feat: add ACME / Let's Encrypt auto-renewal for certificates

Implements a complete ACME client (RFC 8555) with HTTP-01 challenge
handling, automatic renewal via Oban worker, and LiveView UI for
ACME configuration.

- ACME client behaviour + HTTP implementation (Req + JWS ES256)
- Crypto module: EC P-256 account keys, RSA 2048 cert keys, CSR, JWK thumbprint
- ETS-backed challenge store for HTTP-01 token serving
- Renewal orchestration: account registration, order, authorize, finalize, download
- Oban worker on maintenance queue (6-hour interval) with audit logging
- LiveView: ACME config editing, status display, "Renew Now" button, ACME tab on new cert
- 29 new tests (crypto, challenge store, renewal, worker, controller)

Author: raffaelschneider

config/config.exs

@@ -91,6 +91,10 @@ config :sentinel_cp, :github_webhook,
   secret: nil,
   default_branch: "main"
 
+# ACME / Let's Encrypt configuration
+config :sentinel_cp, :acme,
+  directory_url: "https://acme-v02.api.letsencrypt.org/directory"
+
 # Import environment specific config. This must remain at the bottom
 # of this file so it overrides the configuration defined above.
 import_config "#{config_env()}.exs"

config/dev.exs

@@ -97,3 +97,7 @@ config :sentinel_cp, SentinelCp.Bundles.Storage,
 config :sentinel_cp, SentinelCp.Bundles.Compiler,
   sentinel_binary: System.get_env("SENTINEL_BINARY", "sentinel"),
   skip_validation: !System.get_env("SENTINEL_BINARY")
+
+# Use Let's Encrypt staging in development
+config :sentinel_cp, :acme,
+  directory_url: "https://acme-staging-v02.api.letsencrypt.org/directory"

config/test.exs

@@ -54,6 +54,12 @@ config :sentinel_cp, :github_client, SentinelCp.Webhooks.GitHubClient.Mock
 # Use mock DNS resolver in tests
 config :sentinel_cp, :dns_resolver, SentinelCp.Services.DnsResolver.Mock
 
+# Use mock K8s resolver in tests
+config :sentinel_cp, :k8s_resolver, SentinelCp.Services.K8sResolver.Mock
+
+# Use mock ACME client in tests
+config :sentinel_cp, :acme_client, SentinelCp.Services.Acme.Client.Mock
+
 # Wallaby E2E test configuration
 config :wallaby,
   otp_app: :sentinel_cp,

lib/sentinel_cp/application.ex

@@ -16,6 +16,8 @@ defmodule SentinelCp.Application do
       SentinelCp.PromEx,
       # API rate limiting (ETS-backed token bucket)
       SentinelCp.RateLimit,
+      # ACME challenge token store (ETS-backed)
+      SentinelCp.Services.Acme.ChallengeStore,
       # Background job processing
       {Oban, Application.fetch_env!(:sentinel_cp, Oban)},
       # Start to serve requests, typically the last entry
@@ -33,6 +35,7 @@ defmodule SentinelCp.Application do
     SentinelCp.Services.CertificateExpiryWorker.ensure_started()
     SentinelCp.Analytics.PruneWorker.ensure_started()
     SentinelCp.Services.DiscoverySyncWorker.ensure_started()
+    SentinelCp.Services.CertificateRenewalWorker.ensure_started()
 
     result
   end

lib/sentinel_cp/services.ex

@@ -9,6 +9,7 @@ defmodule SentinelCp.Services do
   import Ecto.Query, warn: false
   alias SentinelCp.Repo
   alias SentinelCp.Services.{Service, ServiceTemplate, ProjectConfig, UpstreamGroup, UpstreamTarget, Certificate, AuthPolicy, OpenApiSpec, DiscoverySource, DiscoverySync, Middleware, ServiceMiddleware}
+  alias SentinelCp.Secrets
 
   ## Services
 
@@ -326,6 +327,36 @@ defmodule SentinelCp.Services do
     |> Repo.all()
   end
 
+  @doc """
+  Lists certificates eligible for ACME auto-renewal.
+
+  Finds certificates with `auto_renew: true`, non-empty `acme_config`,
+  and expiring within the configured threshold (default 30 days).
+  """
+  def list_acme_renewal_candidates(days_ahead \\ 30) do
+    now = DateTime.utc_now()
+    threshold = DateTime.add(now, days_ahead * 86_400, :second)
+
+    from(c in Certificate,
+      where: c.auto_renew == true,
+      where: c.status in ["active", "expiring_soon"],
+      where: c.not_after > ^now,
+      where: c.not_after <= ^threshold,
+      order_by: [asc: c.not_after]
+    )
+    |> Repo.all()
+    |> Enum.filter(&((&1.acme_config || %{}) != %{}))
+  end
+
+  @doc """
+  Updates ACME-specific fields on a certificate (account key, renewal status).
+  """
+  def update_certificate_acme(%Certificate{} = cert, attrs) do
+    cert
+    |> Certificate.acme_changeset(attrs)
+    |> Repo.update()
+  end
+
   ## Service Templates
 
   @doc """
@@ -560,7 +591,7 @@ defmodule SentinelCp.Services do
       |> DiscoverySource.sync_changeset(%{last_sync_status: "syncing"})
       |> Repo.update()
 
-    case dns_resolver().resolve_srv(source.hostname) do
+    case resolve_records(source) do
       {:ok, records} ->
         group = get_upstream_group!(source.upstream_group_id)
         current_targets = group.targets || []
@@ -887,10 +918,28 @@ defmodule SentinelCp.Services do
     service_edges ++ target_edges
   end
 
+  defp resolve_records(%DiscoverySource{source_type: "kubernetes"} = source) do
+    case Secrets.resolve_references(source.config || %{}, source.project_id) do
+      {:ok, resolved_config} ->
+        k8s_resolver().resolve_endpoints(resolved_config)
+
+      {:error, reason} ->
+        {:error, "Secret resolution failed: #{inspect(reason)}"}
+    end
+  end
+
+  defp resolve_records(%DiscoverySource{} = source) do
+    dns_resolver().resolve_srv(source.hostname)
+  end
+
   defp dns_resolver do
     Application.get_env(:sentinel_cp, :dns_resolver, SentinelCp.Services.DnsResolver.Inet)
   end
 
+  defp k8s_resolver do
+    Application.get_env(:sentinel_cp, :k8s_resolver, SentinelCp.Services.K8sResolver.HTTP)
+  end
+
   defp resolve_auth_policy_id(%{security_refs: refs}, policy_map) when is_list(refs) do
     Enum.find_value(refs, fn ref -> Map.get(policy_map, ref) end)
   end

lib/sentinel_cp/services/acme/challenge_store.ex

@@ -0,0 +1,80 @@
+defmodule SentinelCp.Services.Acme.ChallengeStore do
+  @moduledoc """
+  ETS-backed GenServer for storing ephemeral ACME HTTP-01 challenge tokens.
+
+  Tokens are stored with a TTL and cleaned up periodically.
+  """
+
+  use GenServer
+
+  @table :acme_challenge_tokens
+  @cleanup_interval :timer.minutes(5)
+  @ttl_seconds 600
+
+  ## Client API
+
+  def start_link(opts \\ []) do
+    GenServer.start_link(__MODULE__, opts, name: __MODULE__)
+  end
+
+  @doc """
+  Stores a challenge token and its key authorization.
+  """
+  def put(token, key_authorization) do
+    expires_at = System.system_time(:second) + @ttl_seconds
+    :ets.insert(@table, {token, key_authorization, expires_at})
+    :ok
+  end
+
+  @doc """
+  Retrieves the key authorization for a challenge token.
+  """
+  def get(token) do
+    case :ets.lookup(@table, token) do
+      [{^token, key_auth, expires_at}] ->
+        if System.system_time(:second) < expires_at do
+          {:ok, key_auth}
+        else
+          :ets.delete(@table, token)
+          :error
+        end
+
+      [] ->
+        :error
+    end
+  end
+
+  @doc """
+  Removes a challenge token.
+  """
+  def delete(token) do
+    :ets.delete(@table, token)
+    :ok
+  end
+
+  ## Server
+
+  @impl true
+  def init(_opts) do
+    table = :ets.new(@table, [:named_table, :public, :set, {:write_concurrency, true}])
+    schedule_cleanup()
+    {:ok, %{table: table}}
+  end
+
+  @impl true
+  def handle_info(:cleanup, state) do
+    cleanup_expired()
+    schedule_cleanup()
+    {:noreply, state}
+  end
+
+  defp schedule_cleanup do
+    Process.send_after(self(), :cleanup, @cleanup_interval)
+  end
+
+  defp cleanup_expired do
+    now = System.system_time(:second)
+    match_spec = [{{:_, :_, :"$1"}, [{:<, :"$1", now}], [true]}]
+    :ets.select_delete(@table, match_spec)
+  end
+end

lib/sentinel_cp/services/acme/client.ex

@@ -0,0 +1,46 @@
+defmodule SentinelCp.Services.Acme.Client do
+  @moduledoc """
+  Behaviour for ACME (RFC 8555) client operations.
+
+  Covers the full certificate issuance flow: directory discovery,
+  account registration, order creation, authorization, challenge
+  response, finalization, and certificate download.
+  """
+
+  @type account_key :: tuple()
+  @type directory :: map()
+  @type nonce :: String.t()
+  @type url :: String.t()
+  @type kid :: String.t()
+
+  @callback get_directory(url()) :: {:ok, directory()} | {:error, term()}
+
+  @callback new_nonce(url()) :: {:ok, nonce()} | {:error, term()}
+
+  @callback new_account(url(), account_key(), nonce(), map()) ::
+              {:ok, %{kid: kid(), nonce: nonce()}} | {:error, term()}
+
+  @callback new_order(url(), kid(), account_key(), nonce(), [String.t()]) ::
+              {:ok, %{order_url: url(), authorizations: [url()], finalize_url: url(), nonce: nonce()}}
+              | {:error, term()}
+
+  @callback get_authorization(url(), kid(), account_key(), nonce()) ::
+              {:ok, %{status: String.t(), challenges: [map()], nonce: nonce()}}
+              | {:error, term()}
+
+  @callback respond_challenge(url(), kid(), account_key(), nonce()) ::
+              {:ok, %{nonce: nonce()}} | {:error, term()}
+
+  @callback poll_authorization(url(), kid(), account_key(), nonce(), keyword()) ::
+              {:ok, %{status: String.t(), nonce: nonce()}} | {:error, term()}
+
+  @callback finalize_order(url(), kid(), account_key(), nonce(), binary()) ::
+              {:ok, %{nonce: nonce()}} | {:error, term()}
+
+  @callback poll_order(url(), kid(), account_key(), nonce(), keyword()) ::
+              {:ok, %{status: String.t(), certificate_url: url() | nil, nonce: nonce()}}
+              | {:error, term()}
+
+  @callback download_certificate(url(), kid(), account_key(), nonce()) ::
+              {:ok, %{cert_pem: String.t(), nonce: nonce()}} | {:error, term()}
+end