Struct Manager 

pub struct Manager {
    cfg: ManagerConfig,
    factory: Arc<dyn AcmeClientFactory>,
    client: Mutex<Option<Arc<dyn AcmeClient>>>,
    storage: Arc<dyn CertStorage>,
    solver: Arc<TlsAlpnSolver>,
    certs: Arc<ArcSwap<HashMap<String, ManagedCert>>>,
    slots: Vec<ManagedSlot>,
    controls: HashMap<String, SlotControl>,
    metrics: Option<Arc<AcmeMetrics>>,
    owner: String,
}

Fields

cfg: ManagerConfig

factory: Arc<dyn AcmeClientFactory>

client: Mutex<Option<Arc<dyn AcmeClient>>>

storage: Arc<dyn CertStorage>

solver: Arc<TlsAlpnSolver>

certs: Arc<ArcSwap<HashMap<String, ManagedCert>>>

slots: Vec<ManagedSlot>

controls: HashMap<String, SlotControl>

metrics: Option<Arc<AcmeMetrics>>

owner: String

Implementations

impl Manager

pub fn new( cfg: ManagerConfig, factory: Arc<dyn AcmeClientFactory>, storage: Arc<dyn CertStorage>, solver: Arc<TlsAlpnSolver>, certs: Arc<ArcSwap<HashMap<String, ManagedCert>>>, slots: Vec<ManagedSlot>, metrics: Option<Arc<AcmeMetrics>>, ) -> Arc<Self>

pub fn slots(&self) -> &[ManagedSlot]

pub fn in_flight(&self, id: &str) -> bool

pub fn renew_now(&self, id: &str, force: bool) -> RenewOutcome

Wakes the slot’s task. Without force, a valid certificate outside its renewal window is left alone (NotDue) — Let’s Encrypt’s duplicate-cert limits are the classic footgun.

pub async fn run(self: Arc<Self>)

Spawns the per-slot loops and returns.

async fn client(&self) -> Result<Arc<dyn AcmeClient>, AcmeError>

fn snapshot(&self, id: &CertId) -> Option<ManagedCert>

fn observe(&self, id: &CertId)

fn remint_placeholder_if_stale( &self, slot: &ManagedSlot, current: ManagedCert, ) -> ManagedCert

Mints a fresh self-signed placeholder when the current one is about to lapse. Placeholders are deliberately short-lived (one hour) so they are never mistaken for a real certificate; a slot whose issuance keeps failing would otherwise end up serving an expired self-signed cert, which fails the TLS handshake outright instead of merely failing verification. The state stays Placeholder – that is what /readyz keys on – and the recorded attempt/error history is carried over.

async fn run_slot(self: Arc<Self>, slot: ManagedSlot)

async fn attempt(&self, slot: &ManagedSlot) -> Result<bool, AcmeError>

One issuance under the lease. Ok(false) = a peer holds the lease.

async fn follow_peer(&self, slot: &ManagedSlot, ctl: &SlotControl) -> bool

Non-leaseholder path: refresh challenge certs from storage every challenge_refresh and look for the peer’s certificate every peer_poll, for at most one lease TTL (then the outer loop re-evaluates). Returns whether a peer’s certificate was adopted, so the caller can reset any failure/backoff state that no longer applies to it.

async fn adopt_from_storage( &self, slot: &ManagedSlot, ) -> Result<bool, AcmeError>

Publishes the stored certificate when it is newer than what we serve.