fn0-worker 0.4.2

Worker binary for the fn0 FaaS platform
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

//! Polls the certificate manifest and hands new certificates to the SNI
//! resolver.
//!
//! Separate from the project manifest poller and slower: custom hostnames
//! change on the timescale of a person editing DNS, while the project manifest
//! carries every deploy. A certificate that appears ten seconds late costs the
//! user one retry; a certificate polled every second would put a PEM per
//! hostname on the wire sixty times a minute per worker.

use crate::cert_resolver::SniCertResolver;
use crate::vault_client::VaultClient;
use doc_db::{Database, DbRequest};
use fn0_shared_schema::WorkerCertManifestDocGet;
use std::sync::Arc;
use std::time::Duration;

const POLL_INTERVAL: Duration = Duration::from_secs(10);

pub async fn run(db: Database, resolver: Arc<SniCertResolver>, vault: Arc<VaultClient>) {
    loop {
        tokio::time::sleep(POLL_INTERVAL).await;

        let manifest = match (WorkerCertManifestDocGet {}).send_with(&db).await {
            Ok(Some(manifest)) => manifest,
            Ok(None) => continue,
            Err(error) => {
                tracing::warn!(%error, "cert manifest fetch failed");
                continue;
            }
        };

        if manifest.cert_version == resolver.current_version() {
            continue;
        }
        resolver
            .apply(&vault, manifest.cert_version, &manifest.certs)
            .await;
    }
}