Module storage 

Storage abstraction.

The Storage trait is the “ground truth” for TLS assets: certificates, private keys, metadata, OCSP staples, ACME accounts, challenge tokens, and distributed locks. The default implementation (feature file-storage) is file::FileStorage, rooted at data_dir().

Clustering: instances that share the same Storage backend (including its Locker) coordinate obtaining/renewing certificates and answer each other’s ACME challenges.

Re-exports

pub use file::FileStorage;

pub use redis::RedisStorage;

pub use redis::RedisStorageOptions;

pub use etcd::EtcdStorage;

pub use etcd::EtcdStorageOptions;

pub use etcd::EtcdTlsOptions;

Modules

etcd

Optional etcd v3 storage and acquisition-checked certificate publication.

file

File-system storage backend.

redis

Optional Redis storage with namespaced data and owner-checked leases.

Structs

CleanStorageOptions

Options for clean_storage.

KeyBuilder

Builds storage keys.

KeyInfo

Metadata for a stored key.

LockGuard

A held acquisition that requests backend release when dropped. Network cleanup is best-effort; use LockGuard::release_and_wait when backend acknowledgement is required.

StorageKeys

The three storage keys belonging to one certificate resource.

Constants

ACME_PREFIX

Storage key prefix for ACME accounts/orders.

CERTS_PREFIX

Storage key prefix for certificates.

LAST_CLEAN_KEY

Storage key of the last-clean timestamp.

OCSP_PREFIX

Storage key prefix for OCSP staples.

STORAGE_KEYS

The package-level key builder.

Statics

STORAGE_DEFAULT

The lazily-initialized default storage instance.

Traits

LockRelease

Object-safe release callback owned by a LockGuard.

Locker

Blocking-until-acquired distributed locking.

Storage

The storage abstraction.

Functions

account_key_prefix

Return the canonical prefix containing one persisted ACME account.

account_private_key

Return the canonical ACME account private-key path.

account_registration

Return the canonical ACME account registration metadata path.

acme_ca_prefix

Return the ACME storage prefix for an issuer/CA key.

acme_hosts_prefix

Return the canonical prefix containing an issuer’s persisted accounts.

acquire

Acquire a lock with a non-cancelled context and RAII release.

acquire_lock

Acquire a distributed lock and register it as owned by this process .

acquire_with_timeout

Acquire a distributed lock with a bounded timeout and RAII release.

certs_prefix

Return the certificate prefix for an issuer.

certs_site_prefix

Return the certificate site prefix for an issuer and domain.

chain_hash

Convenience: compute the chain hash used as cache key / OCSP staple suffix.

clean_storage

Clean the storage: delete expired certificates and stale OCSP staples.

clean_up_own_locks

Release every lock this process still holds. Call during graceful shutdown.

cleanup_own_locks

American-spelling alias for clean_up_own_locks.

issuer_key

Sanitize an ACME directory URL into a stable issuer key.

legacy_account_key_prefix

Return the pre-layout account prefix retained for migration readers.

load_certificate

Load a complete certificate resource from storage.

locks_key

Return the lock-file storage key for a lock name.

ocsp_key

Return an OCSP key from a first SAN and an already-computed hash.

ocsp_staple_key

Return the persisted OCSP staple key for a certificate bundle.

release_lock

Release a previously acquired lock.

safe_key

Sanitize a value for use as a storage-key component.

site_cert_key

Return the certificate PEM key for an issuer and domain.

site_meta_key

Return the metadata key for an issuer and domain.

site_private_key

Return the private-key PEM key for an issuer and domain.

store_certificate

Store a complete certificate resource under its issuer and SAN-derived key.

store_tx

All-or-nothing multi-key store: on failure, keys already written by this transaction are restored to their values from before the transaction (or deleted when they did not exist). This preserves existing resources when a later write fails; a rollback failure is logged because the original write error is the actionable result for the caller.

track_lock

Track a lock for process-shutdown cleanup.

try_acquire

Try to acquire a lock within timeout.

try_acquire_lock

Try to acquire a distributed lock without waiting.

untrack_lock

Stop tracking all registrations with this name without releasing them. Manual registrations must be explicitly untracked by their owner.

Type Aliases

KeyValue

A key-value pair for store_tx.

LockHandle

Compatibility name for LockGuard used by timeout-oriented storage APIs.