Sync ACME account registration (#293)

https://caddy.community/t/lets-encrypt-hits-rate-limit-too-many-registrations-for-this-ip/24343

account.go

@@ -415,6 +415,15 @@ func (am *ACMEIssuer) mostRecentAccountEmail(ctx context.Context, caURL string)
 	return getPrimaryContact(account), true
 }
 
+func accountRegLockKey(acc acme.Account) string {
+	key := "register_acme_account"
+	if len(acc.Contact) == 0 {
+		return key
+	}
+	key += "_" + getPrimaryContact(acc)
+	return key
+}
+
 // getPrimaryContact returns the first contact on the account (if any)
 // without the scheme. (I guess we assume an email address.)
 func getPrimaryContact(account acme.Account) string {

acmeclient.go

@@ -50,6 +50,10 @@ func (iss *ACMEIssuer) newACMEClientWithAccount(ctx context.Context, useTestCA,
 		return nil, err
 	}
 
+	// we try loading the account from storage before a potential
+	// lock, and 0after obtaining the lock as well, to ensure we don't
+	// repeat work done by another instance or goroutine
+	getAccount := func() (acme.Account, error) {
 		// look up or create the ACME account
 		var account acme.Account
 		if iss.AccountKeyPEM != "" {
@@ -59,7 +63,15 @@ func (iss *ACMEIssuer) newACMEClientWithAccount(ctx context.Context, useTestCA,
 			account, err = iss.getAccount(ctx, client.Directory, iss.getEmail())
 		}
 		if err != nil {
-		return nil, fmt.Errorf("getting ACME account: %v", err)
+			return acme.Account{}, fmt.Errorf("getting ACME account: %v", err)
+		}
+		return account, nil
+	}
+
+	// first try getting the account
+	account, err := getAccount()
+	if err != nil {
+		return nil, err
 	}
 
 	// register account if it is new
@@ -68,6 +80,26 @@ func (iss *ACMEIssuer) newACMEClientWithAccount(ctx context.Context, useTestCA,
 			zap.Strings("contact", account.Contact),
 			zap.String("location", account.Location))
 
+		// synchronize this so the account is only created once
+		acctLockKey := accountRegLockKey(account)
+		err = iss.config.Storage.Lock(ctx, acctLockKey)
+		if err != nil {
+			return nil, fmt.Errorf("locking account registration: %v", err)
+		}
+		defer func() {
+			if err := iss.config.Storage.Unlock(ctx, acctLockKey); err != nil {
+				iss.Logger.Error("failed to unlock account registration lock", zap.Error(err))
+			}
+		}()
+
+		// if we're not the only one waiting for this account, then by this point it should already be registered and in storage; reload it
+		account, err = getAccount()
+		if err != nil {
+			return nil, err
+		}
+
+		// if we are the only or first one waiting for this account, then proceed to register it while we have the lock
+		if account.Status == "" {
 			if iss.NewAccountFunc != nil {
 				// obtain lock here, since NewAccountFunc calls happen concurrently and they typically read and change the issuer
 				iss.mu.Lock()
@@ -130,6 +162,12 @@ func (iss *ACMEIssuer) newACMEClientWithAccount(ctx context.Context, useTestCA,
 			if err != nil {
 				return nil, fmt.Errorf("could not save account %v: %v", account.Contact, err)
 			}
+		} else {
+			iss.Logger.Info("account has already been registered; reloaded",
+				zap.Strings("contact", account.Contact),
+				zap.String("status", account.Status),
+				zap.String("location", account.Location))
+		}
 	}
 
 	c := &acmeClient{