Improve ACME support

[blind-oracle]

• Adapt to changes in ic-bn-lib
• Allow loading of ACME account & Cloudflare token from cli/env vars
• Preliminary DNS-PERSIST-01 ACME challenge support
• Update crates
• Formatting

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 023ea59.

Security Overview

• 🔎 Scanned files: 12 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/2f4ca4b6-3e66-473c-8350-2a581fad9f23?scanId=1cc3f0b6-53c4-46c5-9337-f8ab3b5bdab5&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► Cargo.lock     Update a large number of dependencies versions and syn/syn-3.0.2 transition across crates ► Cargo.toml     ic-bn-lib version bump from 0.4 to 0.4.1     maxminddb, mockall, nix, ic-http-gateway-protocol, etc. version updates and feature adjustments ► src/cli.rs     Add dns_persist option and updates to ACME related fields     Adjust descriptions and defaults for ACME configuration ► src/core.rs     Adjust dns_resolver handling in main initialization ► src/log/mod.rs     Minor restructuring and formatting imports ► src/metrics/mod.rs     Re-nesting imports from routing to merged path ► src/metrics/runner.rs     Documentation comment fix for PROMETHEUS content type ► src/policy/mod.rs     Minor formatting/spacing adjustment in function body ► src/routing/ic/handler.rs     Adjust import ordering to colocate BNRequestMetadata/BNResponseMetadata ► src/routing/middleware/geoip.rs     Refactor geoip lookup to use chained methods more succinctly ► src/tls/mod.rs     Remove unconditional import of acme-related items behind cfg gate; adjust ACME setup signatures and types ► src/routing/ic/handler.rs     Reorder imports and remove redundant use statement ► src/routing/middleware/geoip.rs     Modify geoip code to use updated db lookup API ► src/tls/mod.rs     Update ACME-related types and resolver parameter types; adjust setup_acme signature ► Several crates in Cargo.lock

[Copilot]

Pull request overview

This PR updates the gateway’s ACME/TLS integration to align with ic-bn-lib changes, adds CLI/env configuration for ACME account credentials and Cloudflare tokens, and introduces preliminary support for a DNS-PERSIST ACME challenge mode. It also includes dependency bumps and minor formatting/documentation cleanups across the codebase.

Changes:

• Adapt ACME setup to updated ic-bn-lib APIs (resolver type changes, updated ACME DNS initialization, updated Cloudflare DNS client wiring).
• Add CLI/env support for passing ACME account credentials (JSON) and Cloudflare token directly.
• Introduce preliminary DnsPersist challenge handling and update dependencies/formatting.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/create_acme_account.rs	Updates ACME client builder usage for account creation helper tool.
src/tls/mod.rs	Refactors ACME setup to new resolver/client APIs; adds DNS-PERSIST path and account-creds support.
src/routing/middleware/geoip.rs	Updates maxminddb API usage and formats lookup code.
src/routing/ic/handler.rs	Import ordering/formatting only.
src/policy/mod.rs	Minor formatting change.
src/metrics/runner.rs	Converts a comment to a doc comment on a constant.
src/metrics/mod.rs	Import grouping/formatting only.
src/log/mod.rs	Import grouping/formatting only.
src/core.rs	Updates TLS setup call site for new resolver type.
src/cli.rs	Adds ACME account creds option; changes Cloudflare token to string; updates ACME option docs/defaults.
Cargo.toml	Bumps ic-bn-lib, maxminddb, mockall, etc.
Cargo.lock	Lockfile updates reflecting dependency bumps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.