Function start_zt_domain_watch_task

gateway/src/main_service.rs:577–634

Watch for ZT-Domain config changes and auto-renew certificates

(proxy: Proxy)

/// Watch for ZT-Domain config changes and auto-renew certificates
fn start_zt_domain_watch_task(proxy: Proxy) {
    let kv_store = proxy.kv_store.clone();
    let certbot = proxy.certbot.clone();

    let mut rx = kv_store.watch_zt_domain_configs();
    tokio::spawn(async move {
        // Track known domains to detect additions
        let mut known_domains = kv_store
            .list_zt_domain_configs()
            .into_iter()
            .map(|c| c.domain)
            .collect::<HashSet<_>>();

        loop {
            if rx.changed().await.is_err() {
                break;
            }

            // Get current domains
            let current_domains: HashSet<String> = kv_store
                .list_zt_domain_configs()
                .into_iter()
                .map(|c| c.domain)
                .collect();

            // Find newly added domains
            let new_domains: Vec<String> = current_domains
                .iter()
                .filter(|d| !known_domains.contains(*d))
                .cloned()
                .collect();

            // Update known domains
            known_domains = current_domains;

            // Trigger renewal for new domains
            for domain in new_domains {
                info!("ZT-Domain added: {domain}, attempting certificate request...");
                let certbot = certbot.clone();
                tokio::spawn(async move {
                    match certbot.try_renew(&domain, false).await {
                        Ok(renewed) => {
                            if renewed {
                                info!("cert[{domain}]: successfully issued/renewed");
                            } else {
                                info!("cert[{domain}]: renewal not needed or another node is handling it");
                            }
                        }
                        Err(e) => {
                            warn!("cert[{domain}]: auto-renewal failed: {e:?}");
                        }
                    }
                });
            }
        }
    });
    info!("ZT-Domain watch task started");
}