go.mod

@@ -10,7 +10,6 @@ require (
 	github.com/creasty/defaults v1.7.0
 	github.com/go-acme/lego/v4 v4.5.3
 	github.com/go-sql-driver/mysql v1.6.0
-	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/joho/godotenv v1.4.0
 	github.com/lib/pq v1.10.7
 	github.com/mattn/go-sqlite3 v1.14.16

go.sum

@@ -332,8 +332,6 @@ github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09
 github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
-github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
 github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=

server/certificates/certificates.go

@@ -6,11 +6,12 @@ import (
 	"crypto/x509"
 	"errors"
 	"fmt"
-	"github.com/hashicorp/golang-lru/v2"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/OrlovEvgeny/go-mcache"
+
 	"github.com/go-acme/lego/v4/certcrypto"
 	"github.com/go-acme/lego/v4/certificate"
 	"github.com/go-acme/lego/v4/challenge/tlsalpn01"
@@ -27,14 +28,12 @@ import (
 
 var ErrUserRateLimitExceeded = errors.New("rate limit exceeded: 10 certificates per user per 24 hours")
 
-var keyCache *lru.Cache[string, tls.Certificate]
-
 // TLSConfig returns the configuration for generating, serving and cleaning up Let's Encrypt certificates.
 func TLSConfig(mainDomainSuffix string,
 	giteaClient *gitea.Client,
 	acmeClient *AcmeClient,
 	firstDefaultBranch string,
-	challengeCache cache.ICache, canonicalDomainCache cache.ICache,
+	keyCache *mcache.CacheDriver, challengeCache cache.ICache, dnsLookupCache *mcache.CacheDriver, canonicalDomainCache cache.ICache,
 	certDB database.CertDB,
 	noDNS01 bool,
 	rawDomain string,
@@ -89,7 +88,7 @@ func TLSConfig(mainDomainSuffix string,
 				}
 			} else {
 				var targetRepo, targetBranch string
-				targetOwner, targetRepo, targetBranch = dnsutils.GetTargetFromDNS(domain, mainDomainSuffix, firstDefaultBranch)
+				targetOwner, targetRepo, targetBranch = dnsutils.GetTargetFromDNS(domain, mainDomainSuffix, firstDefaultBranch, dnsLookupCache)
 				if targetOwner == "" {
 					// DNS not set up, return main certificate to redirect to the docs
 					domain = mainDomainSuffix
@@ -108,17 +107,9 @@ func TLSConfig(mainDomainSuffix string,
 				}
 			}
 
-			if keyCache == nil {
-				var err error
-				keyCache, err = lru.New[string, tls.Certificate](4096)
-				if err != nil {
-					panic(err) // This should only happen if 4096 < 0 at the time of writing, which should be reason enough to panic.
-				}
-			}
-
 			if tlsCertificate, ok := keyCache.Get(domain); ok {
 				// we can use an existing certificate object
-				return &tlsCertificate, nil
+				return tlsCertificate.(*tls.Certificate), nil
 			}
 
 			var tlsCertificate *tls.Certificate
@@ -143,7 +134,9 @@ func TLSConfig(mainDomainSuffix string,
 				}
 			}
 
-			keyCache.Add(domain, *tlsCertificate)
+			if err := keyCache.Set(domain, tlsCertificate, 15*time.Minute); err != nil {
+				return nil, err
+			}
 			return tlsCertificate, nil
 		},
 		NextProtos: []string{

server/dns/dns.go

@@ -1,38 +1,26 @@
 package dns
 
 import (
-	"github.com/hashicorp/golang-lru/v2"
 	"net"
 	"strings"
 	"time"
+
+	"github.com/OrlovEvgeny/go-mcache"
 )
 
-type lookupCacheEntry struct {
-	cachedName string
-	timestamp  time.Time
-}
-
-var lookupCacheValidity = 30 * time.Second
-
-var lookupCache *lru.Cache[string, lookupCacheEntry]
+// lookupCacheTimeout specifies the timeout for the DNS lookup cache.
+var lookupCacheTimeout = 15 * time.Minute
 
 var defaultPagesRepo = "pages"
 
 // GetTargetFromDNS searches for CNAME or TXT entries on the request domain ending with MainDomainSuffix.
 // If everything is fine, it returns the target data.
-func GetTargetFromDNS(domain, mainDomainSuffix, firstDefaultBranch string) (targetOwner, targetRepo, targetBranch string) {
+func GetTargetFromDNS(domain, mainDomainSuffix, firstDefaultBranch string, dnsLookupCache *mcache.CacheDriver) (targetOwner, targetRepo, targetBranch string) {
 	// Get CNAME or TXT
 	var cname string
 	var err error
-
-	if lookupCache == nil {
-		lookupCache, err = lru.New[string, lookupCacheEntry](4096)
-		if err != nil {
-			panic(err) // This should only happen if 4096 < 0 at the time of writing, which should be reason enough to panic.
-		}
-	}
-	if entry, ok := lookupCache.Get(domain); ok && time.Now().Before(entry.timestamp.Add(lookupCacheValidity)) {
-		cname = entry.cachedName
+	if cachedName, ok := dnsLookupCache.Get(domain); ok {
+		cname = cachedName.(string)
 	} else {
 		cname, err = net.LookupCNAME(domain)
 		cname = strings.TrimSuffix(cname, ".")
@@ -50,10 +38,7 @@ func GetTargetFromDNS(domain, mainDomainSuffix, firstDefaultBranch string) (targ
 				}
 			}
 		}
-		_ = lookupCache.Add(domain, lookupCacheEntry{
-			cname,
-			time.Now(),
-		})
+		_ = dnsLookupCache.Set(domain, cname, lookupCacheTimeout)
 	}
 	if cname == "" {
 		return

server/gitea/cache.go

@@ -100,15 +100,11 @@ type writeCacheReader struct {
 	cache          cache.ICache
 	hasError       bool
 	doNotCache     bool
-	complete       bool
 }
 
 func (t *writeCacheReader) Read(p []byte) (n int, err error) {
 	log.Trace().Msgf("[cache] read %q", t.cacheKey)
 	n, err = t.originalReader.Read(p)
-	if err == io.EOF {
-		t.complete = true
-	}
 	if err != nil && err != io.EOF {
 		log.Trace().Err(err).Msgf("[cache] original reader for %q has returned an error", t.cacheKey)
 		t.hasError = true
@@ -124,7 +120,7 @@ func (t *writeCacheReader) Read(p []byte) (n int, err error) {
 }
 
 func (t *writeCacheReader) Close() error {
-	doWrite := !t.hasError && !t.doNotCache && t.complete
+	doWrite := !t.hasError && !t.doNotCache
 	fc := *t.fileResponse
 	fc.Body = t.buffer.Bytes()
 	if doWrite {

server/handler/handler.go

@@ -4,6 +4,8 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/OrlovEvgeny/go-mcache"
+
 	"github.com/rs/zerolog/log"
 
 	"codeberg.org/codeberg/pages/config"
@@ -23,7 +25,7 @@ const (
 func Handler(
 	cfg config.ServerConfig,
 	giteaClient *gitea.Client,
-	canonicalDomainCache, redirectsCache cache.ICache,
+	dnsLookupCache *mcache.CacheDriver, canonicalDomainCache, redirectsCache cache.ICache,
 ) http.HandlerFunc {
 	return func(w http.ResponseWriter, req *http.Request) {
 		log.Debug().Msg("\n----------------------------------------------------------")
@@ -108,7 +110,7 @@ func Handler(
 				trimmedHost,
 				pathElements,
 				cfg.PagesBranches[0],
-				canonicalDomainCache, redirectsCache)
+				dnsLookupCache, canonicalDomainCache, redirectsCache)
 		}
 	}
 }

server/handler/handler_custom_domain.go

@@ -5,6 +5,8 @@ import (
 	"path"
 	"strings"
 
+	"github.com/OrlovEvgeny/go-mcache"
+
 	"codeberg.org/codeberg/pages/html"
 	"codeberg.org/codeberg/pages/server/cache"
 	"codeberg.org/codeberg/pages/server/context"
@@ -19,10 +21,10 @@ func handleCustomDomain(log zerolog.Logger, ctx *context.Context, giteaClient *g
 	trimmedHost string,
 	pathElements []string,
 	firstDefaultBranch string,
-	canonicalDomainCache, redirectsCache cache.ICache,
+	dnsLookupCache *mcache.CacheDriver, canonicalDomainCache, redirectsCache cache.ICache,
 ) {
 	// Serve pages from custom domains
-	targetOwner, targetRepo, targetBranch := dns.GetTargetFromDNS(trimmedHost, mainDomainSuffix, firstDefaultBranch)
+	targetOwner, targetRepo, targetBranch := dns.GetTargetFromDNS(trimmedHost, mainDomainSuffix, firstDefaultBranch, dnsLookupCache)
 	if targetOwner == "" {
 		html.ReturnErrorPage(ctx,
 			"could not obtain repo owner from custom domain",
@@ -53,7 +55,7 @@ func handleCustomDomain(log zerolog.Logger, ctx *context.Context, giteaClient *g
 			return
 		} else if canonicalDomain != trimmedHost {
 			// only redirect if the target is also a codeberg page!
-			targetOwner, _, _ = dns.GetTargetFromDNS(strings.SplitN(canonicalDomain, "/", 2)[0], mainDomainSuffix, firstDefaultBranch)
+			targetOwner, _, _ = dns.GetTargetFromDNS(strings.SplitN(canonicalDomain, "/", 2)[0], mainDomainSuffix, firstDefaultBranch, dnsLookupCache)
 			if targetOwner != "" {
 				ctx.Redirect("https://"+canonicalDomain+"/"+targetOpt.TargetPath, http.StatusTemporaryRedirect)
 				return

server/handler/handler_test.go

@@ -6,6 +6,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/OrlovEvgeny/go-mcache"
+
 	"codeberg.org/codeberg/pages/config"
 	"codeberg.org/codeberg/pages/server/cache"
 	"codeberg.org/codeberg/pages/server/gitea"
@@ -29,7 +31,7 @@ func TestHandlerPerformance(t *testing.T) {
 		AllowedCorsDomains: []string{"raw.codeberg.org", "fonts.codeberg.org", "design.codeberg.org"},
 		PagesBranches:      []string{"pages"},
 	}
-	testHandler := Handler(serverCfg, giteaClient, cache.NewInMemoryCache(), cache.NewInMemoryCache())
+	testHandler := Handler(serverCfg, giteaClient, mcache.New(), cache.NewInMemoryCache(), cache.NewInMemoryCache())
 
 	testCase := func(uri string, status int) {
 		t.Run(uri, func(t *testing.T) {

server/startup.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/OrlovEvgeny/go-mcache"
 	"github.com/redis/go-redis/v9"
 
 	"github.com/rs/zerolog"
@@ -72,13 +73,17 @@ func Serve(ctx *cli.Context) error {
 	}
 	defer closeFn()
 
+	// keyCache stores the parsed certificate objects (Redis is no advantage here)
+	keyCache := mcache.New()
+	// dnsLookupCache stores DNS lookups for custom domains (Redis is no advantage here)
+	dnsLookupCache := mcache.New()
+
 	var redisErr error = nil
 	createCache := func(name string) cache.ICache {
 		if cfg.Cache.RedisURL != "" {
 			opts, err := redis.ParseURL(cfg.Cache.RedisURL)
 			if err != nil {
 				redisErr = err
-				return nil
 			}
 			return cache.NewRedisCache(name, opts)
 		}
@@ -123,7 +128,7 @@ func Serve(ctx *cli.Context) error {
 		giteaClient,
 		acmeClient,
 		cfg.Server.PagesBranches[0],
-		challengeCache, canonicalDomainCache,
+		keyCache, challengeCache, dnsLookupCache, canonicalDomainCache,
 		certDB,
 		cfg.ACME.NoDNS01,
 		cfg.Server.RawDomain,
@@ -149,7 +154,7 @@ func Serve(ctx *cli.Context) error {
 	}
 
 	// Create ssl handler based on settings
-	sslHandler := handler.Handler(cfg.Server, giteaClient, canonicalDomainCache, redirectsCache)
+	sslHandler := handler.Handler(cfg.Server, giteaClient, dnsLookupCache, canonicalDomainCache, redirectsCache)
 
 	// Start the ssl listener
 	log.Info().Msgf("Start SSL server using TCP listener on %s", listener.Addr())