Feature: On-demand TLS for custom hostnames

[jonyoi]

Hi Kevin,

Would you be open to adding on-demand TLS in kamal-proxy, issuing certs for tenant custom hostnames validated at request time rather than from a fixed host list?

The use case is multi-tenant SaaS. Customers connect their own domains over time, meaning the set of hosts is open-ended and unknown at deploy time. Each needs a cert issued on the first request without requiring a redeploy. Currently, the common workaround is fronting kamal-proxy with Caddy for its on-demand TLS. It works, but it adds an unnecessary proxy layer and a redundant network hop, not to mention another service to run and maintain.

I think this could be a clean fit: kamal-proxy already uses golang.org/x/crypto/acme/autocert, which supports exactly this via its HostPolicy callback. It could be a small, opt-in addition, such as an HTTP "ask" endpoint like Caddy's, in place of the fixed whitelist, while leaving the default single-host path untouched.

If this is something you'd consider, I would be glad to design it with you and put up a PR.

[jonyoi]

#63

sorry, should have checked this, I will testing that branch and report/address