Merge pull request #3942 from lavalleeale-forks/main
Added support for specifying ACME-server by using REGISTRY_HTTP_TLS_LETSENCRYPT_DIRECTORYURL
This commit is contained in:
commit
003dd5aaa1
4 changed files with 29 additions and 11 deletions
|
@ -131,6 +131,10 @@ type Configuration struct {
|
|||
// Hosts specifies the hosts which are allowed to obtain Let's
|
||||
// Encrypt certificates.
|
||||
Hosts []string `yaml:"hosts,omitempty"`
|
||||
|
||||
// DirectoryURL points to the CA directory endpoint.
|
||||
// If empty, LetsEncrypt is used.
|
||||
DirectoryURL string `yaml:"directoryurl,omitempty"`
|
||||
} `yaml:"letsencrypt,omitempty"`
|
||||
} `yaml:"tls,omitempty"`
|
||||
|
||||
|
|
|
@ -89,9 +89,10 @@ var configStruct = Configuration{
|
|||
MinimumTLS string `yaml:"minimumtls,omitempty"`
|
||||
CipherSuites []string `yaml:"ciphersuites,omitempty"`
|
||||
LetsEncrypt struct {
|
||||
CacheFile string `yaml:"cachefile,omitempty"`
|
||||
Email string `yaml:"email,omitempty"`
|
||||
Hosts []string `yaml:"hosts,omitempty"`
|
||||
CacheFile string `yaml:"cachefile,omitempty"`
|
||||
Email string `yaml:"email,omitempty"`
|
||||
Hosts []string `yaml:"hosts,omitempty"`
|
||||
DirectoryURL string `yaml:"directoryurl,omitempty"`
|
||||
} `yaml:"letsencrypt,omitempty"`
|
||||
} `yaml:"tls,omitempty"`
|
||||
Headers http.Header `yaml:"headers,omitempty"`
|
||||
|
@ -113,9 +114,10 @@ var configStruct = Configuration{
|
|||
MinimumTLS string `yaml:"minimumtls,omitempty"`
|
||||
CipherSuites []string `yaml:"ciphersuites,omitempty"`
|
||||
LetsEncrypt struct {
|
||||
CacheFile string `yaml:"cachefile,omitempty"`
|
||||
Email string `yaml:"email,omitempty"`
|
||||
Hosts []string `yaml:"hosts,omitempty"`
|
||||
CacheFile string `yaml:"cachefile,omitempty"`
|
||||
Email string `yaml:"email,omitempty"`
|
||||
Hosts []string `yaml:"hosts,omitempty"`
|
||||
DirectoryURL string `yaml:"directoryurl,omitempty"`
|
||||
} `yaml:"letsencrypt,omitempty"`
|
||||
}{
|
||||
ClientCAs: []string{"/path/to/ca.pem"},
|
||||
|
|
|
@ -242,6 +242,7 @@ http:
|
|||
cachefile: /path/to/cache-file
|
||||
email: emailused@letsencrypt.com
|
||||
hosts: [myregistryaddress.org]
|
||||
directoryurl: https://acme-v02.api.letsencrypt.org/directory
|
||||
debug:
|
||||
addr: localhost:5001
|
||||
prometheus:
|
||||
|
@ -826,6 +827,7 @@ http:
|
|||
cachefile: /path/to/cache-file
|
||||
email: emailused@letsencrypt.com
|
||||
hosts: [myregistryaddress.org]
|
||||
directoryurl: https://acme-v02.api.letsencrypt.org/directory
|
||||
debug:
|
||||
addr: localhost:5001
|
||||
headers:
|
||||
|
@ -917,11 +919,12 @@ TLS certificates provided by
|
|||
> ensure that you have the `ca-certificates` package installed in order to verify
|
||||
> letsencrypt certificates.
|
||||
|
||||
| Parameter | Required | Description |
|
||||
|-----------|----------|-------------------------------------------------------|
|
||||
| `cachefile` | yes | Absolute path to a file where the Let's Encrypt agent can cache data. |
|
||||
| `email` | yes | The email address used to register with Let's Encrypt. |
|
||||
| `hosts` | no | The hostnames allowed for Let's Encrypt certificates. |
|
||||
| Parameter | Required | Description |
|
||||
|----------------|----------|-----------------------------------------------------------------------|
|
||||
| `cachefile` | yes | Absolute path to a file where the Let's Encrypt agent can cache data. |
|
||||
| `email` | yes | The email address used to register with Let's Encrypt. |
|
||||
| `hosts` | no | The hostnames allowed for Let's Encrypt certificates. |
|
||||
| `directoryurl` | no | The url to use for the ACME server. |
|
||||
|
||||
### `debug`
|
||||
|
||||
|
|
|
@ -202,6 +202,14 @@ func getCipherSuiteNames(ids []uint16) []string {
|
|||
return names
|
||||
}
|
||||
|
||||
// set ACME-server/DirectoryURL, if provided
|
||||
func setDirectoryURL(directoryurl string) *acme.Client {
|
||||
if len(directoryurl) > 0 {
|
||||
return &acme.Client{DirectoryURL: directoryurl}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ListenAndServe runs the registry's HTTP server.
|
||||
func (registry *Registry) ListenAndServe() error {
|
||||
config := registry.config
|
||||
|
@ -250,6 +258,7 @@ func (registry *Registry) ListenAndServe() error {
|
|||
Cache: autocert.DirCache(config.HTTP.TLS.LetsEncrypt.CacheFile),
|
||||
Email: config.HTTP.TLS.LetsEncrypt.Email,
|
||||
Prompt: autocert.AcceptTOS,
|
||||
Client: setDirectoryURL(config.HTTP.TLS.LetsEncrypt.DirectoryURL),
|
||||
}
|
||||
tlsConf.GetCertificate = m.GetCertificate
|
||||
tlsConf.NextProtos = append(tlsConf.NextProtos, acme.ALPNProto)
|
||||
|
|
Loading…
Reference in a new issue