Cert services: Self-signed and ACME with DNS challenge

Cargo.toml

@@ -22,11 +22,20 @@ unused = { level = "allow", priority = -1 }
 async-trait = "0.1.91"
 tokio = { version = "1.53.1", features = ["full"] }
 
+# Arc
+arc-swap = "1.9.1"
+
 # Certs
 # used Ring as backend for default
 rcgen = { version = "0.14.8", features = ["default"] }
 # match the backed from rcgen
-instant-acme = { version = "0.8.5", features = ["rcgen"] }
+instant-acme = { version = "0.8.5", default-features = false, features = [
+   "ring",
+   "rcgen",
+   "hyper-rustls",
+] }
+rustls = "0.23.41"
+
 
 # TOML
 toml = "1.1.3"

README.md

@@ -63,6 +63,8 @@ services:
    proxy:
       image: maxvanderschee/reverse-proxy:latest # or ghcr.io/mvdschee/reverse-proxy:latest
       restart: unless-stopped
+      # host ports 80/443 mapped to container ports 8080/8443
+      # see ## Under the hood for explanation
       ports:
          - "80:8080"
          - "443:8443"
@@ -164,5 +166,12 @@ I'll be upfront on every public project about what was done with AI. For this on
 
 - Research and tradeoff discussions
 - Cleanup of the README and other prose
-- Talking through code-level solutions
+- Discussing code-level solutions
 - Generating the Docker image scaffolding from a spec
+
+# TODO:
+
+- finish create_acme_dns_challenge
+- create a dns entry checker for the background task
+- generate a staging certificate with instance_acme
+- wire up the full flow in CertBackgroundRenewal

docker-compose.yml

@@ -6,6 +6,7 @@ services:
          context: .
          dockerfile: .docker/Dockerfile
       ports:
+         # nonroot user can't bind to ports < 1024, so map to 8080/8443
          - "80:8080"
          - "443:8443"
       # Lets upstream = "host.docker.internal:<port>" reach apps running

example/example.toml

@@ -1,5 +1,5 @@
 [acme]
-email       = "max@example.com"
+email       = "max@example.com" # use a real email this will fail the even on local testing
 
 [[routes]]
 host        = "git.example.com"

makefile

@@ -1,5 +1,5 @@
 dev:
-	CONFIG_PATH=./example/example.toml watchexec -q -c -w src --exts rs --restart "cargo run"
+	CONFIG_PATH=./example/local.toml watchexec -q -c -w src --exts rs --restart "cargo run"
 
 scan:
 	foxguard --config .foxguard.yml

src/config.rs

@@ -20,8 +20,8 @@ const HTTP_PORT_DEFAULT: u16 = 80;
 const HTTPS_PORT_DEFAULT: u16 = 443;
 const INPUT_ADDRESS: &str = "0.0.0.0";
 
-// in seconds
-const CERT_BACKGROUND_TASK_INTERVAL: u64 = 120;
+/// in seconds
+const CERT_BACKGROUND_TASK_INTERVAL: u64 = 3600; // 1 hour
 
 #[derive(Debug, Clone)]
 pub struct Config {