Sovite.TLS.MTASTS.Server (sovite v0.6.0)

Copy Markdown View Source

Serves MTA-STS policies (RFC 8461 §3.3): a Sovite.Listener handler for https://mta-sts.<domain>/.well-known/mta-sts.txt, with TLS on the accepted connection.

{Sovite.Listener,
 port: 443,
 handler: Sovite.TLS.MTASTS.Server,
 handler_opts: [
   tls: fn -> Sovite.TLS.server_options(certs_keys: certs_keys, sni_fun: sni_fun) end,
   policy: fn domain -> Map.fetch(policies, domain) end
 ]}

The domain comes from the Host: header, lower-cased and without a port, which must be mta-sts.<domain>. GET and HEAD of the policy path get 200 with the policy as text/plain; other paths and unknown domains get 404, and other methods 405. Each connection serves one request. Requests larger than 8 KiB, or not received within 10 seconds of the connection, are dropped.

Options

  • :tls - a 0-arity function returning the :ssl server options, such as Sovite.TLS.server_options/1 gives. It is called for each connection, so certificates can be reloaded. If it returns nil, the connection is closed. Required.
  • :policy - a 1-arity function given the domain, returning {:ok, text} with the policy body (see Sovite.TLS.MTASTS.policy_text/3) or :error. Required.

Telemetry

  • [:sovite, :tls, :mta_sts, :served] - %{}, %{domain, status}. domain is nil if the request named none.