-- Hoogle documentation, generated by Haddock
-- See Hoogle, http://www.haskell.org/hoogle/

-- | HTTP over TLS support for Warp via the TLS package
--   
--   SSLv1 and SSLv2 are obsoleted by IETF. We should use TLS 1.2 (or TLS
--   1.1 or TLS 1.0 if necessary). HTTP/2 can be negotiated by ALPN. API
--   docs and the README are available at
--   http://www.stackage.org/package/warp-tls.
@package warp-tls
@version 3.3.6

module Network.Wai.Handler.WarpTLS.Internal

-- | Determines where to load the certificate, chain certificates, and key
--   from.
data CertSettings
CertFromFile :: !FilePath -> ![FilePath] -> !FilePath -> CertSettings
CertFromMemory :: !ByteString -> ![ByteString] -> !ByteString -> CertSettings
CertFromRef :: !IORef ByteString -> ![IORef ByteString] -> !IORef ByteString -> CertSettings

-- | Settings for WarpTLS.
data TLSSettings
TLSSettings :: CertSettings -> OnInsecure -> Logging -> [Version] -> [Cipher] -> Bool -> ServerHooks -> Maybe Params -> Maybe Config -> Maybe Credentials -> Maybe SessionManager -> [HashAndSignatureAlgorithm] -> TLSSettings

-- | Where are the certificate, chain certificates, and key loaded from?
--   
--   
--   >>> certSettings defaultTlsSettings
--   tlsSettings "certificate.pem" "key.pem"
--   
[certSettings] :: TLSSettings -> CertSettings

-- | Do we allow insecure connections with this server as well?
--   
--   
--   >>> onInsecure defaultTlsSettings
--   DenyInsecure "This server only accepts secure HTTPS connections."
--   
--   
--   Since 1.4.0
[onInsecure] :: TLSSettings -> OnInsecure

-- | The level of logging to turn on.
--   
--   Default: defaultLogging.
--   
--   Since 1.4.0
[tlsLogging] :: TLSSettings -> Logging

-- | The TLS versions this server accepts.
--   
--   
--   >>> tlsAllowedVersions defaultTlsSettings
--   [TLS13,TLS12,TLS11,TLS10]
--   
--   
--   Since 1.4.2
[tlsAllowedVersions] :: TLSSettings -> [Version]

-- | The TLS ciphers this server accepts.
--   
--   
--   >>> tlsCiphers defaultTlsSettings
--   [ECDHE-ECDSA-AES256GCM-SHA384,ECDHE-ECDSA-AES128GCM-SHA256,ECDHE-RSA-AES256GCM-SHA384,ECDHE-RSA-AES128GCM-SHA256,DHE-RSA-AES256GCM-SHA384,DHE-RSA-AES128GCM-SHA256,ECDHE-ECDSA-AES256CBC-SHA384,ECDHE-RSA-AES256CBC-SHA384,DHE-RSA-AES256-SHA256,ECDHE-ECDSA-AES256CBC-SHA,ECDHE-RSA-AES256CBC-SHA,DHE-RSA-AES256-SHA1,RSA-AES256GCM-SHA384,RSA-AES256-SHA256,RSA-AES256-SHA1,AES128GCM-SHA256,AES256GCM-SHA384]
--   
--   
--   Since 1.4.2
[tlsCiphers] :: TLSSettings -> [Cipher]

-- | Whether or not to demand a certificate from the client. If this is set
--   to True, you must handle received certificates in a server hook or all
--   connections will fail.
--   
--   
--   >>> tlsWantClientCert defaultTlsSettings
--   False
--   
--   
--   Since 3.0.2
[tlsWantClientCert] :: TLSSettings -> Bool

-- | The server-side hooks called by the tls package, including actions to
--   take when a client certificate is received. See the Network.TLS
--   module for details.
--   
--   Default: def
--   
--   Since 3.0.2
[tlsServerHooks] :: TLSSettings -> ServerHooks

-- | Configuration for ServerDHEParams more function lives in
--   cryptonite package
--   
--   Default: Nothing
--   
--   Since 3.2.2
[tlsServerDHEParams] :: TLSSettings -> Maybe Params

-- | Configuration for in-memory TLS session manager. If Nothing,
--   noSessionManager is used. Otherwise, an in-memory TLS session
--   manager is created according to Config.
--   
--   Default: Nothing
--   
--   Since 3.2.4
[tlsSessionManagerConfig] :: TLSSettings -> Maybe Config

-- | Specifying Credentials directly. If this value is specified,
--   other fields such as certFile are ignored.
--   
--   Since 3.2.12
[tlsCredentials] :: TLSSettings -> Maybe Credentials

-- | Specifying SessionManager directly. If this value is specified,
--   tlsSessionManagerConfig is ignored.
--   
--   Since 3.2.12
[tlsSessionManager] :: TLSSettings -> Maybe SessionManager

-- | Specifying supported hash/signature algorithms, ordered by decreasing
--   priority. See the Network.TLS module for details
--   
--   Since 3.3.3
[tlsSupportedHashSignatures] :: TLSSettings -> [HashAndSignatureAlgorithm]

-- | An action when a plain HTTP comes to HTTP over TLS/SSL port.
data OnInsecure
DenyInsecure :: ByteString -> OnInsecure
AllowInsecure :: OnInsecure

-- | Some programs need access to cert settings
getCertSettings :: TLSSettings -> CertSettings
instance GHC.Show.Show Network.Wai.Handler.WarpTLS.Internal.OnInsecure

-- | HTTP over TLS support for Warp via the TLS package.
--   
--   If HTTP/2 is negotiated by ALPN, HTTP/2 over TLS is used. Otherwise
--   HTTP/1.1 over TLS is used.
--   
--   Support for SSL is now obsoleted.
module Network.Wai.Handler.WarpTLS

-- | Running Application with TLSSettings and
--   Settings.
runTLS :: TLSSettings -> Settings -> Application -> IO ()

-- | Running Application with TLSSettings and Settings
--   using specified Socket.
runTLSSocket :: TLSSettings -> Settings -> Socket -> Application -> IO ()

-- | Settings for WarpTLS.
data TLSSettings

-- | Default TLSSettings. Use this to create TLSSettings with
--   the field record name (aka accessors).
defaultTlsSettings :: TLSSettings

-- | A smart constructor for TLSSettings based on
--   defaultTlsSettings.
tlsSettings :: FilePath -> FilePath -> TLSSettings

-- | A smart constructor for TLSSettings that allows specifying
--   chain certificates based on defaultTlsSettings.
--   
--   Since 3.0.3
tlsSettingsChain :: FilePath -> [FilePath] -> FilePath -> TLSSettings

-- | A smart constructor for TLSSettings, but uses in-memory
--   representations of the certificate and key based on
--   defaultTlsSettings.
--   
--   Since 3.0.1
tlsSettingsMemory :: ByteString -> ByteString -> TLSSettings

-- | A smart constructor for TLSSettings, but uses in-memory
--   representations of the certificate and key based on
--   defaultTlsSettings.
--   
--   Since 3.0.3
tlsSettingsChainMemory :: ByteString -> [ByteString] -> ByteString -> TLSSettings

-- | A smart constructor for TLSSettings, but uses references to
--   in-memory representations of the certificate and key based on
--   defaultTlsSettings.
tlsSettingsRef :: IORef ByteString -> IORef ByteString -> TLSSettings

-- | A smart constructor for TLSSettings, but uses references to
--   in-memory representations of the certificate and key based on
--   defaultTlsSettings.
tlsSettingsChainRef :: IORef ByteString -> [IORef ByteString] -> IORef ByteString -> TLSSettings

-- | Determines where to load the certificate, chain certificates, and key
--   from.
data CertSettings

-- | Specifying Credentials directly. If this value is specified,
--   other fields such as certFile are ignored.
--   
--   Since 3.2.12
tlsCredentials :: TLSSettings -> Maybe Credentials

-- | The level of logging to turn on.
--   
--   Default: defaultLogging.
--   
--   Since 1.4.0
tlsLogging :: TLSSettings -> Logging

-- | The TLS versions this server accepts.
--   
--   
--   >>> tlsAllowedVersions defaultTlsSettings
--   [TLS13,TLS12,TLS11,TLS10]
--   
--   
--   Since 1.4.2
tlsAllowedVersions :: TLSSettings -> [Version]

-- | The TLS ciphers this server accepts.
--   
--   
--   >>> tlsCiphers defaultTlsSettings
--   [ECDHE-ECDSA-AES256GCM-SHA384,ECDHE-ECDSA-AES128GCM-SHA256,ECDHE-RSA-AES256GCM-SHA384,ECDHE-RSA-AES128GCM-SHA256,DHE-RSA-AES256GCM-SHA384,DHE-RSA-AES128GCM-SHA256,ECDHE-ECDSA-AES256CBC-SHA384,ECDHE-RSA-AES256CBC-SHA384,DHE-RSA-AES256-SHA256,ECDHE-ECDSA-AES256CBC-SHA,ECDHE-RSA-AES256CBC-SHA,DHE-RSA-AES256-SHA1,RSA-AES256GCM-SHA384,RSA-AES256-SHA256,RSA-AES256-SHA1,AES128GCM-SHA256,AES256GCM-SHA384]
--   
--   
--   Since 1.4.2
tlsCiphers :: TLSSettings -> [Cipher]

-- | Whether or not to demand a certificate from the client. If this is set
--   to True, you must handle received certificates in a server hook or all
--   connections will fail.
--   
--   
--   >>> tlsWantClientCert defaultTlsSettings
--   False
--   
--   
--   Since 3.0.2
tlsWantClientCert :: TLSSettings -> Bool

-- | The server-side hooks called by the tls package, including actions to
--   take when a client certificate is received. See the Network.TLS
--   module for details.
--   
--   Default: def
--   
--   Since 3.0.2
tlsServerHooks :: TLSSettings -> ServerHooks

-- | Configuration for ServerDHEParams more function lives in
--   cryptonite package
--   
--   Default: Nothing
--   
--   Since 3.2.2
tlsServerDHEParams :: TLSSettings -> Maybe Params

-- | Configuration for in-memory TLS session manager. If Nothing,
--   noSessionManager is used. Otherwise, an in-memory TLS session
--   manager is created according to Config.
--   
--   Default: Nothing
--   
--   Since 3.2.4
tlsSessionManagerConfig :: TLSSettings -> Maybe Config

-- | Specifying SessionManager directly. If this value is specified,
--   tlsSessionManagerConfig is ignored.
--   
--   Since 3.2.12
tlsSessionManager :: TLSSettings -> Maybe SessionManager

-- | Do we allow insecure connections with this server as well?
--   
--   
--   >>> onInsecure defaultTlsSettings
--   DenyInsecure "This server only accepts secure HTTPS connections."
--   
--   
--   Since 1.4.0
onInsecure :: TLSSettings -> OnInsecure

-- | An action when a plain HTTP comes to HTTP over TLS/SSL port.
data OnInsecure
DenyInsecure :: ByteString -> OnInsecure
AllowInsecure :: OnInsecure
data WarpTLSException
InsecureConnectionDenied :: WarpTLSException
ClientClosedConnectionPrematurely :: WarpTLSException

-- | Represent Diffie Hellman parameters namely P (prime), and G
--   (generator).
data () => Params

-- | generate params from a specific generator (2 or 5 are common values)
--   we generate a safe prime (a prime number of the form 2p+1 where p is
--   also prime)
generateParams :: MonadRandom m => Int -> Integer -> m Params
instance GHC.Show.Show Network.Wai.Handler.WarpTLS.WarpTLSException
instance GHC.Exception.Type.Exception Network.Wai.Handler.WarpTLS.WarpTLSException
