Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

acmeserver: Configurable resolvers, fix smallstep deprecations #5500

Merged
merged 5 commits into from May 3, 2023

Conversation

francislavoie
Copy link
Member

Closes #5476

Copy link
Contributor

@maraino maraino left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks ok, I've added some minor comments.

modules/caddypki/acmeserver/acmeserver.go Show resolved Hide resolved
Comment on lines +200 to +208
acmeCtx := acme.NewContext(
r.Context(),
ash.acmeDB,
ash.acmeClient,
ash.acmeLinker,
nil,
)
acmeCtx = authority.NewContext(acmeCtx, ash.acmeAuth)
r = r.WithContext(acmeCtx)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is ok. You're doing this for every request, and it should be fine. A minor optimization would be to build it once and move it to the server BaseContext, this is what we do. But it will be available everywhere.

Looking at chi, they have a middleware that we've never used named ServerBaseContext. It allows you to define a base context for a handler, and it adds the context added by net/http. I don't think it's going to make an impact on the performance, but you can test and find out.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, I was trying to figure out how to do this. Thanks for pointing to that chi API, I've never used chi before. The ACME server is definitely not a hot path for most users, so it's probably not a big deal. Context wrapping is pretty cheap in general I think.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@francislavoie Do you want me to hold up on merging until we make that optimization? Or should we go with this and then optimize later?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's no rush on that one. I think we can merge.

modules/caddypki/acmeserver/acmeserver.go Show resolved Hide resolved
modules/caddypki/acmeserver/acmeserver.go Show resolved Hide resolved
modules/caddypki/acmeserver/acmeserver.go Show resolved Hide resolved
modules/caddypki/acmeserver/acmeserver.go Outdated Show resolved Hide resolved
listeners.go Outdated Show resolved Hide resolved
Co-authored-by: itsxaos <33079230+itsxaos@users.noreply.github.com>
@itsxaos
Copy link
Contributor

itsxaos commented Apr 20, 2023

Changes look good to me, but it will be a couple of hours until I can test them.

@itsxaos
Copy link
Contributor

itsxaos commented Apr 20, 2023

Alright, I tried the changes and everything seems to be working as expected!

@mholt mholt enabled auto-merge (squash) May 3, 2023 16:57
Copy link
Member

@mholt mholt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for implementing this! Still think it'd be good to implement that optimization at some point.

@mholt mholt merged commit 3f20a7c into master May 3, 2023
23 checks passed
@mholt mholt deleted the acme-server-resolvers branch May 3, 2023 17:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature ⚙️ New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Allow configuring DNS resolvers used by the internal acme_server to verify DNS challenges
4 participants