Sync ACME account registration (#293)
https://caddy.community/t/lets-encrypt-hits-rate-limit-too-many-registrations-for-this-ip/24343
This commit is contained in:
parent
88e840d8b9
commit
193db7523a
@ -415,6 +415,15 @@ func (am *ACMEIssuer) mostRecentAccountEmail(ctx context.Context, caURL string)
|
||||
return getPrimaryContact(account), true
|
||||
}
|
||||
|
||||
func accountRegLockKey(acc acme.Account) string {
|
||||
key := "register_acme_account"
|
||||
if len(acc.Contact) == 0 {
|
||||
return key
|
||||
}
|
||||
key += "_" + getPrimaryContact(acc)
|
||||
return key
|
||||
}
|
||||
|
||||
// getPrimaryContact returns the first contact on the account (if any)
|
||||
// without the scheme. (I guess we assume an email address.)
|
||||
func getPrimaryContact(account acme.Account) string {
|
||||
|
@ -50,6 +50,10 @@ func (iss *ACMEIssuer) newACMEClientWithAccount(ctx context.Context, useTestCA,
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// we try loading the account from storage before a potential
|
||||
// lock, and 0after obtaining the lock as well, to ensure we don't
|
||||
// repeat work done by another instance or goroutine
|
||||
getAccount := func() (acme.Account, error) {
|
||||
// look up or create the ACME account
|
||||
var account acme.Account
|
||||
if iss.AccountKeyPEM != "" {
|
||||
@ -59,7 +63,15 @@ func (iss *ACMEIssuer) newACMEClientWithAccount(ctx context.Context, useTestCA,
|
||||
account, err = iss.getAccount(ctx, client.Directory, iss.getEmail())
|
||||
}
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("getting ACME account: %v", err)
|
||||
return acme.Account{}, fmt.Errorf("getting ACME account: %v", err)
|
||||
}
|
||||
return account, nil
|
||||
}
|
||||
|
||||
// first try getting the account
|
||||
account, err := getAccount()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// register account if it is new
|
||||
@ -68,6 +80,26 @@ func (iss *ACMEIssuer) newACMEClientWithAccount(ctx context.Context, useTestCA,
|
||||
zap.Strings("contact", account.Contact),
|
||||
zap.String("location", account.Location))
|
||||
|
||||
// synchronize this so the account is only created once
|
||||
acctLockKey := accountRegLockKey(account)
|
||||
err = iss.config.Storage.Lock(ctx, acctLockKey)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("locking account registration: %v", err)
|
||||
}
|
||||
defer func() {
|
||||
if err := iss.config.Storage.Unlock(ctx, acctLockKey); err != nil {
|
||||
iss.Logger.Error("failed to unlock account registration lock", zap.Error(err))
|
||||
}
|
||||
}()
|
||||
|
||||
// if we're not the only one waiting for this account, then by this point it should already be registered and in storage; reload it
|
||||
account, err = getAccount()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// if we are the only or first one waiting for this account, then proceed to register it while we have the lock
|
||||
if account.Status == "" {
|
||||
if iss.NewAccountFunc != nil {
|
||||
// obtain lock here, since NewAccountFunc calls happen concurrently and they typically read and change the issuer
|
||||
iss.mu.Lock()
|
||||
@ -130,6 +162,12 @@ func (iss *ACMEIssuer) newACMEClientWithAccount(ctx context.Context, useTestCA,
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("could not save account %v: %v", account.Contact, err)
|
||||
}
|
||||
} else {
|
||||
iss.Logger.Info("account has already been registered; reloaded",
|
||||
zap.Strings("contact", account.Contact),
|
||||
zap.String("status", account.Status),
|
||||
zap.String("location", account.Location))
|
||||
}
|
||||
}
|
||||
|
||||
c := &acmeClient{
|
||||
|
Loading…
Reference in New Issue
Block a user