|
| 1 | +# Let's Encrypt Module |
| 2 | + |
| 3 | +The Let's Encrypt module provides automatic SSL/TLS certificate generation and management using Let's Encrypt's ACME protocol. It integrates seamlessly with the Modular framework to provide HTTPS capabilities for your applications. |
| 4 | + |
| 5 | +[](https://pkg.go.dev/github.com/GoCodeAlone/modular/modules/letsencrypt) |
| 6 | + |
| 7 | +## Features |
| 8 | + |
| 9 | +- **Automatic Certificate Generation**: Obtain SSL/TLS certificates from Let's Encrypt automatically |
| 10 | +- **Multiple Challenge Types**: Support for HTTP-01 and DNS-01 challenges |
| 11 | +- **Auto-Renewal**: Automatic certificate renewal before expiration |
| 12 | +- **Multiple DNS Providers**: Support for various DNS providers (Cloudflare, Route53, Azure DNS, etc.) |
| 13 | +- **Staging Environment**: Use Let's Encrypt's staging environment for testing |
| 14 | +- **Certificate Storage**: Persistent storage of certificates and account information |
| 15 | +- **Production Ready**: Built with best practices for production deployments |
| 16 | + |
| 17 | +## Installation |
| 18 | + |
| 19 | +```bash |
| 20 | +go get github.com/GoCodeAlone/modular/modules/letsencrypt |
| 21 | +``` |
| 22 | + |
| 23 | +## Quick Start |
| 24 | + |
| 25 | +### Basic Usage with HTTP Challenge |
| 26 | + |
| 27 | +```go |
| 28 | +package main |
| 29 | + |
| 30 | +import ( |
| 31 | + "context" |
| 32 | + "log/slog" |
| 33 | + "os" |
| 34 | + |
| 35 | + "github.com/GoCodeAlone/modular" |
| 36 | + "github.com/GoCodeAlone/modular/modules/letsencrypt" |
| 37 | + "github.com/GoCodeAlone/modular/modules/httpserver" |
| 38 | +) |
| 39 | + |
| 40 | +type AppConfig struct { |
| 41 | + LetsEncrypt letsencrypt.LetsEncryptConfig `yaml:"letsencrypt"` |
| 42 | + HTTPServer httpserver.HTTPServerConfig `yaml:"httpserver"` |
| 43 | +} |
| 44 | + |
| 45 | +func main() { |
| 46 | + logger := slog.New(slog.NewTextHandler(os.Stdout, nil)) |
| 47 | + |
| 48 | + config := &AppConfig{ |
| 49 | + LetsEncrypt: letsencrypt.LetsEncryptConfig{ |
| 50 | + Email: "your-email@example.com", |
| 51 | + Domains: []string{"example.com", "www.example.com"}, |
| 52 | + UseStaging: false, // Set to true for testing |
| 53 | + StoragePath: "./certs", |
| 54 | + AutoRenew: true, |
| 55 | + RenewBefore: 30, // Renew 30 days before expiration |
| 56 | + }, |
| 57 | + HTTPServer: httpserver.HTTPServerConfig{ |
| 58 | + Host: "0.0.0.0", |
| 59 | + Port: 443, |
| 60 | + TLS: &httpserver.TLSConfig{Enabled: true}, |
| 61 | + }, |
| 62 | + } |
| 63 | + |
| 64 | + configProvider := modular.NewStdConfigProvider(config) |
| 65 | + app := modular.NewStdApplication(configProvider, logger) |
| 66 | + |
| 67 | + // Register modules |
| 68 | + app.RegisterModule(letsencrypt.NewLetsEncryptModule()) |
| 69 | + app.RegisterModule(httpserver.NewHTTPServerModule()) |
| 70 | + |
| 71 | + if err := app.Run(); err != nil { |
| 72 | + logger.Error("Application error", "error", err) |
| 73 | + os.Exit(1) |
| 74 | + } |
| 75 | +} |
| 76 | +``` |
| 77 | + |
| 78 | +### DNS Challenge with Cloudflare |
| 79 | + |
| 80 | +```go |
| 81 | +config := &AppConfig{ |
| 82 | + LetsEncrypt: letsencrypt.LetsEncryptConfig{ |
| 83 | + Email: "your-email@example.com", |
| 84 | + Domains: []string{"*.example.com", "example.com"}, |
| 85 | + UseStaging: false, |
| 86 | + StoragePath: "./certs", |
| 87 | + AutoRenew: true, |
| 88 | + UseDNS: true, |
| 89 | + DNSProvider: &letsencrypt.DNSProviderConfig{ |
| 90 | + Name: "cloudflare", |
| 91 | + }, |
| 92 | + DNSConfig: map[string]string{ |
| 93 | + "CLOUDFLARE_EMAIL": "your-email@example.com", |
| 94 | + "CLOUDFLARE_API_KEY": "your-api-key", |
| 95 | + }, |
| 96 | + }, |
| 97 | +} |
| 98 | +``` |
| 99 | + |
| 100 | +## Configuration |
| 101 | + |
| 102 | +### LetsEncryptConfig |
| 103 | + |
| 104 | +| Field | Type | Description | Default | |
| 105 | +|-------|------|-------------|---------| |
| 106 | +| `email` | `string` | Email address for Let's Encrypt registration | Required | |
| 107 | +| `domains` | `[]string` | List of domain names to obtain certificates for | Required | |
| 108 | +| `use_staging` | `bool` | Use Let's Encrypt staging environment | `false` | |
| 109 | +| `storage_path` | `string` | Directory for certificate storage | `"./letsencrypt"` | |
| 110 | +| `renew_before` | `int` | Days before expiry to renew certificates | `30` | |
| 111 | +| `auto_renew` | `bool` | Enable automatic renewal | `true` | |
| 112 | +| `use_dns` | `bool` | Use DNS-01 challenges instead of HTTP-01 | `false` | |
| 113 | + |
| 114 | +### DNS Provider Configuration |
| 115 | + |
| 116 | +For DNS challenges, configure the DNS provider: |
| 117 | + |
| 118 | +```yaml |
| 119 | +letsencrypt: |
| 120 | + email: "your-email@example.com" |
| 121 | + domains: |
| 122 | + - "example.com" |
| 123 | + - "*.example.com" |
| 124 | + use_dns: true |
| 125 | + dns_provider: |
| 126 | + name: "cloudflare" |
| 127 | + dns_config: |
| 128 | + CLOUDFLARE_EMAIL: "your-email@example.com" |
| 129 | + CLOUDFLARE_API_KEY: "your-api-key" |
| 130 | +``` |
| 131 | +
|
| 132 | +### Supported DNS Providers |
| 133 | +
|
| 134 | +- **Cloudflare**: `cloudflare` |
| 135 | +- **Route53 (AWS)**: `route53` |
| 136 | +- **Azure DNS**: `azuredns` |
| 137 | +- **Google Cloud DNS**: `gcloud` |
| 138 | +- **DigitalOcean**: `digitalocean` |
| 139 | +- **Namecheap**: `namecheap` |
| 140 | + |
| 141 | +Each provider requires specific environment variables or configuration parameters. |
| 142 | + |
| 143 | +## Integration with HTTP Server |
| 144 | + |
| 145 | +The Let's Encrypt module works seamlessly with the HTTP Server module by implementing the `CertificateService` interface: |
| 146 | + |
| 147 | +```go |
| 148 | +// The HTTP server module will automatically use certificates from Let's Encrypt |
| 149 | +app.RegisterModule(letsencrypt.NewLetsEncryptModule()) |
| 150 | +app.RegisterModule(httpserver.NewHTTPServerModule()) |
| 151 | +``` |
| 152 | + |
| 153 | +## Advanced Usage |
| 154 | + |
| 155 | +### Custom Certificate Handling |
| 156 | + |
| 157 | +```go |
| 158 | +// Get certificate service for custom handling |
| 159 | +var certService httpserver.CertificateService |
| 160 | +app.GetService("certificateService", &certService) |
| 161 | +
|
| 162 | +// Get certificate for a specific domain |
| 163 | +cert := certService.GetCertificate("example.com") |
| 164 | +``` |
| 165 | + |
| 166 | +### Manual Certificate Operations |
| 167 | + |
| 168 | +```go |
| 169 | +letsEncryptModule := letsencrypt.NewLetsEncryptModule() |
| 170 | +
|
| 171 | +// Force certificate renewal |
| 172 | +if err := letsEncryptModule.RenewCertificate("example.com"); err != nil { |
| 173 | + log.Printf("Failed to renew certificate: %v", err) |
| 174 | +} |
| 175 | +``` |
| 176 | + |
| 177 | +## Environment Variables |
| 178 | + |
| 179 | +You can configure the module using environment variables: |
| 180 | + |
| 181 | +```bash |
| 182 | +LETSENCRYPT_EMAIL=your-email@example.com |
| 183 | +LETSENCRYPT_DOMAINS=example.com,www.example.com |
| 184 | +LETSENCRYPT_USE_STAGING=false |
| 185 | +LETSENCRYPT_STORAGE_PATH=./certs |
| 186 | +LETSENCRYPT_AUTO_RENEW=true |
| 187 | +``` |
| 188 | + |
| 189 | +## Best Practices |
| 190 | + |
| 191 | +1. **Use Staging for Testing**: Always test with `use_staging: true` to avoid rate limits |
| 192 | +2. **Secure Storage**: Ensure certificate storage directory has proper permissions |
| 193 | +3. **Monitor Renewals**: Set up monitoring for certificate renewal failures |
| 194 | +4. **Backup Certificates**: Regularly backup your certificate storage directory |
| 195 | +5. **DNS Challenge for Wildcards**: Use DNS challenges for wildcard certificates |
| 196 | + |
| 197 | +## Troubleshooting |
| 198 | + |
| 199 | +### Common Issues |
| 200 | + |
| 201 | +1. **Rate Limits**: Use staging environment for testing |
| 202 | +2. **DNS Propagation**: DNS challenges may take time to propagate |
| 203 | +3. **Firewall**: Ensure port 80 is accessible for HTTP challenges |
| 204 | +4. **Domain Validation**: Verify domain ownership and DNS configuration |
| 205 | + |
| 206 | +### Debug Mode |
| 207 | + |
| 208 | +Enable debug logging to troubleshoot issues: |
| 209 | + |
| 210 | +```go |
| 211 | +logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{ |
| 212 | + Level: slog.LevelDebug, |
| 213 | +})) |
| 214 | +``` |
| 215 | + |
| 216 | +## Examples |
| 217 | + |
| 218 | +See the [examples directory](../../examples/) for complete working examples: |
| 219 | + |
| 220 | +- Basic HTTPS server with Let's Encrypt |
| 221 | +- Multi-domain certificate management |
| 222 | +- DNS challenge configuration |
| 223 | + |
| 224 | +## Dependencies |
| 225 | + |
| 226 | +- [lego](https://github.com/go-acme/lego) - ACME client library |
| 227 | +- Works with the [httpserver](../httpserver/) module for HTTPS support |
| 228 | + |
| 229 | +## License |
| 230 | + |
| 231 | +This module is part of the Modular framework and is licensed under the [MIT License](../../LICENSE). |
0 commit comments