caddytls: Debug log for ask endpoint

Matthew Holt committed Jan 30, 2023 at 09:30 UTC 0a3efd1641f07ceaa2035cedec1ba43448b2d520

2 files changed +9 -4

modules/caddytls/acmeissuer.go

+8 -2

@@ -495,7 +495,7 @@ func (iss *ACMEIssuer) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {

495 // to see if a certificate can be obtained for name.

496 // The certificate request should be denied if this

497 // returns an error.

498 -func onDemandAskRequest(ask string, name string) error {

498 +func onDemandAskRequest(logger *zap.Logger, ask string, name string) error {

499 askURL, err := url.Parse(ask)

500 if err != nil {

501 return fmt.Errorf("parsing ask URL: %v", err)

@@ -504,13 +504,19 @@ func onDemandAskRequest(ask string, name string) error {

504 qs.Set("domain", name)

505 askURL.RawQuery = qs.Encode()

506

507 - resp, err := onDemandAskClient.Get(askURL.String())

507 + askURLString := askURL.String()

508 + resp, err := onDemandAskClient.Get(askURLString)

509 if err != nil {

510 return fmt.Errorf("error checking %v to determine if certificate for hostname '%s' should be allowed: %v",

511 ask, name, err)

512 }

513 resp.Body.Close()

514

515 + logger.Debug("response from ask endpoint",

516 + zap.String("domain", name),

517 + zap.String("url", askURLString),

518 + zap.Int("status", resp.StatusCode))

519 +

520 if resp.StatusCode < 200 || resp.StatusCode > 299 {

521 return fmt.Errorf("%s: %w %s - non-2xx status code %d", name, errAskDenied, ask, resp.StatusCode)

522 }

modules/caddytls/automation.go

+1 -2

@@ -174,8 +174,7 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {

174 if tlsApp.Automation != nil &&

175 tlsApp.Automation.OnDemand != nil &&

176 tlsApp.Automation.OnDemand.Ask != "" {

177 - err := onDemandAskRequest(tlsApp.Automation.OnDemand.Ask, name)

178 - if err != nil {

177 + if err := onDemandAskRequest(tlsApp.logger, tlsApp.Automation.OnDemand.Ask, name); err != nil {

178 // distinguish true errors from denials, because it's important to log actual errors

179 if !errors.Is(err, errAskDenied) {

180 tlsApp.logger.Error("request to 'ask' endpoint failed",