postrust_proxy/saas/
mod.rs

1//! SaaS Domain Management Module
2//!
3//! Provides multi-tenant domain ownership validation and reverse proxy routing.
4//!
5//! ## Features
6//!
7//! - Domain ownership verification (DNS TXT and HTTP challenge)
8//! - Multi-tenant API key authentication
9//! - Dynamic route management per verified domain
10//! - Manual certificate upload support
11//!
12//! ## Automatic SSL via ACME
13//!
14//! A domain with `ssl_provider = "acme"` that passes verification is left
15//! `ssl_status = 'pending'`, and [`ssl::run`] -- a background worker -- places
16//! the order, answers the HTTP-01 challenge out of
17//! `/.well-known/acme-challenge/{token}`, and stores the certificate. Failures
18//! back off and record `ssl_error`; `POST /domains/{id}/ssl/retry` requeues one.
19//!
20//! Issuance is a worker rather than an endpoint because an ACME order takes
21//! several round trips and a challenge fetch, and retrying under a rate limit
22//! is the normal failure mode. Requires the `acme` feature, which is on by
23//! default.
24//!
25//! ## Prefer DNS verification
26//!
27//! HTTP verification asks the claimant to serve content at a path on the
28//! domain -- but once that domain points at this proxy, this proxy is what
29//! serves that path. Passing shows the domain resolves here, not that the
30//! claimant controls it. DNS verification does show control, and is the
31//! default.
32
33pub mod api_keys;
34pub mod auth;
35pub(crate) mod db;
36pub mod handlers;
37pub mod manager;
38pub mod options;
39#[cfg(feature = "acme")]
40pub mod ssl;
41pub mod types;
42pub mod validation;
43pub mod verification;
44pub mod wellknown_host;
45
46pub use api_keys::ApiKeyService;
47pub use auth::{AuthContext, AuthType, SaasAuthLayer};
48pub use manager::DomainManager;
49pub use options::{DomainPolicy, SaasOptions, UploadTrust};
50pub use types::*;
51pub use validation::ReservedDomains;
52pub use verification::DomainVerificationService;
postrust_proxy/saas/mod.rs

postrust_proxy/saas/
mod.rs
