save private key generated during acme handshake

.env.dev

@@ -4,4 +4,3 @@ export DOMIPLY_ORIGIN_STORE_GIT_DIR_PATH=/tmp/domiply_dev_env/origin/git
 export DOMIPLY_DOMAIN_CHECKER_TARGET_A=127.0.0.1
 export DOMIPLY_DOMAIN_CONFIG_STORE_DIR_PATH=/tmp/domiply_dev_env/domain/config
 export DOMIPLY_DOMAIN_ACME_STORE_DIR_PATH=/tmp/domiply_dev_env/domain/acme
-export DOMIPLY_DOMAIN_ACME_CONTACT_EMAIL=domiply@example.com

TODO

@@ -0,0 +1,11 @@
+- make acme store implement https://docs.rs/rustls/latest/rustls/server/trait.ResolvesServerCert.html
+
+- pass that into https://docs.rs/rustls/latest/rustls/struct.ConfigBuilder.html#
+
+- turn that into a TlsAcceptor (From is implemented here:
+  https://docs.rs/tokio-rustls/latest/tokio_rustls/struct.TlsAcceptor.html#impl-From%3CArc%3CServerConfig%3E%3E-for-TlsAcceptor)
+
+- use tls-listener crate to wrap hyper accepter: https://github.com/tmccombs/tls-listener/blob/main/examples/http.rs#L24
+    - https://github.com/tmccombs/tls-listener/blob/main/examples/tls_config/mod.rs
+
+- logging

src/domain/acme.rs

@@ -1,5 +1,6 @@
 pub mod manager;
 pub mod store;
 
-pub type AccountKey = openssl::pkey::PKey<openssl::pkey::Private>;
+pub type PrivateKey = openssl::pkey::PKey<openssl::pkey::Private>;
+
 pub type Certificate = openssl::x509::X509;

src/domain/acme/manager.rs

@@ -46,8 +46,11 @@ where
         .await
         .map_unexpected()?;
 
+    let mut contact = String::from("mailto:");
+    contact.push_str(contact_email);
+
     let mut builder = acme2::AccountBuilder::new(dir);
-    builder.contact(vec![contact_email.to_string()]);
+    builder.contact(vec![contact]);
     builder.terms_of_service_agreed(true);
 
     match store.get_account_key() {
@@ -78,6 +81,26 @@ where
 
     fn sync_domain(&self, domain: domain::Name) -> Self::SyncDomainFuture<'_> {
         Box::pin(async move {
+            // if there's an existing cert, and its expiry (determined by the soonest value of
+            // not_after amongst its parts) is later than 30 days from now, then we consider it to be
+            // synced.
+            if let Ok((_, cert)) = self.store.get_certificate(domain.as_str()) {
+                let thirty_days = openssl::asn1::Asn1Time::days_from_now(30)
+                    .expect("parsed thirty days from now as Asn1Time");
+
+                let cert_with_soonest_not_after = cert
+                    .into_iter()
+                    .reduce(|a, b| if a.not_after() < b.not_after() { a } else { b })
+                    .ok_or(error::Unexpected::from(
+                        "expected there to be more than one cert",
+                    ))?;
+
+                if thirty_days < cert_with_soonest_not_after.not_after() {
+                    return Ok(());
+                }
+            }
+
+            println!("fetching a new certificate for domain {}", domain.as_str());
             let mut builder = acme2::OrderBuilder::new(self.account.clone());
             builder.add_dns_identifier(domain.as_str().to_string());
             let order = builder.build().await.map_unexpected()?;
@@ -106,18 +129,27 @@ where
                 // At this point the manager is prepared to serve the challenge key via the
                 // `get_http01_challenge_key` method. It is expected that there is some http
                 // server, with this domain pointing at it, which is prepared to serve that
-                // challenge token/key under the `/.well-known/` path. The `validate()` call below
+                // challenge token/key under the `/.well-known/acme-challenge` path. The
-                // will instigate the acme server to make this check, and block until it succeeds.
+                // `validate()` call below will instigate the acme server to make this check, and
+                // block until it succeeds.
 
+                println!(
+                    "waiting for ACME challenge to be validated for domain {}",
+                    domain.as_str(),
+                );
                 let challenge = challenge.validate().await.map_unexpected()?;
 
                 // Poll the challenge every 5 seconds until it is in either the
                 // `valid` or `invalid` state.
-                let challenge = challenge
+                let challenge_res = challenge.wait_done(time::Duration::from_secs(5), 3).await;
-                    .wait_done(time::Duration::from_secs(5), 3)
+
-                    .await
+                // no matter what the result is, clean up the challenge key
+                self.store
+                    .del_http01_challenge_key(&challenge_token)
                     .map_unexpected()?;
 
+                let challenge = challenge_res.map_unexpected()?;
+
                 if challenge.status != acme2::ChallengeStatus::Valid {
                     return Err(error::Unexpected::from(
                         format!(
@@ -128,12 +160,13 @@ where
                     ));
                 }
 
-                self.store
-                    .del_http01_challenge_key(&challenge_token)
-                    .map_unexpected()?;
-
                 // Poll the authorization every 5 seconds until it is in either the
                 // `valid` or `invalid` state.
+                println!(
+                    "waiting for ACME authorization to be validated for domain {}",
+                    domain.as_str(),
+                );
+
                 let authorization = auth
                     .wait_done(time::Duration::from_secs(5), 3)
                     .await
@@ -152,6 +185,11 @@ where
 
             // Poll the order every 5 seconds until it is in either the `ready` or `invalid` state.
             // Ready means that it is now ready for finalization (certificate creation).
+            println!(
+                "waiting for ACME order to be made ready for domain {}",
+                domain.as_str(),
+            );
+
             let order = order
                 .wait_ready(time::Duration::from_secs(5), 3)
                 .await
@@ -173,13 +211,17 @@ where
             // Create a certificate signing request for the order, and request
             // the certificate.
             let order = order
-                .finalize(acme2::Csr::Automatic(pkey))
+                .finalize(acme2::Csr::Automatic(pkey.clone()))
                 .await
                 .map_unexpected()?;
 
             // Poll the order every 5 seconds until it is in either the
             // `valid` or `invalid` state. Valid means that the certificate
             // has been provisioned, and is now ready for download.
+            println!(
+                "waiting for ACME order to be validated for domain {}",
+                domain.as_str(),
+            );
             let order = order
                 .wait_done(time::Duration::from_secs(5), 3)
                 .await
@@ -196,6 +238,7 @@ where
             }
 
             // Download the certificate, and panic if it doesn't exist.
+            println!("fetching certificate for domain {}", domain.as_str());
             let cert =
                 order
                     .certificate()
@@ -215,6 +258,11 @@ where
                 ));
             }
 
+            println!("certificate for {} successfully retrieved", domain.as_str());
+            self.store
+                .set_certificate(domain.as_str(), &pkey, cert)
+                .map_unexpected()?;
+
             Ok(())
         })
     }

src/domain/acme/store.rs

@@ -1,11 +1,12 @@
 use std::io::{Read, Write};
 use std::{fs, io, path, sync};
 
-use crate::domain::acme::{AccountKey, Certificate};
+use crate::domain::acme::{Certificate, PrivateKey};
 use crate::error;
 use crate::error::{MapUnexpected, ToUnexpected};
 
 use hex::ToHex;
+use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 
 #[derive(thiserror::Error, Debug)]
@@ -37,8 +38,8 @@ pub enum GetCertificateError {
 
 #[mockall::automock]
 pub trait Store {
-    fn set_account_key(&self, k: &AccountKey) -> Result<(), error::Unexpected>;
+    fn set_account_key(&self, k: &PrivateKey) -> Result<(), error::Unexpected>;
-    fn get_account_key(&self) -> Result<AccountKey, GetAccountKeyError>;
+    fn get_account_key(&self) -> Result<PrivateKey, GetAccountKeyError>;
 
     fn set_http01_challenge_key(&self, token: &str, key: &str) -> Result<(), error::Unexpected>;
     fn get_http01_challenge_key(&self, token: &str) -> Result<String, GetHttp01ChallengeKeyError>;
@@ -47,15 +48,25 @@ pub trait Store {
     fn set_certificate(
         &self,
         domain: &str,
+        key: &PrivateKey,
         cert: Vec<Certificate>,
     ) -> Result<(), error::Unexpected>;
 
     /// Returned vec is guaranteed to have len > 0
-    fn get_certificate(&self, domain: &str) -> Result<Vec<Certificate>, GetCertificateError>;
+    fn get_certificate(
+        &self,
+        domain: &str,
+    ) -> Result<(PrivateKey, Vec<Certificate>), GetCertificateError>;
 }
 
 pub trait BoxedStore: Store + Send + Sync + Clone + 'static {}
 
+#[derive(Debug, Serialize, Deserialize)]
+struct StoredPKeyCert {
+    private_key_pem: String,
+    cert_pems: Vec<String>,
+}
+
 struct FSStore {
     dir_path: path::PathBuf,
 }
@@ -86,21 +97,24 @@ impl FSStore {
     }
 
     fn certificate_path(&self, domain: &str) -> path::PathBuf {
-        self.dir_path.join("certificates").join(domain)
+        self.dir_path
+            .join("certificates")
+            .join(domain)
+            .with_extension("json")
     }
 }
 
 impl BoxedStore for sync::Arc<FSStore> {}
 
 impl Store for sync::Arc<FSStore> {
-    fn set_account_key(&self, k: &AccountKey) -> Result<(), error::Unexpected> {
+    fn set_account_key(&self, k: &PrivateKey) -> Result<(), error::Unexpected> {
         let mut file = fs::File::create(self.account_key_path()).map_unexpected()?;
         let pem = k.private_key_to_pem_pkcs8().map_unexpected()?;
         file.write_all(&pem).map_unexpected()?;
         Ok(())
     }
 
-    fn get_account_key(&self) -> Result<AccountKey, GetAccountKeyError> {
+    fn get_account_key(&self) -> Result<PrivateKey, GetAccountKeyError> {
         let mut file = fs::File::open(self.account_key_path()).map_err(|e| match e.kind() {
             io::ErrorKind::NotFound => GetAccountKeyError::NotFound,
             _ => e.to_unexpected().into(),
@@ -109,7 +123,7 @@ impl Store for sync::Arc<FSStore> {
         let mut pem = Vec::<u8>::new();
         file.read_to_end(&mut pem).map_unexpected()?;
 
-        let k = AccountKey::private_key_from_pem(&pem).map_unexpected()?;
+        let k = PrivateKey::private_key_from_pem(&pem).map_unexpected()?;
         Ok(k)
     }
 
@@ -140,38 +154,50 @@ impl Store for sync::Arc<FSStore> {
     fn set_certificate(
         &self,
         domain: &str,
+        key: &PrivateKey,
         cert: Vec<Certificate>,
     ) -> Result<(), error::Unexpected> {
-        let cert: Vec<String> = cert
+        let to_store = StoredPKeyCert {
+            private_key_pem: String::from_utf8(key.private_key_to_pem_pkcs8().map_unexpected()?)
+                .map_unexpected()?,
+            cert_pems: cert
                 .into_iter()
                 .map(|cert| {
                     let cert_pem = cert.to_pem().map_unexpected()?;
                     let cert_pem = String::from_utf8(cert_pem).map_unexpected()?;
                     Ok::<String, error::Unexpected>(cert_pem)
                 })
-            .try_collect()?;
+                .try_collect()?,
+        };
 
         let cert_file = fs::File::create(self.certificate_path(domain)).map_unexpected()?;
 
-        serde_json::to_writer(cert_file, &cert).map_unexpected()?;
+        serde_json::to_writer(cert_file, &to_store).map_unexpected()?;
 
         Ok(())
     }
 
-    fn get_certificate(&self, domain: &str) -> Result<Vec<Certificate>, GetCertificateError> {
+    fn get_certificate(
+        &self,
+        domain: &str,
+    ) -> Result<(PrivateKey, Vec<Certificate>), GetCertificateError> {
         let file = fs::File::open(self.certificate_path(domain)).map_err(|e| match e.kind() {
             io::ErrorKind::NotFound => GetCertificateError::NotFound,
             _ => e.to_unexpected().into(),
         })?;
 
-        let cert: Vec<String> = serde_json::from_reader(file).map_unexpected()?;
+        let stored: StoredPKeyCert = serde_json::from_reader(file).map_unexpected()?;
 
-        let cert: Vec<Certificate> = cert
+        let key =
+            PrivateKey::private_key_from_pem(stored.private_key_pem.as_bytes()).map_unexpected()?;
+
+        let cert: Vec<Certificate> = stored
+            .cert_pems
             .into_iter()
             .map(|cert| openssl::x509::X509::from_pem(cert.as_bytes()).map_unexpected())
             .try_collect()?;
 
-        Ok(cert)
+        Ok((key, cert))
     }
 }
 
@@ -187,7 +213,7 @@ mod tests {
 
         assert!(matches!(
             store.get_account_key(),
-            Err::<AccountKey, GetAccountKeyError>(GetAccountKeyError::NotFound)
+            Err::<PrivateKey, GetAccountKeyError>(GetAccountKeyError::NotFound)
         ));
 
         let k = acme2::gen_rsa_private_key(4096).expect("private key generated");

src/domain/config.rs

@@ -1,4 +1,5 @@
 use std::path::{Path, PathBuf};
+use std::str::FromStr;
 use std::{fs, io, sync};
 
 use crate::error::{MapUnexpected, ToUnexpected};
@@ -37,10 +38,14 @@ pub enum SetError {
     Unexpected(#[from] error::Unexpected),
 }
 
+/// Used in the return from all_domains from Store.
+pub type AllDomainsResult<T> = Result<T, error::Unexpected>;
+
 #[mockall::automock]
 pub trait Store {
     fn get(&self, domain: &domain::Name) -> Result<Config, GetError>;
     fn set(&self, domain: &domain::Name, config: &Config) -> Result<(), SetError>;
+    fn all_domains(&self) -> AllDomainsResult<Vec<AllDomainsResult<domain::Name>>>;
 }
 
 pub trait BoxedStore: Store + Send + Sync + Clone {}
@@ -89,6 +94,22 @@ impl Store for sync::Arc<FSStore> {
 
         Ok(())
     }
+
+    fn all_domains(&self) -> AllDomainsResult<Vec<AllDomainsResult<domain::Name>>> {
+        Ok(fs::read_dir(&self.dir_path)
+            .map_unexpected()?
+            .map(
+                |dir_entry_res: io::Result<fs::DirEntry>| -> AllDomainsResult<domain::Name> {
+                    let domain = dir_entry_res.map_unexpected()?.file_name();
+                    let domain = domain.to_str().ok_or_else(|| {
+                        error::Unexpected::from("couldn't convert os string to &str")
+                    })?;
+
+                    Ok(domain::Name::from_str(domain).map_unexpected()?)
+                },
+            )
+            .collect())
+    }
 }
 
 #[cfg(test)]

src/domain/manager.rs

@@ -115,6 +115,8 @@ impl From<config::SetError> for SyncWithConfigError {
 
 pub type GetAcmeHttp01ChallengeKeyError = acme::manager::GetHttp01ChallengeKeyError;
 
+pub type AllDomainsResult<T> = config::AllDomainsResult<T>;
+
 #[mockall::automock(
     type Origin=origin::MockOrigin;
     type SyncWithConfigFuture=future::Ready<Result<(), SyncWithConfigError>>;
@@ -153,6 +155,8 @@ pub trait Manager {
         &self,
         token: &str,
     ) -> Result<String, GetAcmeHttp01ChallengeKeyError>;
+
+    fn all_domains(&self) -> AllDomainsResult<Vec<AllDomainsResult<domain::Name>>>;
 }
 
 pub trait BoxedManager: Manager + Send + Sync + Clone {}
@@ -283,4 +287,8 @@ where
 
         Err(GetAcmeHttp01ChallengeKeyError::NotFound)
     }
+
+    fn all_domains(&self) -> AllDomainsResult<Vec<AllDomainsResult<domain::Name>>> {
+        self.domain_config_store.all_domains()
+    }
 }

src/main.rs

@@ -1,6 +1,7 @@
 #![feature(result_option_inspect)]
 
 use clap::Parser;
+use futures::stream::futures_unordered::FuturesUnordered;
 use futures::stream::StreamExt;
 use signal_hook_tokio::Signals;
 use tokio::select;
@@ -20,7 +21,7 @@ use domiply::domain::manager::Manager;
 #[command(about = "A domiply to another dimension")]
 struct Cli {
     #[arg(long, required = true, env = "DOMIPLY_HTTP_DOMAIN")]
-    http_domain: String,
+    http_domain: domiply::domain::Name,
 
     #[arg(long, default_value_t = SocketAddr::from_str("[::]:3030").unwrap(), env = "DOMIPLY_HTTP_LISTEN_ADDR")]
     http_listen_addr: SocketAddr,
@@ -28,7 +29,8 @@ struct Cli {
     #[arg(
         long,
         help = "E.g. '[::]:443', if given then SSL certs will automatically be retrieved for all domains using LetsEncrypt",
-        env = "DOMIPLY_HTTPS_LISTEN_ADDR"
+        env = "DOMIPLY_HTTPS_LISTEN_ADDR",
+        requires = "domain_acme_contact_email"
     )]
     https_listen_addr: Option<SocketAddr>,
 
@@ -50,13 +52,15 @@ struct Cli {
     #[arg(long, required = true, env = "DOMIPLY_DOMAIN_ACME_STORE_DIR_PATH")]
     domain_acme_store_dir_path: path::PathBuf,
 
-    #[arg(long, required = true, env = "DOMIPLY_DOMAIN_ACME_CONTACT_EMAIL")]
+    #[arg(long, env = "DOMIPLY_DOMAIN_ACME_CONTACT_EMAIL")]
-    domain_acme_contact_email: String,
+    domain_acme_contact_email: Option<String>,
 }
 
 fn main() {
     let config = Cli::parse();
 
+    let mut wait_group = FuturesUnordered::new();
+
     let tokio_runtime = std::sync::Arc::new(
         tokio::runtime::Builder::new_multi_thread()
             .enable_all()
@@ -102,11 +106,12 @@ fn main() {
             domiply::domain::acme::store::new(&config.domain_acme_store_dir_path)
                 .expect("domain acme store initialized");
 
+        // if https_listen_addr is set then domain_acme_contact_email is required, see the Cli/clap
+        // settings.
+        let domain_acme_contact_email = config.domain_acme_contact_email.unwrap();
+
         let domain_acme_manager = tokio_runtime.block_on(async {
-            domiply::domain::acme::manager::new(
+            domiply::domain::acme::manager::new(domain_acme_store, &domain_acme_contact_email)
-                domain_acme_store,
-                &config.domain_acme_contact_email,
-            )
                 .await
                 .expect("domain acme manager initialized")
         });
@@ -121,7 +126,7 @@ fn main() {
         domain_acme_manager.clone(),
     );
 
-    let origin_syncer_handler = {
+    wait_group.push({
         let manager = manager.clone();
         let canceller = canceller.clone();
 
@@ -150,10 +155,10 @@ fn main() {
                     });
             }
         })
-    };
+    });
 
     let service = domiply::service::new(
-        manager,
+        manager.clone(),
         config.domain_checker_target_a,
         config.passphrase,
         config.http_domain.clone(),
@@ -174,13 +179,18 @@ fn main() {
             async move { Ok::<_, Infallible>(service) }
         });
 
-    let server_handler = {
+    wait_group.push({
         let http_domain = config.http_domain.clone();
+        let canceller = canceller.clone();
 
         tokio_runtime.spawn(async move {
             let addr = config.http_listen_addr;
 
-            println!("Listening on http://{}:{}", http_domain, addr.port());
+            println!(
+                "Listening on http://{}:{}",
+                http_domain.as_str(),
+                addr.port()
+            );
             let server = hyper::Server::bind(&addr).serve(make_service);
 
             let graceful = server.with_graceful_shutdown(async {
@@ -191,27 +201,63 @@ fn main() {
                 panic!("server error: {}", e);
             };
         })
-    };
+    });
 
     // if there's an acme manager then it means that https is enabled, and we should ensure that
     // the http domain for domiply itself has a valid certificate.
     if let Some(domain_acme_manager) = domain_acme_manager {
-        let domain = domiply::domain::Name::from_str(&config.http_domain)
+        let manager = manager.clone();
-            .expect("--http-domain parses as a domain");
+        let canceller = canceller.clone();
+        let http_domain = config.http_domain.clone();
+
+        // Periodically refresh all domain certs
+        wait_group.push(tokio_runtime.spawn(async move {
+            let mut interval = time::interval(time::Duration::from_secs(60 * 60));
+
+            loop {
+                select! {
+                _ = interval.tick() => (),
+                _ = canceller.cancelled() => return,
+                }
 
-        tokio_runtime.spawn(async move {
                 _ = domain_acme_manager
+                    .sync_domain(http_domain.clone())
+                    .await
+                    .inspect_err(|err| {
+                        println!(
+                            "Error while getting cert for {}: {err}",
+                            http_domain.as_str()
+                        )
+                    });
+
+                let domains_iter = manager.all_domains();
+
+                if let Err(err) = domains_iter {
+                    println!("Got error calling all_domains: {err}");
+                    continue;
+                }
+
+                for domain in domains_iter.unwrap().into_iter() {
+                    match domain {
+                        Ok(domain) => {
+                            let _ = domain_acme_manager
                                 .sync_domain(domain.clone())
                                 .await
                                 .inspect_err(|err| {
-                    println!("Error while getting cert for {}: {err}", domain.as_str())
+                                    println!(
-                });
+                                        "Error while getting cert for {}: {err}",
+                                        domain.as_str(),
+                                    )
                                 });
                         }
+                        Err(err) => println!("Error iterating through domains: {err}"),
+                    };
+                }
+            }
+        }));
+    }
 
-    tokio_runtime
+    tokio_runtime.block_on(async { while let Some(_) = wait_group.next().await {} });
-        .block_on(async { futures::try_join!(origin_syncer_handler, server_handler) })
-        .unwrap();
 
     println!("Graceful shutdown complete");
 }

src/service.rs

@@ -23,7 +23,7 @@ where
     domain_manager: DomainManager,
     target_a: net::Ipv4Addr,
     passphrase: String,
-    http_domain: String,
+    http_domain: domain::Name,
     handlebars: handlebars::Handlebars<'svc>,
 }
 
@@ -31,7 +31,7 @@ pub fn new<'svc, DomainManager>(
     domain_manager: DomainManager,
     target_a: net::Ipv4Addr,
     passphrase: String,
-    http_domain: String,
+    http_domain: domain::Name,
 ) -> Service<'svc, DomainManager>
 where
     DomainManager: domain::manager::BoxedManager,
@@ -324,8 +324,8 @@ where
             .map(strip_port),
         req.uri().host().map(strip_port),
     ) {
-        (Some(h), _) if h != svc.http_domain => Some(h),
+        (Some(h), _) if h != svc.http_domain.as_str() => Some(h),
-        (_, Some(h)) if h != svc.http_domain => Some(h),
+        (_, Some(h)) if h != svc.http_domain.as_str() => Some(h),
         _ => None,
     }
     .and_then(|h| domain::Name::from_str(h).ok());
@@ -341,8 +341,8 @@ where
         return svc.render(200, path, ());
     }
 
-    if method == Method::GET && path.starts_with("/.well-known/") {
+    if method == Method::GET && path.starts_with("/.well-known/acme-challenge/") {
-        let token = path.trim_start_matches("/.well-known/");
+        let token = path.trim_start_matches("/.well-known/acme-challenge/");
 
         if let Ok(key) = svc.domain_manager.get_acme_http01_challenge_key(token) {
             let body: hyper::Body = key.into();