feat: automatic ssl certificate

src/default.conf

@@ -2,8 +2,25 @@ error_log /dev/stdout;
 
 lua_shared_dict jasima_cache 20m;
 lua_package_path "/opt/sitelen-tu/?.lua;;";
+
+lua_shared_dict auto_ssl 1m;
+lua_shared_dict auto_ssl_settings 64k;
+
 resolver 127.0.0.11 valid=60 ipv6=off;
 
+init_by_lua_block {
+    auto_ssl = (require "resty.auto-ssl").new()
+    auto_ssl:set("allow_domain", function(domain)
+        -- TODO: Set via environment variable
+        return domain ~= "127.0.0.1"
+    end)
+    auto_ssl:init()
+}
+
+init_worker_by_lua_block {
+    auto_ssl:init_worker()
+}
+
 upstream origin {
     server 127.0.0.1;
 
@@ -11,9 +28,15 @@ upstream origin {
 }
 
 server {
-    listen 80;
+    listen 443 ssl;
     server_name localhost default;
 
+    ssl_certificate_by_lua_block {
+        auto_ssl:ssl_certificate()
+    }
+    ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt;
+    ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;
+
     location / {
         # These variables are set in the access_by_lua stage
         # TODO: These might be better to set with a set_by_lua_block
@@ -40,3 +63,27 @@ server {
         body_filter_by_lua_file /opt/sitelen-tu/body_filter.lua;
     }
 }
+
+server {
+    listen 80;
+    location /.well-known/acme-challenge/ {
+        content_by_lua_block {
+            auto_ssl:challenge_server()
+        }
+    }
+    location / {
+        return 404;
+    }
+}
+
+server {
+    listen 127.0.0.1:8999;
+    client_body_buffer_size 128k;
+    client_max_body_size 128k;
+
+    location / {
+        content_by_lua_block {
+            auto_ssl:hook_server()
+        }
+    }
+}