Brad FitzpatrickandBrad Fitzpatrick
b553969b03
Use TLS-ALPN-01 for Funnel certificate renewals only when the node already has a cached certificate, and fall back to DNS-01 with a fresh order if the ALPN path is unavailable or fails. Dynamically advertise acme-tls/1 only while an ACME challenge certificate is pending, and add client metrics for DNS-01 and TLS-ALPN-01 start/success/failure paths. Updates tailscale/corp#41736 Fixes tailscale/corp#42320 Change-Id: I5adc6ea129237f9ef592f84fc1a8953c80bc9d5c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
38 lines
954 B
Go
38 lines
954 B
Go
// Copyright (c) Tailscale Inc & contributors
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
//go:build ts_omit_serve
|
|
|
|
// These are temporary (2025-09-13) stubs for when tailscaled is built with the
|
|
// ts_omit_serve build tag, disabling serve.
|
|
//
|
|
// TODO: move serve to a separate package, out of ipnlocal, and delete this
|
|
// file. One step at a time.
|
|
|
|
package ipnlocal
|
|
|
|
import (
|
|
"tailscale.com/ipn"
|
|
"tailscale.com/tailcfg"
|
|
)
|
|
|
|
const serveEnabled = false
|
|
|
|
type localListener = struct{}
|
|
|
|
func (b *LocalBackend) DeleteForegroundSession(sessionID string) error {
|
|
return nil
|
|
}
|
|
|
|
type funnelFlow = struct{}
|
|
|
|
func (*LocalBackend) hasIngressEnabledLocked() bool { return false }
|
|
func (*LocalBackend) shouldWireInactiveIngressLocked() bool { return false }
|
|
func (*LocalBackend) hasFunnelForHostPort(host string, port uint16) bool {
|
|
return false
|
|
}
|
|
|
|
func (b *LocalBackend) vipServicesFromPrefsLocked(prefs ipn.PrefsView) []*tailcfg.VIPService {
|
|
return nil
|
|
}
|