[POC/RFC] Add OpenSSL provider support #255
Draft
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motives
lua-resty-auto-ssl
is extremely useful in development environment as well as in production. However while LE is great and free, it's not flexible enough for all scenarios. OpenSSL bridges this gap giving ultimate control over the process.What this does?
In essence this PR adds a (pretty feature-complete) proof-of-concept of local OpenSSL integration in
lua-resty-auto-ssl
. By default compatibility is not broken in any way and the code behaves as before, so it can be deployed without any changes to the configuration.Scope of changes
openssl_manager
implements the logic oflua-resty-auto-ssl
<=> OpenSSL interactionopenssl_hooks
mirrorsletsencrypt_hooks
mimicking flow ofdehydrated
calling hooks script which then calls internal web server to deploy certsssl_provider
is added:resty.auto-ssl.ssl_providers.lets_encrypt
(BC)resty.auto-ssl.ssl_providers.openssl
to enable OpenSSL provideropenssl_config
is added which accepts a path to POSIX shell script which can override options present inopenssl_manager
Current state
WDYT?
Is that something you will like merged?
cc: @GUI