TLS & ACME

Fluxheim can serve TLS with static certificates or manage ACME certificates for you.

Managed certificates

[[vhosts]]
name = "site"
hosts = ["example.com"]

[vhosts.tls]
acme = true
email = "admin@example.com"
storage = "/var/lib/fluxheim/acme"

ACME safety and lifecycle

Fluxheim 1.7.9 validates issuer directories and requires explicit agreement to the exact advertised terms before creating an account. Account bootstrap, certificate publication, deactivation, and revocation use recoverable transactions.

[[tls.acme.issuers]]
name = "letsencrypt"
directory_url = "https://acme-v02.api.letsencrypt.org/directory"
terms_of_service_agreed = true
terms_of_service_url = "https://letsencrypt.org/repository/"

Confirm the current URL from the issuer before deployment. A changed or mismatched agreement must be rejected.

Check and maintain ACME

fluxheim-acme --config /etc/fluxheim/fluxheim.toml doctor
fluxheim-acme --config /etc/fluxheim/fluxheim.toml doctor --online
fluxheim-acme --config /etc/fluxheim/fluxheim.toml renew
fluxheim-acme --config /etc/fluxheim/fluxheim.toml revoke --vhost example.com --confirm

Online checks run from this server and do not replace external monitoring. Revocation quarantines the managed certificate pair and requests a reload; install a replacement before continuing normal service.

TLS choices

Choice	Use it when
`rustls`	You want the normal memory-safe TLS path.
`openssl`	You need an OpenSSL provider boundary.
`modern`	Only modern TLS clients must connect.
`intermediate`	You want the default production compatibility profile.
`compat`	You must keep TLS 1.2 compatibility explicit.

Static certificate example

[server]
tls_listen = ["0.0.0.0:8443"]

[[vhosts]]
name = "site"
hosts = ["example.com"]

[vhosts.tls]
cert_path = "/etc/fluxheim/tls/fullchain.pem"
key_path = "/etc/fluxheim/tls/privkey.pem"

Client certificate revocation

When mutual TLS must reject revoked client certificates, provide a bounded PEM CRL bundle. Fluxheim validates the complete issuer chain and rejects expired or incomplete CRL policy.

[vhosts.tls.client_auth]
mode = "required"
ca_path = "/etc/fluxheim/tls/client-ca.pem"
crl_path = "/etc/fluxheim/tls/client-crls.pem"

Required client authentication in a FIPS or ISO-required compliance mode also requires a CRL bundle. Ordinary client authentication keeps revocation as an explicit opt-in.

Before enabling ACME

Make sure public DNS points to this server.
Allow HTTP-01 or TLS-ALPN-01 challenge traffic.
Mount ACME state as persistent writable storage.
Use externally issued certificates for strict FIPS or ISO-required boundaries.