proxy serving with HTTPS request for configured host names");
@@ -105,9 +87,14 @@ where
         }
         _ = server_crypto_rx.changed() => {
           if server_crypto_rx.borrow().is_none() {
+            error!("Reloader is broken");
             break;
           }
-          let server_crypto = server_crypto_rx.borrow().clone().unwrap();
+          let cert_keys_map = server_crypto_rx.borrow().clone().unwrap();
+          let Some(server_crypto): Option<Arc<ServerCrypto>> = (&cert_keys_map).try_into().ok() else {
+            error!("Failed to update server crypto");
+            break;
+          };
           server_crypto_map = Some(server_crypto.inner_local_map.clone());
         }
         else => break
@@ -117,7 +104,7 @@ where
   }
 
   #[cfg(feature = "http3")]
-  async fn listener_service_h3(&self, mut server_crypto_rx: watch::Receiver<Option<Arc<ServerCrypto>>>) -> Result<()> {
+  async fn listener_service_h3(&self, mut server_crypto_rx: ReloaderReceiver<ServerCryptoBase>) -> Result<()> {
     info!("Start UDP proxy serving with HTTP/3 request for configured host names");
     // first set as null config server
     let rustls_server_config = ServerConfig::builder()
@@ -173,12 +160,18 @@ where
         }
         _ = server_crypto_rx.changed() => {
           if server_crypto_rx.borrow().is_none() {
+            error!("Reloader is broken");
             break;
           }
-          server_crypto = server_crypto_rx.borrow().clone();
+          let cert_keys_map = server_crypto_rx.borrow().clone().unwrap();
-          if server_crypto.is_some(){
+
-            endpoint.set_server_config(Some(QuicServerConfig::with_crypto(server_crypto.clone().unwrap().inner_global_no_client_auth.clone())));
+          server_crypto = (&cert_keys_map).try_into().ok();
-          }
+          let Some(inner) = server_crypto.clone() else {
+            error!("Failed to update server crypto for h3");
+            break;
+          };
+          endpoint.set_server_config(Some(QuicServerConfig::with_crypto(inner.clone().inner_global_no_client_auth.clone())));
+
         }
         else => break
       }
@@ -188,7 +181,14 @@ where
   }
 
   pub async fn start_with_tls(self, server: Http<LocalExecutor>) -> Result<()> {
-    let (tx, rx) = watch::channel::<Option<Arc<ServerCrypto>>>(None);
+    let (cert_reloader_service, cert_reloader_rx) = ReloaderService::<CryptoReloader, ServerCryptoBase>::new(
+      &self.globals.clone(),
+      CERTS_WATCH_DELAY_SECS,
+      !LOAD_CERTS_ONLY_WHEN_UPDATED,
+    )
+    .await
+    .map_err(|e| anyhow::anyhow!(e))?;
+
     #[cfg(not(feature = "http3"))]
     {
       tokio::select! {
@@ -209,13 +209,13 @@ where
     {
       if self.globals.proxy_config.http3 {
         tokio::select! {
-          _= self.cert_service(tx) => {
+          _= cert_reloader_service.start() => {
             error!("Cert service for TLS exited");
           },
-          _ = self.listener_service(server, rx.clone()) => {
+          _ = self.listener_service(server, cert_reloader_rx.clone()) => {
             error!("TCP proxy service for TLS exited");
           },
-          _= self.listener_service_h3(rx) => {
+          _= self.listener_service_h3(cert_reloader_rx) => {
             error!("UDP proxy service for QUIC exited");
           },
           else => {
@@ -226,10 +226,10 @@ where
         Ok(())
       } else {
         tokio::select! {
-          _= self.cert_service(tx) => {
+          _= cert_reloader_service.start() => {
             error!("Cert service for TLS exited");
           },
-          _ = self.listener_service(server, rx) => {
+          _ = self.listener_service(server, cert_reloader_rx) => {
             error!("TCP proxy service for TLS exited");
           },
           else => {

src/utils/bytes_name.rs

@@ -7,6 +7,13 @@ impl From<&[u8]> for ServerNameBytesExp {
     Self(b.to_ascii_lowercase())
   }
 }
+impl TryInto<String> for &ServerNameBytesExp {
+  type Error = anyhow::Error;
+  fn try_into(self) -> Result<String, Self::Error> {
+    let s = std::str::from_utf8(&self.0)?;
+    Ok(s.to_string())
+  }
+}
 
 /// Path name, like "/path/ok", represented in bytes-based struct
 /// for searching hashmap or key list by exact or longest-prefix matching