1li/tlsask
Watch
1
0
Fork
You've already forked tlsask
 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions
No description
12 commits 1 branch 6 tags 36 KiB
  • Go 94.7%
  • Dockerfile 5.3%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
SimbaFs 3de0bbb4a4
All checks were successful
Build and publish image / build-and-push (push) Successful in 11s
Details
fix missing build id
2026-10-03 20:33:59 +08:00
.forgejo/workflows fix missing build id 2026-10-03 20:33:59 +08:00
.gitignore add systemd service 2026-09-18 23:21:25 +08:00
Dockerfile fix noroot user 2026-09-29 01:22:53 +08:00
go.mod migrate to k8s 2026-09-29 00:47:17 +08:00
go.sum migrate to k8s 2026-09-29 00:47:17 +08:00
main.go migrate to k8s 2026-09-29 00:47:17 +08:00
README.md fix noroot user 2026-09-29 01:22:53 +08:00

README.md

TLS on-demand ask service

tlsask runs in Kubernetes and answers Caddy's on-demand TLS checks from the hosts declared by Kubernetes Ingress resources.

The process uses the pod's in-cluster ServiceAccount credentials, performs an initial list of Ingresses across all namespaces, and watches for changes.

Endpoints:

  • GET /check?domain=example.com: returns 204 when the domain is present, otherwise 404.
  • GET /healthz: process health check.
  • GET /readyz: returns 204 after the initial Ingress list succeeds.

The default listen address is 0.0.0.0:3000. Override it with LISTEN_ADDR only when running outside the Kubernetes deployment.

Build the image from this directory and publish it to the registry referenced by k8s/tlsask.yaml before deploying the manifest.