Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 01:00 UTC
| 1 | // Copyright 2015 Matthew Holt and The Caddy Authors |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | package caddypki |
| 16 | |
| 17 | import ( |
| 18 | "fmt" |
| 19 | |
| 20 | "go.uber.org/zap" |
| 21 | |
| 22 | "github.com/caddyserver/caddy/v2" |
| 23 | ) |
| 24 | |
| 25 | func init() { |
| 26 | caddy.RegisterModule(PKI{}) |
| 27 | } |
| 28 | |
| 29 | // PKI provides Public Key Infrastructure facilities for Caddy. |
| 30 | // |
| 31 | // This app can define certificate authorities (CAs) which are capable |
| 32 | // of signing certificates. Other modules can be configured to use |
| 33 | // the CAs defined by this app for issuing certificates or getting |
| 34 | // key information needed for establishing trust. |
| 35 | type PKI struct { |
| 36 | // The certificate authorities to manage. Each CA is keyed by an |
| 37 | // ID that is used to uniquely identify it from other CAs. |
| 38 | // At runtime, the GetCA() method should be used instead to ensure |
| 39 | // the default CA is provisioned if it hadn't already been. |
| 40 | // The default CA ID is "local". |
| 41 | CAs map[string]*CA `json:"certificate_authorities,omitempty"` |
| 42 | |
| 43 | ctx caddy.Context |
| 44 | log *zap.Logger |
| 45 | } |
| 46 | |
| 47 | // CaddyModule returns the Caddy module information. |
| 48 | func (PKI) CaddyModule() caddy.ModuleInfo { |
| 49 | return caddy.ModuleInfo{ |
| 50 | ID: "pki", |
| 51 | New: func() caddy.Module { return new(PKI) }, |
| 52 | } |
| 53 | } |
| 54 | |
| 55 | // Provision sets up the configuration for the PKI app. |
| 56 | func (p *PKI) Provision(ctx caddy.Context) error { |
| 57 | p.ctx = ctx |
| 58 | p.log = ctx.Logger() |
| 59 | |
| 60 | for caID, ca := range p.CAs { |
| 61 | err := ca.Provision(ctx, caID, p.log) |
| 62 | if err != nil { |
| 63 | return fmt.Errorf("provisioning CA '%s': %v", caID, err) |
| 64 | } |
| 65 | } |
| 66 | |
| 67 | // if this app is initialized at all, ensure there's at |
| 68 | // least a default CA that can be used: the standard CA |
| 69 | // which is used implicitly for signing local-use certs |
| 70 | if len(p.CAs) == 0 { |
| 71 | err := p.ProvisionDefaultCA(ctx) |
| 72 | if err != nil { |
| 73 | return fmt.Errorf("provisioning CA '%s': %v", DefaultCAID, err) |
| 74 | } |
| 75 | } |
| 76 | |
| 77 | return nil |
| 78 | } |
| 79 | |
| 80 | // ProvisionDefaultCA sets up the default CA. |
| 81 | func (p *PKI) ProvisionDefaultCA(ctx caddy.Context) error { |
| 82 | if p.CAs == nil { |
| 83 | p.CAs = make(map[string]*CA) |
| 84 | } |
| 85 | |
| 86 | p.CAs[DefaultCAID] = new(CA) |
| 87 | return p.CAs[DefaultCAID].Provision(ctx, DefaultCAID, p.log) |
| 88 | } |
| 89 | |
| 90 | // Start starts the PKI app. |
| 91 | func (p *PKI) Start() error { |
| 92 | // install roots to trust store, if not disabled |
| 93 | for _, ca := range p.CAs { |
| 94 | if ca.InstallTrust != nil && !*ca.InstallTrust { |
| 95 | ca.log.Info("root certificate trust store installation disabled; unconfigured clients may show warnings", |
| 96 | zap.String("path", ca.rootCertPath)) |
| 97 | continue |
| 98 | } |
| 99 | |
| 100 | if err := ca.installRoot(); err != nil { |
| 101 | // could be some system dependencies that are missing; |
| 102 | // shouldn't totally prevent startup, but we should log it |
| 103 | ca.log.Error("failed to install root certificate", |
| 104 | zap.Error(err), |
| 105 | zap.String("certificate_file", ca.rootCertPath)) |
| 106 | } |
| 107 | } |
| 108 | |
| 109 | // see if root/intermediates need renewal... |
| 110 | p.renewCerts() |
| 111 | |
| 112 | // ...and keep them renewed (one goroutine per CA with its own interval) |
| 113 | for _, ca := range p.CAs { |
| 114 | go p.maintenanceForCA(ca) |
| 115 | } |
| 116 | |
| 117 | return nil |
| 118 | } |
| 119 | |
| 120 | // Stop stops the PKI app. |
| 121 | func (p *PKI) Stop() error { |
| 122 | return nil |
| 123 | } |
| 124 | |
| 125 | // GetCA retrieves a CA by ID. If the ID is the default |
| 126 | // CA ID, and it hasn't been provisioned yet, it will |
| 127 | // be provisioned. |
| 128 | func (p *PKI) GetCA(ctx caddy.Context, id string) (*CA, error) { |
| 129 | ca, ok := p.CAs[id] |
| 130 | if !ok { |
| 131 | // for anything other than the default CA ID, error out if it wasn't configured |
| 132 | if id != DefaultCAID { |
| 133 | return nil, fmt.Errorf("no certificate authority configured with id: %s", id) |
| 134 | } |
| 135 | |
| 136 | // for the default CA ID, provision it, because we want it to "just work" |
| 137 | err := p.ProvisionDefaultCA(ctx) |
| 138 | if err != nil { |
| 139 | return nil, fmt.Errorf("failed to provision default CA: %s", err) |
| 140 | } |
| 141 | ca = p.CAs[id] |
| 142 | } |
| 143 | |
| 144 | return ca, nil |
| 145 | } |
| 146 | |
| 147 | // Interface guards |
| 148 | var ( |
| 149 | _ caddy.Provisioner = (*PKI)(nil) |
| 150 | _ caddy.App = (*PKI)(nil) |
| 151 | ) |