Purge expired certificates managed in cloud providers

internal/certacme/client_obtain.go

@@ -32,28 +32,34 @@ type ObtainCertificateRequest struct {
 	NoCommonName      bool
 
 	// 提供商相关
+	_                      struct{}
 	ChallengeType          string
 	Provider               domain.ACMEChallengeProviderType
 	ProviderAccessConfig   map[string]any
 	ProviderExtendedConfig map[string]any
 
 	// 解析相关
+	_                  struct{}
 	DisableFollowCNAME bool
 	Nameservers        []string
 
 	// DNS-01 质询相关
+	_                     struct{}
 	DnsPropagationWait    int
 	DnsPropagationTimeout int
 	DnsTTL                int
 
 	// HTTP-01 质询相关
+	_             struct{}
 	HttpDelayWait int
 
 	// ACME 相关
+	_              struct{}
 	PreferredChain string
 	ACMEProfile    string
 
 	// ARI 相关
+	_                     struct{}
 	DisableARI            bool
 	ARIReplacesAccountUrl string
 	ARIReplacesCertId     string
@@ -102,7 +108,8 @@ func (c *ACMEClient) ObtainCertificate(ctx context.Context, request *ObtainCerti
 			opts := &dns01.Options{}
 			opts.RecursiveNameservers = request.Nameservers
 			dns01.SetDefaultClient(dns01.NewClient(opts))
-			c.client.Challenge.SetDNS01Provider(provider,
+			c.client.Challenge.SetDNS01Provider(
+				provider,
 				dns01.CondOptions(
 					request.DnsPropagationWait > 0,
 					dns01.PropagationWait(time.Duration(request.DnsPropagationWait)*time.Second, true),
@@ -129,7 +136,8 @@ func (c *ACMEClient) ObtainCertificate(ctx context.Context, request *ObtainCerti
 				return nil, fmt.Errorf("failed to initialize http-01 provider '%s': %w", request.Provider, err)
 			}
 
-			c.client.Challenge.SetHTTP01Provider(provider,
+			c.client.Challenge.SetHTTP01Provider(
+				provider,
 				http01.SetDelay(time.Duration(request.HttpDelayWait)*time.Second),
 			)
 		}

internal/certmgmt/client_deploy.go

@@ -10,11 +10,13 @@ import (
 
 type DeployCertificateRequest struct {
 	// 提供商相关
+	_                      struct{}
 	Provider               domain.DeploymentProviderType
 	ProviderAccessConfig   map[string]any
 	ProviderExtendedConfig map[string]any
 
 	// 证书相关
+	_              struct{}
 	CertificatePEM string
 	PrivateKeyPEM  string
 }

internal/certmgmt/client_purge.go

@@ -0,0 +1,50 @@
+package certmgmt
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/certimate-go/certimate/internal/certmgmt/purgers"
+	"github.com/certimate-go/certimate/internal/domain"
+)
+
+type PurgeCertificateRequest struct {
+	// 提供商相关
+	_                      struct{}
+	Provider               domain.PurgeProviderType
+	ProviderAccessConfig   map[string]any
+	ProviderExtendedConfig map[string]any
+
+	// 清理相关
+	_      struct{}
+	Expiry time.Duration
+}
+
+type PurgeCertificateResponse struct{}
+
+func (c *Client) PurgeCertificate(ctx context.Context, request *PurgeCertificateRequest) (*PurgeCertificateResponse, error) {
+	if request == nil {
+		return nil, fmt.Errorf("the request is nil")
+	}
+
+	providerFactory, err := purgers.Registries.Get(request.Provider)
+	if err != nil {
+		return nil, err
+	}
+
+	provider, err := providerFactory(&purgers.ProviderFactoryOptions{
+		ProviderAccessConfig:   request.ProviderAccessConfig,
+		ProviderExtendedConfig: request.ProviderExtendedConfig,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to initialize purge provider '%s': %w", request.Provider, err)
+	}
+
+	provider.SetLogger(c.logger)
+	if _, err := provider.Purge(ctx, request.Expiry); err != nil {
+		return nil, err
+	}
+
+	return &PurgeCertificateResponse{}, nil
+}

internal/certmgmt/deployers/sp_aliyun_alb.go

@@ -25,6 +25,7 @@ func init() {
 			LoadbalancerId:  xmaps.GetString(options.ProviderExtendedConfig, "loadbalancerId"),
 			ListenerId:      xmaps.GetString(options.ProviderExtendedConfig, "listenerId"),
 			Domain:          xmaps.GetString(options.ProviderExtendedConfig, "domain"),
+			AutoPrune:       xmaps.GetBool(options.ProviderExtendedConfig, "autoPrune"),
 		})
 		return provider, err
 	})

internal/certmgmt/deployers/sp_aliyun_esa.go

@@ -21,6 +21,7 @@ func init() {
 			AccessKeySecret: credentials.AccessKeySecret,
 			Region:          xmaps.GetString(options.ProviderExtendedConfig, "region"),
 			SiteId:          xmaps.GetInt64(options.ProviderExtendedConfig, "siteId"),
+			AutoPrune:       xmaps.GetBool(options.ProviderExtendedConfig, "autoPrune"),
 		})
 		return provider, err
 	})

internal/certmgmt/deployers/sp_aws_alb.go

@@ -25,6 +25,7 @@ func init() {
 			ListenerArn:       xmaps.GetString(options.ProviderExtendedConfig, "listenerArn"),
 			CertificateSource: xmaps.GetOrDefaultString(options.ProviderExtendedConfig, "certificateSource", dplyimpl.CERTIFICATE_SOURCE_ACM),
 			IsDefault:         xmaps.GetBool(options.ProviderExtendedConfig, "isDefault"),
+			AutoPrune:         xmaps.GetBool(options.ProviderExtendedConfig, "autoPrune"),
 		})
 		return provider, err
 	})

internal/certmgmt/deployers/sp_aws_nlb.go

@@ -25,6 +25,7 @@ func init() {
 			ListenerArn:       xmaps.GetString(options.ProviderExtendedConfig, "listenerArn"),
 			CertificateSource: xmaps.GetOrDefaultString(options.ProviderExtendedConfig, "certificateSource", dplyimpl.CERTIFICATE_SOURCE_ACM),
 			IsDefault:         xmaps.GetBool(options.ProviderExtendedConfig, "isDefault"),
+			AutoPrune:         xmaps.GetBool(options.ProviderExtendedConfig, "autoPrune"),
 		})
 		return provider, err
 	})

internal/certmgmt/deployers/sp_tencentcloud_ga2.go

@@ -24,6 +24,7 @@ func init() {
 			DeployTarget:  xmaps.GetString(options.ProviderExtendedConfig, "deployTarget"),
 			AcceleratorId: xmaps.GetString(options.ProviderExtendedConfig, "acceleratorId"),
 			ListenerId:    xmaps.GetString(options.ProviderExtendedConfig, "listenerId"),
+			AutoPrune:     xmaps.GetBool(options.ProviderExtendedConfig, "autoPrune"),
 		})
 		return provider, err
 	})

internal/certmgmt/deployers/sp_ucloud_ualb.go

@@ -26,6 +26,7 @@ func init() {
 			LoadbalancerId: xmaps.GetString(options.ProviderExtendedConfig, "loadbalancerId"),
 			ListenerId:     xmaps.GetString(options.ProviderExtendedConfig, "listenerId"),
 			Domain:         xmaps.GetString(options.ProviderExtendedConfig, "domain"),
+			AutoPrune:      xmaps.GetBool(options.ProviderExtendedConfig, "autoPrune"),
 		})
 		return provider, err
 	})

internal/certmgmt/purgers/registry.go

@@ -0,0 +1,54 @@
+package purgers
+
+import (
+	"fmt"
+
+	"github.com/certimate-go/certimate/internal/domain"
+	"github.com/certimate-go/certimate/pkg/core"
+)
+
+type ProviderFactoryFunc func(options *ProviderFactoryOptions) (core.Purger, error)
+
+type ProviderFactoryOptions struct {
+	ProviderAccessConfig   map[string]any
+	ProviderExtendedConfig map[string]any
+}
+
+type Registry[T comparable] interface {
+	Register(T, ProviderFactoryFunc) error
+	MustRegister(T, ProviderFactoryFunc)
+	Get(T) (ProviderFactoryFunc, error)
+}
+
+type registry[T comparable] struct {
+	factories map[T]ProviderFactoryFunc
+}
+
+func (r *registry[T]) Register(name T, factory ProviderFactoryFunc) error {
+	if _, exists := r.factories[name]; exists {
+		return fmt.Errorf("provider '%v' already registered", name)
+	}
+
+	r.factories[name] = factory
+	return nil
+}
+
+func (r *registry[T]) MustRegister(name T, factory ProviderFactoryFunc) {
+	if err := r.Register(name, factory); err != nil {
+		panic(err)
+	}
+}
+
+func (r *registry[T]) Get(name T) (ProviderFactoryFunc, error) {
+	if factory, exists := r.factories[name]; exists {
+		return factory, nil
+	}
+
+	return nil, fmt.Errorf("provider '%v' not registered", name)
+}
+
+func newRegistry[T comparable]() Registry[T] {
+	return &registry[T]{factories: make(map[T]ProviderFactoryFunc)}
+}
+
+var Registries = newRegistry[domain.PurgeProviderType]()

internal/certmgmt/purgers/sp_aliyun_cas.go

@@ -0,0 +1,27 @@
+package purgers
+
+import (
+	"fmt"
+
+	"github.com/certimate-go/certimate/internal/domain"
+	"github.com/certimate-go/certimate/pkg/core"
+	prgimpl "github.com/certimate-go/certimate/pkg/core/purger/providers/aliyun-cas"
+	xmaps "github.com/certimate-go/certimate/pkg/utils/maps"
+)
+
+func init() {
+	Registries.MustRegister(domain.PurgeProviderTypeAliyunCAS, func(options *ProviderFactoryOptions) (core.Purger, error) {
+		credentials := domain.AccessConfigForAliyun{}
+		if err := xmaps.Populate(options.ProviderAccessConfig, &credentials); err != nil {
+			return nil, fmt.Errorf("failed to populate provider access config: %w", err)
+		}
+
+		provider, err := prgimpl.NewPurger(&prgimpl.PurgerConfig{
+			AccessKeyId:     credentials.AccessKeyId,
+			AccessKeySecret: credentials.AccessKeySecret,
+			ResourceGroupId: credentials.ResourceGroupId,
+			Region:          xmaps.GetString(options.ProviderExtendedConfig, "region"),
+		})
+		return provider, err
+	})
+}

internal/certmgmt/purgers/sp_aliyun_clb.go

@@ -0,0 +1,27 @@
+package purgers
+
+import (
+	"fmt"
+
+	"github.com/certimate-go/certimate/internal/domain"
+	"github.com/certimate-go/certimate/pkg/core"
+	prgimpl "github.com/certimate-go/certimate/pkg/core/purger/providers/aliyun-clb"
+	xmaps "github.com/certimate-go/certimate/pkg/utils/maps"
+)
+
+func init() {
+	Registries.MustRegister(domain.PurgeProviderTypeAliyunCLB, func(options *ProviderFactoryOptions) (core.Purger, error) {
+		credentials := domain.AccessConfigForAliyun{}
+		if err := xmaps.Populate(options.ProviderAccessConfig, &credentials); err != nil {
+			return nil, fmt.Errorf("failed to populate provider access config: %w", err)
+		}
+
+		provider, err := prgimpl.NewPurger(&prgimpl.PurgerConfig{
+			AccessKeyId:     credentials.AccessKeyId,
+			AccessKeySecret: credentials.AccessKeySecret,
+			ResourceGroupId: credentials.ResourceGroupId,
+			Region:          xmaps.GetString(options.ProviderExtendedConfig, "region"),
+		})
+		return provider, err
+	})
+}

internal/certmgmt/purgers/sp_aliyun_esa.go

@@ -0,0 +1,27 @@
+package purgers
+
+import (
+	"fmt"
+
+	"github.com/certimate-go/certimate/internal/domain"
+	"github.com/certimate-go/certimate/pkg/core"
+	prgimpl "github.com/certimate-go/certimate/pkg/core/purger/providers/aliyun-esa"
+	xmaps "github.com/certimate-go/certimate/pkg/utils/maps"
+)
+
+func init() {
+	Registries.MustRegister(domain.PurgeProviderTypeAliyunESA, func(options *ProviderFactoryOptions) (core.Purger, error) {
+		credentials := domain.AccessConfigForAliyun{}
+		if err := xmaps.Populate(options.ProviderAccessConfig, &credentials); err != nil {
+			return nil, fmt.Errorf("failed to populate provider access config: %w", err)
+		}
+
+		provider, err := prgimpl.NewPurger(&prgimpl.PurgerConfig{
+			AccessKeyId:     credentials.AccessKeyId,
+			AccessKeySecret: credentials.AccessKeySecret,
+			Region:          xmaps.GetString(options.ProviderExtendedConfig, "region"),
+			SiteId:          xmaps.GetInt64(options.ProviderExtendedConfig, "siteId"),
+		})
+		return provider, err
+	})
+}

internal/certmgmt/purgers/sp_aws_acm.go

@@ -0,0 +1,27 @@
+package purgers
+
+import (
+	"fmt"
+
+	"github.com/certimate-go/certimate/internal/domain"
+	"github.com/certimate-go/certimate/pkg/core"
+	pgrimpl "github.com/certimate-go/certimate/pkg/core/purger/providers/aws-acm"
+	xmaps "github.com/certimate-go/certimate/pkg/utils/maps"
+)
+
+func init() {
+	Registries.MustRegister(domain.PurgeProviderTypeAWSACM, func(options *ProviderFactoryOptions) (core.Purger, error) {
+		credentials := domain.AccessConfigForAWS{}
+		if err := xmaps.Populate(options.ProviderAccessConfig, &credentials); err != nil {
+			return nil, fmt.Errorf("failed to populate provider access config: %w", err)
+		}
+
+		provider, err := pgrimpl.NewPurger(&pgrimpl.PurgerConfig{
+			AuthMethod:      credentials.AuthMethod,
+			AccessKeyId:     credentials.AccessKeyId,
+			SecretAccessKey: credentials.SecretAccessKey,
+			Region:          xmaps.GetString(options.ProviderExtendedConfig, "region"),
+		})
+		return provider, err
+	})
+}

internal/certmgmt/purgers/sp_aws_iam.go

@@ -0,0 +1,28 @@
+package purgers
+
+import (
+	"fmt"
+
+	"github.com/certimate-go/certimate/internal/domain"
+	"github.com/certimate-go/certimate/pkg/core"
+	pgrimpl "github.com/certimate-go/certimate/pkg/core/purger/providers/aws-iam"
+	xmaps "github.com/certimate-go/certimate/pkg/utils/maps"
+)
+
+func init() {
+	Registries.MustRegister(domain.PurgeProviderTypeAWSIAM, func(options *ProviderFactoryOptions) (core.Purger, error) {
+		credentials := domain.AccessConfigForAWS{}
+		if err := xmaps.Populate(options.ProviderAccessConfig, &credentials); err != nil {
+			return nil, fmt.Errorf("failed to populate provider access config: %w", err)
+		}
+
+		provider, err := pgrimpl.NewPurger(&pgrimpl.PurgerConfig{
+			AuthMethod:      credentials.AuthMethod,
+			AccessKeyId:     credentials.AccessKeyId,
+			SecretAccessKey: credentials.SecretAccessKey,
+			Region:          xmaps.GetString(options.ProviderExtendedConfig, "region"),
+			CertificatePath: xmaps.GetOrDefaultString(options.ProviderExtendedConfig, "certificatePath", "/"),
+		})
+		return provider, err
+	})
+}

internal/certmgmt/purgers/sp_azure_keyvault.go

@@ -0,0 +1,28 @@
+package purgers
+
+import (
+	"fmt"
+
+	"github.com/certimate-go/certimate/internal/domain"
+	"github.com/certimate-go/certimate/pkg/core"
+	pgrimpl "github.com/certimate-go/certimate/pkg/core/purger/providers/azure-keyvault"
+	xmaps "github.com/certimate-go/certimate/pkg/utils/maps"
+)
+
+func init() {
+	Registries.MustRegister(domain.PurgeProviderTypeAzureKeyVault, func(options *ProviderFactoryOptions) (core.Purger, error) {
+		credentials := domain.AccessConfigForAzure{}
+		if err := xmaps.Populate(options.ProviderAccessConfig, &credentials); err != nil {
+			return nil, fmt.Errorf("failed to populate provider access config: %w", err)
+		}
+
+		provider, err := pgrimpl.NewPurger(&pgrimpl.PurgerConfig{
+			TenantId:     credentials.TenantId,
+			ClientId:     credentials.ClientId,
+			ClientSecret: credentials.ClientSecret,
+			CloudName:    credentials.CloudName,
+			KeyVaultName: xmaps.GetString(options.ProviderExtendedConfig, "keyvaultName"),
+		})
+		return provider, err
+	})
+}