Class: Kamal::Configuration::Proxy::Acme

Inherits:
Object
  • Object
show all
Defined in:
lib/kamal/configuration/proxy/acme.rb

Overview

ACME configuration for the kamal-proxy container, including the DNS-01 challenge credentials.

Everything here except the credentials becomes a kamal-proxy run flag, so it lands in the run command and therefore in Proxy::Run#config_digest — changing the block reboots the proxy on the next deploy.

Credentials go the other way, through an env file uploaded at mode 0600. A DNS API token can rewrite your zone; docker run --env TOKEN=... would put it in the host's process listing and in kamal's own audit log.

Constant Summary collapse

DNS_PROVIDERS =

The canonical provider names kamal-proxy MINIMUM_VERSION advertises. Kept in step with the proxy by test/proxy_flag_coverage_test.rb, which compares this list against the manifest bin/sync-proxy-flags generates from the image.

%w[
  auto cloudflare digitalocean gcloud godaddy hetzner namecheap route53 vultr
].freeze
DNS_PROVIDER_ALIASES =

Short forms kamal-proxy's ParseProviderName accepts but does not advertise, so they cannot be generated from --help and are not drift-checked.

%w[ cf do gcp google googledns gd hz nc aws r53 vr ].freeze
SUPPORTED_DNS_PROVIDERS = 
(DNS_PROVIDERS + DNS_PROVIDER_ALIASES).freeze

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(acme_config:, secrets:) ⇒ Acme

Returns a new instance of Acme.



27
28
29
30
 
# File 'lib/kamal/configuration/proxy/acme.rb', line 27

def initialize(acme_config:, secrets:)
  @acme_config = acme_config || {}
  @secrets = secrets
end

Instance Attribute Details

#acme_config ⇒ Object (readonly)

Returns the value of attribute acme_config.



25
26
27
 
# File 'lib/kamal/configuration/proxy/acme.rb', line 25

def acme_config
  @acme_config
end

#secrets ⇒ Object (readonly)

Returns the value of attribute secrets.



25
26
27
 
# File 'lib/kamal/configuration/proxy/acme.rb', line 25

def secrets
  @secrets
end

Instance Method Details

#configured? ⇒ Boolean

Returns:

  • (Boolean) 


32
33
34
 
# File 'lib/kamal/configuration/proxy/acme.rb', line 32

def configured?
  acme_config.present?
end

#credential_names ⇒ Object 



36
37
38
 
# File 'lib/kamal/configuration/proxy/acme.rb', line 36

def credential_names
  Array(acme_config["credentials"])
end

#credentials? ⇒ Boolean

Returns:

  • (Boolean) 


40
41
42
 
# File 'lib/kamal/configuration/proxy/acme.rb', line 40

def credentials?
  credential_names.any?
end

#credentials_env ⇒ Object

The resolved credentials, for the shared proxy secrets env file that Proxy::Run#secrets_io assembles (cache store and acme travel together).



46
47
48
 
# File 'lib/kamal/configuration/proxy/acme.rb', line 46

def credentials_env
  credential_names.to_h { |name| [ name, secrets[name] ] }
end

#run_command_args ⇒ Object

Rendered with = rather than a space, unlike the rest of the run command: Cobra only reads a boolean flag's value in --flag=false form, so --acme-http-fallback false would set the flag true and leave "false" behind as a stray argument. Both booleans default to true in the proxy, which makes false the value an operator actually writes.



55
56
57
 
# File 'lib/kamal/configuration/proxy/acme.rb', line 55

def run_command_args
  Kamal::Utils.optionize(run_command_options, with: "=")
end

#run_command_options ⇒ Object

compact, not compact_blank: false is a meaningful value for both booleans.



60
61
62
63
64
65
66
67
68
 
# File 'lib/kamal/configuration/proxy/acme.rb', line 60

def run_command_options
  {
    "acme-email": acme_config["email"],
    "acme-dns-provider": acme_config["dns_provider"],
    "acme-directory": acme_config["directory"],
    "acme-prefer-wildcard": acme_config["prefer_wildcard"],
    "acme-http-fallback": acme_config["http_fallback"]
  }.compact
end