Struct DomainVerificationService 

pub struct DomainVerificationService { /* private fields */ }

Domain verification service for DNS and HTTP challenges.

Implementations

impl DomainVerificationService

pub fn new() -> Self

Create a new domain verification service.

pub async fn verify_dns(&self, domain: &str, token: &str) -> VerificationResult

Verify domain ownership via DNS TXT record.

The user must create a TXT record at _postrust-verification.{domain} with the value postrust-verify={token}.

pub async fn verify_http(&self, domain: &str, token: &str) -> VerificationResult

Verify domain ownership via HTTP challenge.

The user must serve a file at https://{domain}/.well-known/postrust-verification/{token} (or the http:// equivalent) with the content postrust-verify={token}.

This makes the proxy fetch a URL on a name the tenant chose, so it is careful about where it connects:

• the name is resolved here, every address in a forbidden range is discarded, and the request is pinned to an address that survived. Pinned, because letting the HTTP client resolve again would let a short-TTL record answer differently the second time – public for the check, 169.254.169.254 for the connection.
• redirects are not followed. A redirect is a second URL, on a host nobody checked.
• at most [MAX_BODY] bytes are read, whatever Content-Length says or does not say.
• what the tenant is told is a fixed sentence. Neither the fetched body nor the client’s error text is returned: either would turn this into a way to read responses from wherever the proxy can reach.

Trait Implementations

impl Default for DomainVerificationService

fn default() -> Self

Returns the “default value” for a type.