Allow graceful TLS key rotation about galene

[athoune]

GetCertificate method, for just in time certificate read will only be used for new connections. Websocket will keep the connection opened for a long time.

Why do you care about certificate reload? paid certifcate are valid for years.
If you choose to use LE, using a proxy like Traefik or Caddy (and sharing web with other applications) will be more simple.
Integrating lego lib in galene is more robust than cron+certbot+kill -HUP.

[tohojo]

Mathieu Lecarme <[email protected]> writes:

`GetCertificate` method, for just in time certificate read will only be used for new connections. Websocket will keep the connection opened for a long time. Why do you care about certificate reload? paid certifcate are valid for years. If you choose to use LE, using a proxy like Traefik or Caddy (and sharing web with other applications) will be more simple.

But if you're *not* sharing the IP with other applications, that just means another service to configure...

Integrating lego lib in galene is more robust than cron+certbot+kill -HUP.

Why would that be more robust?

[athoune]

But if you're not sharing the IP with other applications, that just
means another service to configure...
You are using one IP per service ? ipv6 was done for you!

Using a complete HTTP server for handling multihosting, throtlling, bot ban … is just a standard. Few call it ingress.

Integrating lego lib in galene is more robust than cron+certbot+kill
-HUP.

Why would that be more robust?

that just means another service to configure, and a cron to miss.

[jech]

Galène is meant to work both behind a reverse proxy and directly exposed to the Internet. This is not open to discussion.

[athoune]

Sure, the discussion was more about lego integration (inside) vs certbot integration (outside).

[jech]

Fixed in b1babf5.