| 116 | var autocertManager *autocert.Manager |
| 117 | |
| 118 | func newAutocertManager(cfg config.Autocert) *autocert.Manager { |
| 119 | if len(cfg.CacheDir) > 0 { |
| 120 | if err := os.MkdirAll(cfg.CacheDir, 0o700); err != nil { |
| 121 | log.Fatalf("error while creating folder %q: %s", cfg.CacheDir, err) |
| 122 | } |
| 123 | } |
| 124 | var hp autocert.HostPolicy |
| 125 | if len(cfg.AllowedHosts) != 0 { |
| 126 | allowedHosts := make(map[string]struct{}, len(cfg.AllowedHosts)) |
| 127 | for _, v := range cfg.AllowedHosts { |
| 128 | allowedHosts[v] = struct{}{} |
| 129 | } |
| 130 | hp = func(_ context.Context, host string) error { |
| 131 | if _, ok := allowedHosts[host]; ok { |
| 132 | return nil |
| 133 | } |
| 134 | return fmt.Errorf("host %q doesn't match `host_policy` configuration", host) |
| 135 | } |
| 136 | } |
| 137 | return &autocert.Manager{ |
| 138 | Prompt: autocert.AcceptTOS, |
| 139 | Cache: autocert.DirCache(cfg.CacheDir), |
| 140 | HostPolicy: hp, |
| 141 | } |
| 142 | } |
| 143 | |
| 144 | func newListener(listenAddr string) net.Listener { |
| 145 | network := "tcp4" |