diff options
| -rw-r--r-- | core/certmanager.lua | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/core/certmanager.lua b/core/certmanager.lua new file mode 100644 index 00000000..55059b3f --- /dev/null +++ b/core/certmanager.lua @@ -0,0 +1,35 @@ +local configmanager = require "core.configmanager"; +local ssl = ssl; +local ssl_newcontext = ssl.newcontext; + +local setmetatable = setmetatable; + +local prosody = prosody; + +module "certmanager" + +-- These are the defaults if not overridden in the config +local default_ssl_ctx = { mode = "client", protocol = "sslv23", capath = "/etc/ssl/certs", verify = "none", options = "no_sslv2"; }; +local default_ssl_ctx_in = { mode = "server", protocol = "sslv23", capath = "/etc/ssl/certs", verify = "none", options = "no_sslv2"; }; + +local default_ssl_ctx_mt = { __index = default_ssl_ctx }; +local default_ssl_ctx_in_mt = { __index = default_ssl_ctx_in }; + +-- Global SSL options if not overridden per-host +local default_ssl_config = configmanager.get("*", "core", "ssl"); + +function get_context(host, mode, config) + local ssl_config = config and config.core.ssl or default_ssl_config; + if ssl and ssl_config then + return ssl_newcontext(setmetatable(ssl_config, mode == "client" and default_ssl_ctx_mt or default_ssl_ctx_in_mt)); + end + return nil; +end + +function reload_ssl_config() + default_ssl_config = config.get("*", "core", "ssl"); +end + +prosody.events.add_handler("config-reloaded", reload_ssl_config); + +return _M; |