You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/ipn
Andrew Lytvynov c1ecae13ab
ipn/{ipnlocal,localapi}: actually renew certs before expiry (#8731)
While our `shouldStartDomainRenewal` check is correct, `getCertPEM`
would always bail if the existing cert is not expired. Add the same
`shouldStartDomainRenewal` check to `getCertPEM` to make it proceed with
renewal when existing certs are still valid but should be renewed.

The extra check is expensive (ARI request towards LetsEncrypt), so cache
the last check result for 1hr to not degrade `tailscale serve`
performance.

Also, asynchronous renewal is great for `tailscale serve` but confusing
for `tailscale cert`. Add an explicit flag to `GetCertPEM` to force a
synchronous renewal for `tailscale cert`.

Fixes #8725

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2 years ago
..
ipnauth all: update copyright and license headers 3 years ago
ipnlocal ipn/{ipnlocal,localapi}: actually renew certs before expiry (#8731) 2 years ago
ipnserver logpolicy, various: allow overriding log function 3 years ago
ipnstate cli: introduce exit-node subcommand to list and filter exit nodes 2 years ago
localapi ipn/{ipnlocal,localapi}: actually renew certs before expiry (#8731) 2 years ago
policy ipn: prefer allow/denylist terminology 3 years ago
store ipn/store/awsstore: persist state with intelligent tiering 3 years ago
backend.go all: update copyright and license headers 3 years ago
doc.go all: update copyright and license headers 3 years ago
fake_test.go all: update copyright and license headers 3 years ago
ipn_clone.go {cmd/tailscale/cli,ipn}: add http support to tailscale serve (#8358) 3 years ago
ipn_view.go {cmd/tailscale/cli,ipn}: add http support to tailscale serve (#8358) 3 years ago
prefs.go all: update copyright and license headers 3 years ago
prefs_test.go all: update copyright and license headers 3 years ago
serve.go {cmd/tailscale/cli,ipn}: add http support to tailscale serve (#8358) 3 years ago
serve_test.go ipn: add Funnel port check from nodeAttr 3 years ago
store.go ipn/store: add support for stores to hook into a custom dialer 3 years ago