vicarian 0.5.0

Vicarian is a TLS-first reverse-proxy server with ACME support
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120

use std::sync::Arc;

use anyhow::{anyhow, Result};
use camino::Utf8PathBuf;
use papaya::HashMap as Papaya;
use tracing::info;
use unicase::UniCase;

use crate::{
    RunContext,
    certificates::HostCertificate,
};


// TODO: We currently use papaya to store lookup tables for multiple
// server support. However we don't actually support multiple servers
// in the config at the moment. This may change, so this is left in
// place for now.
//
// TODO: It _might_ be possible to return references rather than Arcs
// here, which would enforce the store as being the source of
// truth. But a bit fiddly for MVP version.
#[derive(Debug)]
pub struct CertStore {
    _context: Arc<RunContext>,
    by_host: Papaya<UniCase<String>, HostCertificate>,
    by_file: Papaya<Utf8PathBuf, HostCertificate>,
}

impl CertStore {

    pub fn new(_context: Arc<RunContext>) -> Result<Self> {
        info!("Loading host certificates");

        let certstore = Self {
            _context,
            by_host: Papaya::new(),
            by_file: Papaya::new(),
        };
        Ok(certstore)
    }

    pub fn by_host(&self, host: &str) -> Option<HostCertificate> {
        let pmap = self.by_host.pin();
        let host = UniCase::new(host.to_string());
        pmap.get(&host)
            .cloned()
    }

    /// Takes a host and returns a matching wildcard, if any.
    pub fn by_wildcard(&self, host: &str) -> Option<HostCertificate> {
        host.split_once('.')
            .and_then(|(_host, domain)| {
                let wildcard = format!("*.{domain}");
                self.by_host(&wildcard)
            })

    }

    pub fn by_file(&self, file: &Utf8PathBuf) -> Option<HostCertificate> {
        let pmap = self.by_file.pin();
        pmap.get(file)
            .cloned()
    }

    pub fn upsert(&self, newcert: HostCertificate) -> Result<()> {
        for hostname in newcert.hostnames().iter() {
            let host = UniCase::new(hostname.clone());

            info!("Updating/inserting certificate for {host}");
            self.by_host.pin().update_or_insert(host, |_old| newcert.clone(), newcert.clone());
        }

        let keyfile = newcert.keyfile().to_path_buf();
        let certfile = newcert.certfile().to_path_buf();
        let by_file = self.by_file.pin();
        by_file.update_or_insert(keyfile, |_old| newcert.clone(), newcert.clone());
        by_file.update_or_insert(certfile, |_old| newcert.clone(), newcert.clone());

        Ok(())
    }

    pub fn upsert_all(&self, newcerts: Vec<HostCertificate>) -> Result<()> {
        for hc in newcerts {
            self.upsert(hc)?;
        }
        Ok(())
    }

    pub fn update(&self, newcert: HostCertificate) -> Result<()> {
        for hostname in newcert.hostnames().iter() {
            info!("Updating certificate for {hostname}");
            let host = UniCase::new(hostname.clone());
            self.by_host.pin().update(host, |_old| newcert.clone())
                .ok_or(anyhow!("Matching host for {} not found in cert store", hostname))?;
        }

        let keyfile = newcert.keyfile().to_path_buf();
        let certfile = newcert.certfile().to_path_buf();
        let by_file = self.by_file.pin();
        by_file.update(keyfile, |_old| newcert.clone())
            .ok_or(anyhow!("File {} not found in cert store", newcert.keyfile()))?;
        by_file.update(certfile, |_old| newcert.clone())
            .ok_or(anyhow!("File {} not found in cert store", newcert.certfile()))?;

        Ok(())
    }

    pub fn watchlist(&self) -> Vec<Utf8PathBuf> {
        let by_host = self.by_host.pin();
        by_host.values()
            .filter(|h| h.watch())
            .flat_map(|h| [
                h.keyfile().to_path_buf(),
                h.certfile().to_path_buf()
            ])
            .collect()
    }

}