Feature Request: Reload server TLS certificate

[bitc]

I can currently use warp with TLS by giving it a certificate when I start the server, as shown in the example: https://github.com/seanmonstar/warp/blob/master/examples/tls.rs

The problem is that when the certificate expires, the server must be restarted. I would like to update the certificate of the currently running warp server, so that existing connections are not touched, but all new incoming TCP connections are served the updated certificate.

In terms of the API, one possible suggestion would be to initialize the warp server with a "Channel" object. Then later on I can feed a new certificate into the channel whenever I want. But any other API that works would also be welcome.

This feature would be especially useful for those using letsencrypt, which has short certificate expiry times, and would be a better solution than the restarting technique discussed in #252

Thank you

[acilcenter]

I think this mechanism can be very useful for updating configurations for reverse proxies, redirects etc with zero down time. So please can you implement for a broader use case.

[acilcenter]

I did some research for inspiration and use cases:

Nginx has a product for similar use case: https://www.nginx.com/products/nginx-unit/

Envoy also picks up the configuration change with no downtime.
https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/operations/dynamic_configuration

This is cited as one of the advantages of Envoy against Nginx.

https://dropbox.tech/infrastructure/how-we-migrated-dropbox-from-nginx-to-envoy

Aside: Envoy also has a pluggable filter chain mechanism which enables wasm modules to be used with, which makes it lightweight altentative to containers.

https://webassemblyhub.io
https://istio.io/latest/blog/2020/wasm-announce/

API configurability: Perhaps most importantly, Envoy provides a set of management APIs that can be implemented by control plane services. If a control plane implements all of the APIs, it becomes possible to run Envoy across an entire infrastructure using a generic common bootstrap configuration. All further configuration changes are delivered seamlessly and dynamically via the management server in such a way that Envoy never needs to be restarted. This makes Envoy a universal data plane that, when coupled with a sophisticated enough control plane, vastly reduces overall operational complexity.

https://blog.envoyproxy.io/the-universal-data-plane-api-d15cec7a

I know these are ambitious projects and it is more than simple file watching but having this feature baked into the library opens up windows to amazing possibilities for modest projects.

[thewh1teagle]

Is there an update for that?
I need this feature because when I update the certificate, I currently have to disconnect all the connected clients.

I can try to implement it if it isn't supported yet. Hints would be appreciated.