Module fleet 

One certificate pair per zone, and the SNI dispatch that picks between them.

Why a deployment cannot have one certificate

A wildcard matches exactly one label. *.pds.did.bot covers claudes.pds.did.bot and does not cover agent.claudes.pds.did.bot, so a deployment configured with claudes.pds.did.bot and vllm.pds.did.bot needs a <zone> + *.<zone> pair for each of them — two ACME orders, two certificates, two renewal clocks. crate::manager::CertificateManager is one zone’s worth of that; CertificateFleet is the deployment’s.

One ServerConfig regardless

The listener still binds once and the process still builds one rustls::ServerConfig. ZoneResolver sits where a single zone’s crate::resolver::SwappableCert would, holds one of those per zone, and picks between them on the SNI name each ClientHello carries. Each zone’s renewal swaps its own certificate under the same [arc_swap::ArcSwap] a single-zone deployment uses, so hot reload is unchanged: no listener is rebound, and no connection past its handshake notices.

What a failed renewal does here

Exactly what it does for one zone, per zone and no more widely. crate::renew holds the whole policy: renewal starts 30 days before expiry, retries hourly, keeps serving the existing certificate on failure, warns after three consecutive failures and escalates to AlertLevel::Critical inside three days of expiry whether or not anything has failed yet. A zone whose renewal is failing does not stop the other zones’ renewals or their traffic; CertificateFleet::alert_level reports the worst level any zone is at, so a deployment-wide health check reads one value, and CertificateFleet::zone_alert_levels says which zone it came from.

Structs

AbortOnDrop 🔒

Aborts every renewal task when the loop future is dropped, so a cancelled run_renewal_loops does not leave tasks renewing behind it.

CertificateFleet

Every configured zone’s certificate, renewed independently, served through one rustls::ServerConfig.

ZoneResolver

The process’s one rustls certificate resolver when several zones are served: one SwappableCert per zone, chosen by SNI.

Enums

FleetError

Why a fleet could not be assembled.

Functions

zone_covers

Whether a certificate for zone — covering zone and *.zone — is the right certificate to present for host.