From a394e6a3e31250e565d047189556e68d83adeb37 Mon Sep 17 00:00:00 2001 From: Emile Vauge Date: Fri, 9 Dec 2016 14:37:39 +0100 Subject: [PATCH] Manage acme cert in infinit channels Signed-off-by: Emile Vauge --- acme/acme.go | 184 ++++++++++++++++++++++--------------------- cluster/datastore.go | 8 +- glide.lock | 8 +- glide.yaml | 1 + 4 files changed, 107 insertions(+), 94 deletions(-) diff --git a/acme/acme.go b/acme/acme.go index 2232886b8..64cb21c44 100644 --- a/acme/acme.go +++ b/acme/acme.go @@ -19,6 +19,7 @@ import ( "github.com/containous/traefik/log" "github.com/containous/traefik/safe" "github.com/containous/traefik/types" + "github.com/eapache/channels" "github.com/xenolf/lego/acme" "github.com/xenolf/lego/providers/dns" ) @@ -46,6 +47,7 @@ type ACME struct { store cluster.Store challengeProvider *challengeProvider checkOnDemandDomain func(domain string) bool + jobs *channels.InfiniteChannel TLSConfig *tls.Config `description:"TLS config in case wildcard certs are used"` } @@ -107,6 +109,7 @@ func (a *ACME) init() error { log.Warnf("ACME.StorageFile is deprecated, use ACME.Storage instead") a.Storage = a.StorageFile } + a.jobs = channels.NewInfiniteChannel() return nil } @@ -159,9 +162,7 @@ func (a *ACME) CreateClusterConfig(leadership *cluster.Leadership, tlsConfig *tl case <-ctx.Done(): return case <-ticker.C: - if err := a.renewCertificates(); err != nil { - log.Errorf("Error renewing ACME certificate: %s", err.Error()) - } + a.renewCertificates() } } }) @@ -222,12 +223,10 @@ func (a *ACME) CreateClusterConfig(leadership *cluster.Leadership, tlsConfig *tl if err != nil { return err } - safe.Go(func() { - a.retrieveCertificates() - if err := a.renewCertificates(); err != nil { - log.Errorf("Error renewing ACME certificate %+v: %s", account, err.Error()) - } - }) + + a.retrieveCertificates() + a.renewCertificates() + a.runJobs() } return nil }) @@ -312,19 +311,14 @@ func (a *ACME) CreateLocalConfig(tlsConfig *tls.Config, checkOnDemandDomain func return err } - safe.Go(func() { - a.retrieveCertificates() - if err := a.renewCertificates(); err != nil { - log.Errorf("Error renewing ACME certificate %+v: %s", account, err.Error()) - } - }) + a.retrieveCertificates() + a.renewCertificates() + a.runJobs() ticker := time.NewTicker(24 * time.Hour) safe.Go(func() { for range ticker.C { - if err := a.renewCertificates(); err != nil { - log.Errorf("Error renewing ACME certificate %+v: %s", account, err.Error()) - } + a.renewCertificates() } }) @@ -361,83 +355,87 @@ func (a *ACME) getCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificat } func (a *ACME) retrieveCertificates() { - log.Infof("Retrieving ACME certificates...") - for _, domain := range a.Domains { - // check if cert isn't already loaded - account := a.store.Get().(*Account) - if _, exists := account.DomainsCertificate.exists(domain); !exists { - domains := []string{} - domains = append(domains, domain.Main) - domains = append(domains, domain.SANs...) - certificateResource, err := a.getDomainsCertificates(domains) - if err != nil { - log.Errorf("Error getting ACME certificate for domain %s: %s", domains, err.Error()) - continue - } - transaction, object, err := a.store.Begin() - if err != nil { - log.Errorf("Error creating ACME store transaction from domain %s: %s", domain, err.Error()) - continue - } - account = object.(*Account) - _, err = account.DomainsCertificate.addCertificateForDomains(certificateResource, domain) - if err != nil { - log.Errorf("Error adding ACME certificate for domain %s: %s", domains, err.Error()) - continue - } + a.jobs.In() <- func() { + log.Infof("Retrieving ACME certificates...") + for _, domain := range a.Domains { + // check if cert isn't already loaded + account := a.store.Get().(*Account) + if _, exists := account.DomainsCertificate.exists(domain); !exists { + domains := []string{} + domains = append(domains, domain.Main) + domains = append(domains, domain.SANs...) + certificateResource, err := a.getDomainsCertificates(domains) + if err != nil { + log.Errorf("Error getting ACME certificate for domain %s: %s", domains, err.Error()) + continue + } + transaction, object, err := a.store.Begin() + if err != nil { + log.Errorf("Error creating ACME store transaction from domain %s: %s", domain, err.Error()) + continue + } + account = object.(*Account) + _, err = account.DomainsCertificate.addCertificateForDomains(certificateResource, domain) + if err != nil { + log.Errorf("Error adding ACME certificate for domain %s: %s", domains, err.Error()) + continue + } - if err = transaction.Commit(account); err != nil { - log.Errorf("Error Saving ACME account %+v: %s", account, err.Error()) - continue + if err = transaction.Commit(account); err != nil { + log.Errorf("Error Saving ACME account %+v: %s", account, err.Error()) + continue + } } } + log.Infof("Retrieved ACME certificates") } - log.Infof("Retrieved ACME certificates") } -func (a *ACME) renewCertificates() error { - log.Debugf("Testing certificate renew...") - account := a.store.Get().(*Account) - for _, certificateResource := range account.DomainsCertificate.Certs { - if certificateResource.needRenew() { - log.Debugf("Renewing certificate %+v", certificateResource.Domains) - renewedCert, err := a.client.RenewCertificate(acme.CertificateResource{ - Domain: certificateResource.Certificate.Domain, - CertURL: certificateResource.Certificate.CertURL, - CertStableURL: certificateResource.Certificate.CertStableURL, - PrivateKey: certificateResource.Certificate.PrivateKey, - Certificate: certificateResource.Certificate.Certificate, - }, true, OSCPMustStaple) - if err != nil { - log.Errorf("Error renewing certificate: %v", err) - continue - } - log.Debugf("Renewed certificate %+v", certificateResource.Domains) - renewedACMECert := &Certificate{ - Domain: renewedCert.Domain, - CertURL: renewedCert.CertURL, - CertStableURL: renewedCert.CertStableURL, - PrivateKey: renewedCert.PrivateKey, - Certificate: renewedCert.Certificate, - } - transaction, object, err := a.store.Begin() - if err != nil { - return err - } - account = object.(*Account) - err = account.DomainsCertificate.renewCertificates(renewedACMECert, certificateResource.Domains) - if err != nil { - log.Errorf("Error renewing certificate: %v", err) - continue - } +func (a *ACME) renewCertificates() { + a.jobs.In() <- func() { + log.Debugf("Testing certificate renew...") + account := a.store.Get().(*Account) + for _, certificateResource := range account.DomainsCertificate.Certs { + if certificateResource.needRenew() { + log.Debugf("Renewing certificate %+v", certificateResource.Domains) + renewedCert, err := a.client.RenewCertificate(acme.CertificateResource{ + Domain: certificateResource.Certificate.Domain, + CertURL: certificateResource.Certificate.CertURL, + CertStableURL: certificateResource.Certificate.CertStableURL, + PrivateKey: certificateResource.Certificate.PrivateKey, + Certificate: certificateResource.Certificate.Certificate, + }, true, OSCPMustStaple) + if err != nil { + log.Errorf("Error renewing certificate: %v", err) + continue + } + log.Debugf("Renewed certificate %+v", certificateResource.Domains) + renewedACMECert := &Certificate{ + Domain: renewedCert.Domain, + CertURL: renewedCert.CertURL, + CertStableURL: renewedCert.CertStableURL, + PrivateKey: renewedCert.PrivateKey, + Certificate: renewedCert.Certificate, + } + transaction, object, err := a.store.Begin() + if err != nil { + log.Errorf("Error renewing certificate: %v", err) + continue + } + account = object.(*Account) + err = account.DomainsCertificate.renewCertificates(renewedACMECert, certificateResource.Domains) + if err != nil { + log.Errorf("Error renewing certificate: %v", err) + continue + } - if err = transaction.Commit(account); err != nil { - log.Errorf("Error Saving ACME account %+v: %s", account, err.Error()) - continue + if err = transaction.Commit(account); err != nil { + log.Errorf("Error Saving ACME account %+v: %s", account, err.Error()) + continue + } } } } - return nil } func dnsOverrideDelay(delay int) error { @@ -521,8 +519,9 @@ func (a *ACME) loadCertificateOnDemand(clientHello *tls.ClientHelloInfo) (*tls.C // LoadCertificateForDomains loads certificates from ACME for given domains func (a *ACME) LoadCertificateForDomains(domains []string) { - domains = fun.Map(types.CanonicalDomain, domains).([]string) - safe.Go(func() { + a.jobs.In() <- func() { + log.Debugf("LoadCertificateForDomains %s...", domains) + domains = fun.Map(types.CanonicalDomain, domains).([]string) operation := func() error { if a.client == nil { return fmt.Errorf("ACME client still not built") @@ -576,7 +575,7 @@ func (a *ACME) LoadCertificateForDomains(domains []string) { log.Errorf("Error Saving ACME account %+v: %v", account, err) return } - }) + } } func (a *ACME) getDomainsCertificates(domains []string) (*Certificate, error) { @@ -597,3 +596,12 @@ func (a *ACME) getDomainsCertificates(domains []string) (*Certificate, error) { Certificate: certificate.Certificate, }, nil } + +func (a *ACME) runJobs() { + safe.Go(func() { + for job := range a.jobs.Out() { + function := job.(func()) + function() + } + }) +} diff --git a/cluster/datastore.go b/cluster/datastore.go index 3ddfd144d..88f453b4d 100644 --- a/cluster/datastore.go +++ b/cluster/datastore.go @@ -231,21 +231,21 @@ func (s *datastoreTransaction) Commit(object Object) error { s.localLock.Lock() defer s.localLock.Unlock() if s.dirty { - return fmt.Errorf("transaction already used, please begin a new one") + return fmt.Errorf("Transaction already used, please begin a new one") } s.Datastore.meta.object = object err := s.Datastore.meta.Marshall() if err != nil { - return err + return fmt.Errorf("Marshall error: %s", err) } err = s.kv.StoreConfig(s.Datastore.meta) if err != nil { - return err + return fmt.Errorf("StoreConfig error: %s", err) } err = s.remoteLock.Unlock() if err != nil { - return err + return fmt.Errorf("Unlock error: %s", err) } s.dirty = true diff --git a/glide.lock b/glide.lock index 7ac67a952..cd0120564 100644 --- a/glide.lock +++ b/glide.lock @@ -1,5 +1,5 @@ -hash: 0d092f94db69882e79d229c34b9483899e1208eaa7dd0acdd5184635cb0cdaaa -updated: 2017-01-12T12:31:31.35220213+01:00 +hash: ccd56edd81d054a00b23493227ff0765b020aa1de24f8a9d9ff54a05c0223885 +updated: 2017-02-03T09:45:05.719219148+01:00 imports: - name: bitbucket.org/ww/goautoneg version: 75cd24fc2f2c2a2088577d12123ddee5f54e0675 @@ -213,6 +213,10 @@ imports: - store/zookeeper - name: github.com/donovanhide/eventsource version: fd1de70867126402be23c306e1ce32828455d85b +- name: github.com/eapache/channels + version: 47238d5aae8c0fefd518ef2bee46290909cf8263 +- name: github.com/eapache/queue + version: 44cc805cf13205b55f69e14bcb69867d1ae92f98 - name: github.com/edeckers/auroradnsclient version: 8b777c170cfd377aa16bb4368f093017dddef3f9 subpackages: diff --git a/glide.yaml b/glide.yaml index a185a2665..d72ce1f8e 100644 --- a/glide.yaml +++ b/glide.yaml @@ -118,3 +118,4 @@ import: version: v0.3.0 subpackages: - metrics +- package: github.com/eapache/channels \ No newline at end of file