The Access system in Certimate serves as the centralized credential manager for all third-party integrations. It abstracts authentication details (API keys, tokens, SSH credentials) from the functional logic of certificate issuance and deployment, providing a unified interface for the Workflow Engine.
The core entity for managing credentials is the Access struct. It is persisted in the PocketBase access collection and contains a generic configuration map that is unmarshaled into provider-specific structs at runtime.
The Access model defines the identity and provider type, while the Config field stores the sensitive credential data as a map.
| Field | Type | Description |
|---|---|---|
Name | string | User-defined label for the credential. |
Provider | string | The provider identifier (e.g., "aliyun", "ssh"). |
Config | map[string]any | Key-value pairs of credentials. |
Reserve | string | Optional tag for system-reserved credentials (e.g., "ca", "notif"). |
Sources:
Access struct definition: internal/domain/access.go9-16AccessModel: ui/src/domain/access.ts1-6Certimate categorizes providers based on their functional usage. A single provider (like Alibaba Cloud) can support multiple usage types.
Defined in the frontend as AccessUsageType ui/src/domain/provider.ts152:
dns ui/src/domain/provider.ts146): Used for ACME DNS-01 challenge record management.hosting ui/src/domain/provider.ts147): Targets for certificate deployment (Servers, CDNs, Load Balancers).ca ui/src/domain/provider.ts148): Certificate Authorities for ACME issuance.notification ui/src/domain/provider.ts149): Channels for system alerts (Webhook, Email, Matrix, Mattermost, etc.).The system maintains a mapping of provider strings to their capabilities and metadata.
The backend defines AccessProviderType as a string type internal/domain/provider.go3 with constants for every supported service. This includes an expanded list of DNS providers for Lego integration, such as AccessProviderType35cn internal/domain/provider.go17 AccessProviderType51DNScom internal/domain/provider.go18 and AccessProviderTypeGcore internal/domain/provider.go68
The registry covers a wide range of providers including Beget, Dynadot, Hetzner, Hostingde, Hostinger, Infomaniak, Ionos, Namedotcom, Namesilo, Netcup, NS1, Regru, RuCenter, Spaceship, TechnitiumDNS, Todaynic, Vultr, and Westcn internal/domain/provider.go34-137
accessProvidersMap)The accessProvidersMap is the source of truth for the UI, defining the display name, icon, and supported usages for each provider. It determines the order in which providers appear in the "Create Credential" selection list ui/src/domain/provider.ts158-162
Provider Capability Mapping
Sources:
AccessProviderType constants: internal/domain/provider.go15-144ACCESS_PROVIDERS frontend constants: ui/src/domain/provider.ts17-141ACCESS_USAGES frontend constants: ui/src/domain/provider.ts145-150accessProvidersMap implementation: ui/src/domain/provider.ts158-188Each provider has a dedicated configuration struct in the backend to ensure type-safe access to credentials. These structs are used when the Workflow Engine or ACME Client needs to initialize a provider client.
| Provider | Struct Name | Key Fields |
|---|---|---|
| Alibaba Cloud | AccessConfigForAliyun | AccessKeyId, AccessKeySecret, ResourceGroupId internal/domain/access.go68-72 |
| SSH | AccessConfigForSSH | Host, Port, Username, Password, Key internal/domain/access.go351-359 |
| AWS | AccessConfigForAWS | AccessKeyId, SecretAccessKey internal/domain/access.go84-87 |
| S3 | AccessConfigForS3 | Endpoint, Region, AccessKey, SecretKey internal/domain/access.go335-343 |
| Matrix | AccessConfigForMatrix | HomeserverUrl, AccessToken, InternalRoomId internal/domain/access.go278-282 |
| Akamai | AccessConfigForAkamai | Host, ClientToken, ClientSecret, AccessToken internal/domain/access.go61-66 |
| 35cn | AccessConfigFor35cn | Username, ApiPassword internal/domain/access.go25-28 |
| 51DNS | AccessConfigFor51DNScom | ApiKey, ApiSecret internal/domain/access.go30-33 |
Sources:
The following diagrams illustrate how credentials flow through the system and map natural language concepts to code entities.
This diagram bridges user-facing concepts to specific code symbols.
Sources:
The frontend uses the accessProvidersMap to dynamically render forms via AccessForm.tsx ui/src/components/access/AccessForm.tsx29-108 The form utilizes AccessProviderSelect to filter providers by their intended usage ui/src/components/access/AccessForm.tsx92-101
The AccessForm component utilizes AccessConfigFieldsProvider ui/src/components/access/AccessForm.tsx49-67 to inject specific fields based on the selected AccessProviderType.
Key components in this flow:
useAntdForm ui/src/components/access/AccessForm.tsx41-45provider field ui/src/components/access/AccessForm.tsx49-67VolcengineALB, JDCloudCDN, HuaweiCloudAPIG, AWSAmplify, BytePlusTOS, DogeCloudCDN, and GcoreCDN ui/src/components/workflow/designer/forms/BizDeployNodeConfigFieldsProvider.tsx5-74The system uses zod for schema validation in AccessForm ui/src/components/access/AccessForm.tsx34-39 When a user clicks submit, the form is validated against the formSchema and persisted via the PocketBase SDK.
Sources:
Refresh this wiki