wip: designing acme

rpxy-acme/src/targets.rs

@@ -1,83 +1,96 @@
-use rustc_hash::FxHashMap as HashMap;
-use std::path::PathBuf;
-use url::Url;
-
+use crate::dir_cache::DirCache;
 use crate::{
-  constants::{ACME_ACCOUNT_SUBDIR, ACME_CERTIFICATE_FILE_NAME, ACME_DIR_URL, ACME_PRIVATE_KEY_FILE_NAME, ACME_REGISTRY_PATH},
+  constants::{ACME_DIR_URL, ACME_REGISTRY_PATH},
   error::RpxyAcmeError,
   log::*,
 };
+use rustc_hash::FxHashMap as HashMap;
+use rustls_acme::AcmeConfig;
+use std::{fmt::Debug, path::PathBuf, sync::Arc};
+use url::Url;
 
 #[derive(Debug)]
 /// ACME settings
-pub struct AcmeTargets {
-  /// ACME account email
-  pub email: String,
+pub struct AcmeContexts<EC, EA = EC>
+where
+  EC: Debug + 'static,
+  EA: Debug + 'static,
+{
   /// ACME directory url
-  pub acme_dir_url: Url,
-  /// ACME registry path that stores account key and certificate
-  pub acme_registry_path: PathBuf,
-  /// ACME accounts directory, subdirectory of ACME_REGISTRY_PATH
-  pub acme_accounts_dir: PathBuf,
-  /// ACME target info map
-  pub acme_targets: HashMap<String, AcmeTargetInfo>,
+  acme_dir_url: Url,
+  /// ACME registry directory
+  acme_registry_dir: PathBuf,
+  /// ACME contacts
+  contacts: Vec<String>,
+  /// ACME config
+  inner: HashMap<String, Box<AcmeConfig<EC, EA>>>,
 }
 
-#[derive(Debug)]
-/// ACME settings for each server name
-pub struct AcmeTargetInfo {
-  /// Server name
-  pub server_name: String,
-  /// private key path
-  pub private_key_path: PathBuf,
-  /// certificate path
-  pub certificate_path: PathBuf,
-}
+impl AcmeContexts<std::io::Error> {
+  /// Create a new instance. Note that for each domain, a new AcmeConfig is created.
+  /// This means that for each domain, a distinct operation will be dispatched and separated certificates will be generated.
+  pub fn try_new(
+    acme_dir_url: Option<&str>,
+    acme_registry_dir: Option<&str>,
+    contacts: &[String],
+    domains: &[String],
+  ) -> Result<Self, RpxyAcmeError> {
+    let acme_registry_dir = acme_registry_dir
+      .map(|v| v.to_ascii_lowercase())
+      .map_or_else(|| PathBuf::from(ACME_REGISTRY_PATH), PathBuf::from);
+    if acme_registry_dir.exists() && !acme_registry_dir.is_dir() {
+      return Err(RpxyAcmeError::InvalidAcmeRegistryPath);
+    }
+    let acme_dir_url = acme_dir_url
+      .map(|v| v.to_ascii_lowercase())
+      .as_deref()
+      .map_or_else(|| Url::parse(ACME_DIR_URL), Url::parse)?;
+    let contacts = contacts.iter().map(|email| format!("mailto:{email}")).collect::<Vec<_>>();
+    let rustls_client_config = rustls::ClientConfig::builder()
+      .dangerous() // The `Verifier` we're using is actually safe
+      .with_custom_certificate_verifier(std::sync::Arc::new(rustls_platform_verifier::Verifier::new()))
+      .with_no_client_auth();
+    let rustls_client_config = Arc::new(rustls_client_config);
 
-impl AcmeTargets {
-  /// Create a new instance
-  pub fn try_new(email: &str, acme_dir_url: Option<&str>, acme_registry_path: Option<&str>) -> Result<Self, RpxyAcmeError> {
-    let acme_dir_url = Url::parse(acme_dir_url.unwrap_or(ACME_DIR_URL))?;
-    let acme_registry_path = acme_registry_path.map_or_else(|| PathBuf::from(ACME_REGISTRY_PATH), PathBuf::from);
-    if acme_registry_path.exists() && !acme_registry_path.is_dir() {
-      return Err(RpxyAcmeError::InvalidAcmeRegistryPath);
-    }
-    let acme_account_dir = acme_registry_path.join(ACME_ACCOUNT_SUBDIR);
-    if acme_account_dir.exists() && !acme_account_dir.is_dir() {
-      return Err(RpxyAcmeError::InvalidAcmeRegistryPath);
-    }
-    std::fs::create_dir_all(&acme_account_dir)?;
+    let inner = domains
+      .iter()
+      .map(|domain| {
+        let dir_cache = DirCache::new(&acme_registry_dir, domain);
+        let config = AcmeConfig::new([domain])
+          .contact(&contacts)
+          .cache(dir_cache)
+          .directory(acme_dir_url.as_str())
+          .client_tls_config(rustls_client_config.clone());
+        let config = Box::new(config);
+        (domain.to_ascii_lowercase(), config)
+      })
+      .collect::<HashMap<_, _>>();
 
     Ok(Self {
-      email: email.to_owned(),
       acme_dir_url,
-      acme_registry_path,
-      acme_accounts_dir: acme_account_dir,
-      acme_targets: HashMap::default(),
+      acme_registry_dir,
+      contacts,
+      inner,
     })
   }
+}
 
-  /// Add a new target
-  /// Write dummy cert and key files if not exists
-  pub fn add_target(&mut self, server_name: &str) -> Result<(), RpxyAcmeError> {
-    info!("Adding ACME target: {}", server_name);
-    let parent_dir = self.acme_registry_path.join(server_name);
-    let private_key_path = parent_dir.join(ACME_PRIVATE_KEY_FILE_NAME);
-    let certificate_path = parent_dir.join(ACME_CERTIFICATE_FILE_NAME);
+#[cfg(test)]
+mod tests {
+  use super::*;
 
-    if !parent_dir.exists() {
-      warn!("Creating ACME target directory: {}", parent_dir.display());
-      std::fs::create_dir_all(parent_dir)?;
-    }
-
-    self.acme_targets.insert(
-      server_name.to_owned(),
-      AcmeTargetInfo {
-        server_name: server_name.to_owned(),
-        private_key_path,
-        certificate_path,
-      },
-    );
-    Ok(())
+  #[test]
+  fn test_try_new() {
+    let acme_dir_url = "https://acme.example.com/directory";
+    let acme_registry_dir = "/tmp/acme";
+    let contacts = vec!["test@example.com".to_string()];
+    let acme_contexts: AcmeContexts<std::io::Error> = AcmeContexts::try_new(
+      Some(acme_dir_url),
+      Some(acme_registry_dir),
+      &contacts,
+      &["example.com".to_string(), "example.org".to_string()],
+    )
+    .unwrap();
+    println!("{:#?}", acme_contexts);
   }
 }