SSL Certs from Vault

[far-blue]

I love the concept of fabio where you cut out all the middle layers and simply route according to the service records. I'd love to see TCP routing for ssh and mysql services but that's a different issue ;)

What I'd like to suggest here is that SSL certs are fetched from Vault. This would allow services to have auto-generated certs based on Vault's PKI support which has improved greatly in the last couple of releases. I believe the Rest API for Vault is very simple if you are just requesting certs and then it's just a case of tracking expiry - which can be done in memory because restarting fabio you can just request fresh certs. You could even fetch certs lazily on first routing request.

[magiconair]

Yeah, that has been on my wish list for a while (see #27)...

[jefferai]

Vault guy here! Got pointed this way :-)

This would be super cool -- you are probably aware of this, but there is a function that lets you get a certificate based on a client-supplied host name (GetCertificate at https://golang.org/pkg/crypto/tls/#Config) so you could definitely fetch-on-demand.

Looked through the other ticket -- there's definitely room for both LE and Vault, as they really tackle different use-cases. LE is designed to provide certs in an automated way to the Internet infrastructure, but doesn't work well within an organization. Vault's PKI support is designed to provide certs in an automated way within an organization, where you don't need to issue certs acceptable to the wider Internet but you need to issue a large number from a root trusted internally. So for software like fabio, if Internet-facing, you can definitely see imagine fetching certs from LE for the front end, and your backend services fetching certs from Vault. If fabio isn't Internet-facing in your setup, it could also fetch from Vault.