Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
caddytls: Configurable cache size limit
Matthew Holt committed
Jun 5, 2020 at 11:14 UTC
11a132d48b574ef113e411aa22c0801a5a3190bd
2 files changed
+22
-4
modules/caddytls/automation.go
+2
-4
@@ -49,15 +49,13 @@ type AutomationConfig struct {
49
// Caddy staples OCSP (and caches the response) for all
50
// qualifying certificates by default. This setting
51
// changes how often it scans responses for freshness,
52
- // and updates them if they are getting stale.
52
+ // and updates them if they are getting stale. Default: 1h
53
OCSPCheckInterval caddy.Duration `json:"ocsp_interval,omitempty"`
54
55
// Every so often, Caddy will scan all loaded, managed
56
// certificates for expiration. This setting changes how
57
// frequently the scan for expiring certificates is
58
- // performed. If your certificate lifetimes are very
59
- // short (less than ~24 hours), you should set this to
60
- // a low value.
58
+ // performed. Default: 10m
59
RenewCheckInterval caddy.Duration `json:"renew_interval,omitempty"`
60
61
defaultPublicAutomationPolicy *AutomationPolicy
modules/caddytls/tls.go
+20
@@ -57,6 +57,9 @@ type TLS struct {
57
// Configures session ticket ephemeral keys (STEKs).
58
SessionTickets *SessionTicketService `json:"session_tickets,omitempty"`
59
60
+ // Configures the in-memory certificate cache.
61
+ Cache *CertCacheOptions `json:"cache,omitempty"`
62
+
63
certificateLoaders []CertificateLoader
64
automateNames []string
65
certCache *certmagic.Cache
@@ -89,6 +92,9 @@ func (t *TLS) Provision(ctx caddy.Context) error {
92
cacheOpts.OCSPCheckInterval = time.Duration(t.Automation.OCSPCheckInterval)
93
cacheOpts.RenewCheckInterval = time.Duration(t.Automation.RenewCheckInterval)
94
}
95
+ if t.Cache != nil {
96
+ cacheOpts.Capacity = t.Cache.Capacity
97
+ }
98
t.certCache = certmagic.NewCache(cacheOpts)
99
100
// certificate loaders
@@ -215,6 +221,11 @@ func (t *TLS) Validate() error {
221
}
222
}
223
}
224
+ if t.Cache != nil {
225
+ if t.Cache.Capacity < 0 {
226
+ return fmt.Errorf("cache capacity must be >= 0")
227
+ }
228
+ }
229
return nil
230
}
231
@@ -445,6 +456,15 @@ func (AutomateLoader) CaddyModule() caddy.ModuleInfo {
456
}
457
}
458
459
+// CertCacheOptions configures the certificate cache.
460
+type CertCacheOptions struct {
461
+ // Maximum number of certificates to allow in the
462
+ // cache. If reached, certificates will be randomly
463
+ // evicted to make room for new ones. Default: 0
464
+ // (no limit).
465
+ Capacity int `json:"capacity,omitempty"`
466
+}
467
+
468
// Variables related to storage cleaning.
469
var (
470
storageCleanInterval = 12 * time.Hour