Configures an ACME (RFC 8555) client, e.g. to retrieve TLS certificates from Let's Encrypt.

To store the key material and certificates, you can use the local file system or your Kubernetes cluster.

To use ACME:

Register your domain and point the DNS record to your server(s) runnig Membrane.
Let Membrane listen on port 80 and use the <acmeHttpChallenge /> (see below).
Let Membrane listen on port 443 and use <ssl><acme .../><ssl> (see below). Here, you have to configure where Membrane will store the keys and certificates.

Syntax

acme:
  '$ref': <string>
  azureDns: {}
  azureTableStorage: {}
  contacts: <string>
  directoryUrl: <string>
  dnsOperator: {}
  experimental: <boolean>
  fileStorage: {}
  hosts: <string>
  httpClientConfig: {}
  kubernetesStorage: {}
  memoryStorage: {}
  renewal: <string>
  retry: <number>
  termsOfServiceAgreed: <boolean>
  validity: <string>

acme:
  '$ref': <string>
  azureDns: {}
  azureTableStorage: {}
  contacts: <string>
  directoryUrl: <string>
  dnsOperator: {}
  experimental: <boolean>
  fileStorage: {}
  hosts: <string>
  httpClientConfig: {}
  kubernetesStorage: {}
  memoryStorage: {}
  renewal: <string>
  retry: <number>
  termsOfServiceAgreed: <boolean>
  validity: <string>

Sample

<serviceProxy port="80">
  <acmeHttpChallenge />
    <groovy>
      exc.setResponse(Response.ok("here").build());
      RETURN
    </groovy>
</serviceProxy>

<serviceProxy host="test.example.com" port="443">
  <ssl>
    <acme
      directoryUrl="https://acme-staging-v02.api.letsencrypt.org/directory"
      contacts="mailto:webmaster@example.com"
      termsOfServiceAgreed="true">
      <fileStorage dir="C:\tmp" />
    </acme>
  </ssl>
    ...
</serviceProxy>

<serviceProxy host="test.example.com" port="443">
  <ssl>
    <acme
      directoryUrl="https://acme-staging-v02.api.letsencrypt.org/directory"
      contacts="mailto:webmaster@example.com"
      termsOfServiceAgreed="true"&gt;
  <kubernetesStorage namespace="membrane"
      masterLease="membrane" accountSecret="acme-account" prefix="acme-" />
    </acme>
  </ssl>
    ...
</serviceProxy>

<serviceProxy port="80">
  <acmeHttpChallenge />
    <groovy>
      exc.setResponse(Response.ok("here").build());
      RETURN
    </groovy>
</serviceProxy>

<serviceProxy host="test.example.com" port="443">
  <ssl>
    <acme
      directoryUrl="https://acme-staging-v02.api.letsencrypt.org/directory"
      contacts="mailto:webmaster@example.com"
      termsOfServiceAgreed="true">
      <fileStorage dir="C:\tmp" />
    </acme>
  </ssl>
    ...
</serviceProxy>

<serviceProxy host="test.example.com" port="443">
  <ssl>
    <acme
      directoryUrl="https://acme-staging-v02.api.letsencrypt.org/directory"
      contacts="mailto:webmaster@example.com"
      termsOfServiceAgreed="true"&gt;
  <kubernetesStorage namespace="membrane"
      masterLease="membrane" accountSecret="acme-account" prefix="acme-" />
    </acme>
  </ssl>
    ...
</serviceProxy>

Attributes

Name	Required	Default	Description	Examples
$ref	false	-	Reference a component defined under components.	-
contacts	false	-	-	mailto:webmaster
directoryUrl	false	-	-	-
experimental	false	-	-	-
hosts	false	-	-	-
renewal	false	1/3	When to renew the certificate. Can be "1/3" (meaning that the certificate will be renewed when 1/3 of the validity period is left) or "never" (meaning that renewal will never be attempted). If you choose "never", someone else should take care of renewing the key and certificate and update the storage accordingly.	-
retry	false	10000	Number of milliseconds after which a retry should be attempted. (in case of any error, e.g. in case the ACME server cannot be reached or validation failed.)	-
termsOfServiceAgreed	false	-	-	-
validity	false	-	-	PT7D

Child Structure

Element	Cardinality	Description
azureDns	0..1	Configures Azure DNS for ACME DNS-01 validation.
azureTableStorage	0..1
dnsOperator	0..1
fileStorage	0..1
httpClientConfig	0..1	Configuration container for Membrane's HTTP client. Allows defining proxy, connection, authentication, TLS, and retry behavior. Can be used as a reusable bean and referenced via . Most of its sub-elements are optional.
kubernetesStorage	0..1
memoryStorage	0..1	For testing purposes only.

Can be used in

components ssl