0.34.6_repo_cleanup

src/tls/certificates.rs

@@ -1,5 +1,3 @@
-/// Build the fixed administration TLS configuration. A named inventory
-/// certificate may be selected; otherwise the app-managed default pair is used.
 pub fn compile_admin(
     settings: &Settings,
     administration: &crate::settings::Administration,
@@ -132,15 +130,9 @@ pub fn import(directory: &Path, name: &str, cert: PathBuf, key: PathBuf) -> Resu
     )
 }
 
-/// Result of reconciling an externally supplied certificate/key pair with the
-/// immutable generation currently selected by a manual certificate id.
 #[derive(Debug, PartialEq, Eq)]
 pub enum ExternalPairDeployment {
-    /// The configured RustProxy-owned generation already contains the exact
-    /// certificate chain and private key supplied by the external issuer.
     Unchanged { covered_hosts: Vec<String> },
-    /// A new immutable generation was written and must be published through the
-    /// revisioned configuration path before the old generation can be removed.
     Staged {
         cert_file: String,
         key_file: String,
@@ -159,12 +151,6 @@ fn external_generation_pair(certificate_id: &str, cert_file: &str, key_file: &st
     cert_stem == key_stem && cert_stem.starts_with(&prefix)
 }
 
-/// Validate an externally supplied pair and reconcile it with the currently
-/// selected RustProxy-owned immutable generation. Repeating the same deploy is
-/// therefore a no-op, while a missing/different pair stages a fresh generation.
-///
-/// `current_pair` is advisory: unreadable/missing current files are treated as
-/// drift and repaired by staging a new generation instead of failing the deploy.
 pub fn reconcile_external_pair(
     directory: &Path,
     certificate_id: &str,
@@ -210,8 +196,6 @@ pub fn reconcile_external_pair(
     })
 }
 
-/// Stage a locally supplied certificate/key pair under generation-specific
-/// filenames. This compatibility wrapper always stages a new generation.
 pub fn stage_external_pair(
     directory: &Path,
     certificate_id: &str,
@@ -230,8 +214,6 @@ pub fn stage_external_pair(
     }
 }
 
-/// Best-effort rollback for a generation created by `stage_external_pair`.
-/// Only generation-specific external files may be removed through this helper.
 pub fn remove_external_pair(directory: &Path, cert_file: &str, key_file: &str) -> Result<()> {
     safe_name(cert_file)?;
     safe_name(key_file)?;
@@ -254,8 +236,6 @@ pub fn remove_external_pair(directory: &Path, cert_file: &str, key_file: &str) -
     Ok(())
 }
 
-/// Select named inventory certificates per vhost/redirect host. A single global
-/// SNI resolver cannot give the same name different certificates by destination IP.
 pub fn for_all_frontends(
     settings: &Settings,
     vhosts: &[crate::vhost::Vhost],
@@ -317,7 +297,6 @@ pub fn for_all_frontends(
     Ok(result)
 }
 
-/// Compatibility helper for callers without dedicated local-response hosts.
 pub fn for_frontends(
     settings: &Settings,
     vhosts: &[crate::vhost::Vhost],
@@ -326,12 +305,9 @@ pub fn for_frontends(
     for_all_frontends(settings, vhosts, redirects, &[])
 }
 
-/// Compatibility helper used by focused TLS tests and callers that only have vhosts.
 pub fn for_vhosts(settings: &Settings, vhosts: &[crate::vhost::Vhost]) -> Result<Settings> {
     for_frontends(settings, vhosts, &[])
 }
-/// Upload staging: files are private and immutable; configuration publication is
-/// a separate revisioned operation. Unbound files never alter active TLS state.
 pub fn upload(
     directory: &Path,
     certificate: &[u8],
@@ -358,8 +334,6 @@ pub fn upload(
     }
     crate::auth::prepare_directory(directory)?;
     let _lock = crate::auth::lock_directory(directory)?;
-    // Bound abandoned staging files. Admins may remove unreferenced upload-* pairs
-    // locally; never delete potentially active files automatically.
     let staged = fs::read_dir(directory)?
         .filter_map(|e| e.ok())
         .filter(|e| {
@@ -382,7 +356,6 @@ pub fn upload(
         hosts: Vec::new(),
     })
 }
-/// Validate immutable ACME outputs before they may be published to the library.
 pub fn validate_acme(
     directory: &Path,
     id: String,
@@ -402,8 +375,6 @@ pub fn validate_acme(
     let mut resolver = ResolvesServerCertUsingSni::new();
     for domain in domains {
         let domain = normalize_host_pattern(domain)?;
-        // A concrete name checks a wildcard SAN without relying on wildcard
-        // behavior in rustls' stock validation resolver.
         let name = domain
             .strip_prefix("*.")
             .map(|d| format!("rustproxy-acme-check.{d}"))