first commit

internal/acme/challenge.go

@@ -0,0 +1,45 @@
+package acme
+
+import (
+	"net/http"
+	"strings"
+	"sync"
+)
+
+// ChallengeResponder serves HTTP-01 challenge responses at
+// /.well-known/acme-challenge/{token} — mount it on the plain :80 listener
+// (or wherever the CA's HTTP-01 validator will connect) before requesting
+// challenge validation.
+type ChallengeResponder struct {
+	mu     sync.RWMutex
+	tokens map[string]string // token -> key authorization
+}
+
+func NewChallengeResponder() *ChallengeResponder {
+	return &ChallengeResponder{tokens: make(map[string]string)}
+}
+
+func (c *ChallengeResponder) Set(token, keyAuthorization string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.tokens[token] = keyAuthorization
+}
+
+func (c *ChallengeResponder) Remove(token string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	delete(c.tokens, token)
+}
+
+func (c *ChallengeResponder) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	token := strings.TrimPrefix(r.URL.Path, "/.well-known/acme-challenge/")
+	c.mu.RLock()
+	keyAuth, ok := c.tokens[token]
+	c.mu.RUnlock()
+	if !ok {
+		http.NotFound(w, r)
+		return
+	}
+	w.Header().Set("Content-Type", "application/octet-stream")
+	w.Write([]byte(keyAuth))
+}