ol.clave.ext.common

Common utilities for clave server extensions.

This namespace provides server-agnostic helpers for working with clave’s automation layer, including keystore creation and event processing.

These functions can be used by any server extension (Jetty, http-kit, etc.).

create-keystore

(create-keystore bundle)
(create-keystore bundle password)

Create an in-memory PKCS12 KeyStore from a clave certificate bundle.

No disk I/O - purely in-memory operation suitable for TLS handshakes.

key description

bundle

Certificate bundle from ol.clave.automation/lookup-cert

password

Optional keystore password (default "changeit")

Returns a java.security.KeyStore ready for use with TLS servers. Returns nil if bundle is nil (no certificate available yet).

(create-keystore (auto/lookup-cert system "example.com"))
;; => #object[java.security.KeyStore ...]

source

certificate-event?

(certificate-event? evt)

Check if an event indicates a certificate change.

Returns true for :certificate-obtained and :certificate-renewed events.

key description

evt

Event from ol.clave.automation/subscribe-events

 
(when (certificate-event? evt)
  (log/info "Certificate updated for" (event-domain evt)))

source

event-domain

(event-domain evt)

Extract the domain name from a certificate event.

Returns the domain string or nil if event has no domain.

key description

evt

Event map

source

wrap-redirect-https

(wrap-redirect-https handler)
(wrap-redirect-https handler {:keys [ssl-port] :or {ssl-port 443}})

Ring middleware that redirects HTTP requests to HTTPS.

key description

handler

Ring handler to wrap

opts

Options map with :ssl-port

Options: - :ssl-port - HTTPS port for redirect URL. Defaults to 443 (implicit, no port in URL). Use a custom port like 8443 to include it explicitly.

Passes through requests that are already HTTPS (by :scheme or x-forwarded-proto header).

(wrap-redirect-https handler {:ssl-port 8443})

source

no-op-solver

(no-op-solver)

Create a no-op ACME solver for testing.

Returns a solver that does nothing. Useful with PEBBLE_VA_ALWAYS_VALID=1 where challenge validation is skipped.

{:solvers {:http-01 (no-op-solver)}}

source

missing-certificates

(missing-certificates system domains)

Returns domains without a currently available certificate.

Uses ol.clave.automation/lookup-cert as the authoritative state source.

key description

system

Clave automation system

domains

Domains to check

source

wait-for-certificates

(wait-for-certificates system domains event-queue timeout-ms poll-interval-ms)

Waits for certificates to be available for all domains.

Certificate state from ol.clave.automation/lookup-cert is authoritative. The function accepts an existing event-queue, an optional timeout-ms, and a positive poll-interval-ms. It reports a terminal :certificate-failed event for a still-missing domain immediately and reports :subscription-overflow instead of degrading to a timeout.

Create event-queue before ol.clave.automation/manage-domains because subscriptions receive only live events. The caller must pass the queue to ol.clave.automation/unsubscribe-events in a finally clause.

key description

system

Clave automation system

domains

Domains to wait for

event-queue

Queue from ol.clave.automation/subscribe-events

timeout-ms

Timeout in milliseconds, or nil for none

poll-interval-ms

Maximum interval between authoritative checks

Returns nil once every certificate is available.

(let [events (auto/subscribe-events system)]
  (try
    (auto/manage-domains system ["example.com"])
    (wait-for-certificates system ["example.com"] events 120000 100)
    (finally
      (auto/unsubscribe-events system events))))

source