code wiki / (root) / nx_cert_autorenew_lib.nx

nx_cert_autorenew_lib.nx

buildroot/runtime/nx_cert_autorenew_lib.nx

4480 B80 linesdepth 6pulls 7 transitivereach 2 importersview sourcekind librarytopic cert
docsdependenciesstructsconstsfunctions

about

nx_cert_autorenew_lib.nx -- PURE mapping + threshold logic for the per-domain wildcard TLS auto-renewal system (no I/O, no TLS, no fork). Split out (rule 15 DRY / rule 9 single-responsibility) so BOTH the driver (nx_cert_autorenew.nx) and the gate (nx_cert_autorenew_gate.nx) share ONE copy of the domain->path mapping + the WARN/EXPIRED trigger predicate -- the exact logic the gate proves and the driver acts on. Reuses nx_cert_monitor's verdict vocabulary (CM_OK/WARN/EXPIRED/NOCERT + cm_verdict + CM_WARN_DAYS) so the monitor and the renewer can NEVER disagree about "is this cert expiring". The mapping closes the gap that started this whole arc: a per-domain wildcard cert that silently lapsed because nothing renewed it. Given a dotted domain D, the system knows EXACTLY: issue output -> /tmp/new_<D>_fullchain.der + /tmp/new_<D>_ecdsa_key.bin (nx_acme_dns01_issue argv[1]=D) live SNI path -> /volume1/.../certs/le_<label>_fullchain.der + le_<label>_ecdsa_key.bin (label = D's first DNS label; the names nx_sites_daemon loads per ClientHello SNI) license_tier: ORIGINAL (composes nx_cert_monitor's verdict logic; no new crypto/transport)

dependencies 1 imports · 2 importers

nx_cert_monitor.nx nx_cert_autorenew_lib.nx nx_cert_autorenew.nx nx_cert_autorenew_gate.nx

imports: nx_cert_monitor.nx

imported by: nx_cert_autorenew.nxnx_cert_autorenew_gate.nx

structs

none

consts

17const CAR_CERT_DIR: *u8 = "/volume1/homes/elderwesto/nishihost/certs/" as *u8
18const CAR_TMP_NEW: *u8 = "/tmp/new_" as *u8

functions

21func car_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
called by 2: car_renew_domaincar_sweep_one
22func car_streq(a: *u8, b: *u8) -> i64
called by 2: car_renew_domainmain
29func car_put(out: *u8, off: i64, s: *u8) -> i64
called by 5: car_stamp_pathcar_issue_dercar_issue_keycar_remote_dercar_remote_key
38func car_label(domain: *u8, out: *u8) -> i64
called by 3: car_renew_domaincar_sweep_onemain
50func car_issue_der(domain: *u8, out: *u8) -> i64
called by 2: car_renew_domainmain calls 1: car_put
56func car_issue_key(domain: *u8, out: *u8) -> i64
called by 2: car_renew_domainmain calls 1: car_put
62func car_remote_der(label: *u8, out: *u8) -> i64
called by 2: car_renew_domainmain calls 1: car_put
68func car_remote_key(label: *u8, out: *u8) -> i64
called by 2: car_renew_domainmain calls 1: car_put
76func car_should_renew(verdict: i64) -> i64
called by 2: car_sweep_onemain