tls: Avoid duplication AutomationPolicies for large quantities of names

This should greatly reduce memory usage at scale. Part of an overall
effort between Caddy 2 and CertMagic to optimize for large numbers of
names.

2 files changed, 22 insertions, 9 deletions

diff --git a/modules/caddyhttp/autohttps.go b/modules/caddyhttp/autohttps.go
index d60e955ce..8b6fa4d3a 100644
--- a/modules/caddyhttp/autohttps.go
+++ b/modules/caddyhttp/autohttps.go
@@ -338,7 +338,7 @@ func (app *App) automaticHTTPSPhase3() error {
 			srv.tlsApp.Automation = new(caddytls.AutomationConfig)
 		}
 		srv.tlsApp.Automation.Policies = append(srv.tlsApp.Automation.Policies,
-			caddytls.AutomationPolicy{
+			&caddytls.AutomationPolicy{
 				Hosts:      domainsForCerts,
 				Management: acmeManager,
 			})
diff --git a/modules/caddytls/tls.go b/modules/caddytls/tls.go
index f9beb6f48..7d80bfb93 100644
--- a/modules/caddytls/tls.go
+++ b/modules/caddytls/tls.go
@@ -202,19 +202,32 @@ func (t *TLS) Cleanup() error {
 // Manage immediately begins managing names according to the
 // matching automation policy.
 func (t *TLS) Manage(names []string) error {
+	// for a large number of names, we can be more memory-efficient
+	// by making only one certmagic.Config for all the names that
+	// use that config, rather than calling ManageSync/ManageAsync
+	// once for every name; so first, bin names by AutomationPolicy
+	policyToNames := make(map[*AutomationPolicy][]string)
 	for _, name := range names {
 		ap := t.getAutomationPolicyForName(name)
+		policyToNames[ap] = append(policyToNames[ap], name)
+	}
+
+	// now that names are grouped by policy, we can simply make one
+	// certmagic.Config for each (potentially large) group of names
+	// and call ManageSync/ManageAsync just once for the whole batch
+	for ap, names := range policyToNames {
 		magic := certmagic.New(t.certCache, ap.makeCertMagicConfig(t.ctx))
 		var err error
 		if ap.ManageSync {
-			err = magic.ManageSync([]string{name})
+			err = magic.ManageSync(names)
 		} else {
-			err = magic.ManageAsync(t.ctx.Context, []string{name})
+			err = magic.ManageAsync(t.ctx.Context, names)
 		}
 		if err != nil {
-			return fmt.Errorf("automate: manage %s: %v", name, err)
+			return fmt.Errorf("automate: manage %v: %v", names, err)
 		}
 	}
+
 	return nil
 }
 
@@ -234,7 +247,7 @@ func (t *TLS) getConfigForName(name string) (certmagic.Config, error) {
 	return ap.makeCertMagicConfig(t.ctx), nil
 }
 
-func (t *TLS) getAutomationPolicyForName(name string) AutomationPolicy {
+func (t *TLS) getAutomationPolicyForName(name string) *AutomationPolicy {
 	if t.Automation != nil {
 		for _, ap := range t.Automation.Policies {
 			if len(ap.Hosts) == 0 {
@@ -248,9 +261,7 @@ func (t *TLS) getAutomationPolicyForName(name string) AutomationPolicy {
 			}
 		}
 	}
-
-	// default automation policy
-	return AutomationPolicy{Management: new(ACMEManagerMaker)}
+	return defaultAutomationPolicy
 }
 
 // AllMatchingCertificates returns the list of all certificates in
@@ -329,7 +340,7 @@ type Certificate struct {
 type AutomationConfig struct {
 	// The list of automation policies. The first matching
 	// policy will be applied for a given certificate/name.
-	Policies []AutomationPolicy `json:"policies,omitempty"`
+	Policies []*AutomationPolicy `json:"policies,omitempty"`
 
 	// On-Demand TLS defers certificate operations to the
 	// moment they are needed, e.g. during a TLS handshake.
@@ -510,6 +521,8 @@ var (
 	storageCleanMu sync.Mutex
 )
 
+var defaultAutomationPolicy = &AutomationPolicy{Management: new(ACMEManagerMaker)}
+
 // Interface guards
 var (
 	_ caddy.App          = (*TLS)(nil)