public_tls.go RawHistoryFolder

1// Package out defines output ports (interfaces) for infrastructure.
2// These interfaces define the contract between use cases and driven adapters.
3package out
4
5import (
6	"context"
7	"crypto/tls"
8	"time"
9
10	"github.com/bnema/gordon/internal/domain"
11)
12
13// CertificateOrder represents a request to obtain or renew a certificate.
14type CertificateOrder struct {
15	ID        string
16	Names     []string
17	Challenge domain.ACMEChallengeMode
18}
19
20// StoredCertificate represents a persisted certificate with its metadata.
21type StoredCertificate struct {
22	ID            string
23	Names         []string
24	Challenge     domain.ACMEChallengeMode
25	Certificate   tls.Certificate
26	CertPEM       []byte
27	ChainPEM      []byte
28	FullchainPEM  []byte
29	PrivateKeyPEM []byte
30	NotAfter      time.Time
31	LastError     string
32}
33
34// ACMEAccount represents a stored ACME account registration.
35type ACMEAccount struct {
36	Email           string
37	PrivateKeyPEM   []byte
38	RegistrationURI string
39	BodyJSON        []byte
40}
41
42// CertificateStoreState represents persisted ACME reconciliation state.
43type CertificateStoreState struct {
44	ObtainCursor int
45}
46
47// SecretValue holds a resolved secret value and its source.
48type SecretValue struct {
49	Value  string
50	Source domain.ACMETokenSource
51}
52
53// CloudflareZone represents a Cloudflare DNS zone.
54type CloudflareZone struct {
55	ID   string
56	Name string
57}
58
59// HTTPChallengeSink defines the contract for storing HTTP-01 challenge tokens
60// while an ACME issuer completes domain validation.
61type HTTPChallengeSink interface {
62	// Present stores the key authorization for a challenge token.
63	Present(token, keyAuth string) error
64
65	// CleanUp removes the key authorization for a challenge token.
66	CleanUp(token string) error
67}
68
69// PublicCertificateIssuer defines the contract for obtaining and renewing
70// TLS certificates via ACME.
71type PublicCertificateIssuer interface {
72	// Obtain requests a new certificate for the given order.
73	Obtain(ctx context.Context, order CertificateOrder) (*StoredCertificate, error)
74
75	// Renew renews an existing certificate.
76	Renew(ctx context.Context, cert StoredCertificate) (*StoredCertificate, error)
77}
78
79// CertificateStore defines the contract for persisting ACME accounts and certificates.
80type CertificateStore interface {
81	// LoadAccount retrieves an ACME account.
82	LoadAccount(ctx context.Context) (*ACMEAccount, error)
83
84	// SaveAccount persists an ACME account.
85	SaveAccount(ctx context.Context, account ACMEAccount) error
86
87	// LoadAll returns all stored certificates.
88	LoadAll(ctx context.Context) ([]StoredCertificate, error)
89
90	// Save persists a certificate.
91	Save(ctx context.Context, cert StoredCertificate) error
92
93	// LoadState returns persisted reconciliation state.
94	LoadState(ctx context.Context) (CertificateStoreState, error)
95
96	// SaveState persists reconciliation state.
97	SaveState(ctx context.Context, state CertificateStoreState) error
98
99	// Lock acquires a lock to prevent concurrent certificate operations.
100	Lock(ctx context.Context) (unlock func() error, err error)
101}
102
103// SecretResolver defines the contract for resolving Cloudflare API tokens.
104type SecretResolver interface {
105	// ResolveCloudflareToken retrieves the Cloudflare API token from the configured source.
106	ResolveCloudflareToken(ctx context.Context) (SecretValue, error)
107}
108
109// CloudflareZoneResolver defines the contract for resolving DNS zones.
110type CloudflareZoneResolver interface {
111	// FindZone finds the Cloudflare zone for the given domain.
112	FindZone(ctx context.Context, domain string) (CloudflareZone, error)
113}