https

Documentation

Overview

Package https is the built-in "https" plugin (Phase 9, tracker #65). It gives `acthur dev` browser-trusted-shaped local TLS without depending on an external tool: EnsureDevCert generates a self-signed CA and a leaf certificate (SANs: the project's dev domain, `*.<domain>`, and localhost/127.0.0.1) directly with Go's crypto/x509, persists them under <root>/.acthur/certs/, and reuses them on every subsequent call as long as they remain valid and cover the requested domain.

Honest scope: the PRD's dev-mode description names mkcert specifically (generate a local CA via mkcert, install it in the system trust store so browsers never warn). This plugin deliberately does NOT shell out to mkcert (an external binary this repo cannot assume is installed) and does NOT install the generated CA into the OS/browser trust store (that step needs elevated permissions/`security`/`certutil` calls that are platform-specific and were judged out of scope for a first slice — see the status note in docs/implementation/active/0007-prd-completion.md). The result: `acthur dev --https` serves real TLS 1.2+ with a real self-signed cert, but a browser will show a one-time trust warning until a developer manually imports .acthur/certs/ca.pem — an explicit, honest gap, not a silent stub. Production TLS (Caddy/Nginx/ACME) is likewise not implemented here; that belongs to the deploy targets (Phase 8), not dev mode.

Index

• type CertPaths
  • func EnsureDevCert(root, domain string) (CertPaths, error)
  • func PathsFor(root string) CertPaths

Types

type CertPaths

type CertPaths struct {
	CAFile   string
	CAKey    string
	CertFile string
	KeyFile  string
}

CertPaths are the on-disk locations of the generated dev CA and leaf certificate/key, all under <root>/.acthur/certs/.

func EnsureDevCert

func EnsureDevCert(root, domain string) (CertPaths, error)

EnsureDevCert returns a CA + leaf certificate/key pair covering domain (and "*.<domain>", "localhost", "127.0.0.1"), generating and persisting a fresh pair under <root>/.acthur/certs/ if none exists yet, or if the existing leaf cert doesn't cover domain or expires within 30 days.

func PathsFor

func PathsFor(root string) CertPaths

PathsFor returns the well-known cert file locations for root, without touching disk.