Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 22:15 UTC
httpcaddyfile: Fix generated config related to ACME global options
If global DNS provider is configured, it does not need to be repeated in the JSON. If acme_* options are used, base automation policies should populate their issuers accordingly. Global issuer settings like acme_* options don't need to specify subjects in the automation policy since they should apply as a global default.
Matthew Holt committed
Aug 4, 2025 at 16:20 UTC
0badb071efc38bb9cc055076f0a48d1725fe8cc8
3 files changed
+21
-13
caddyconfig/httpcaddyfile/tlsapp.go
+20
-2
@@ -571,6 +571,10 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
571
return fmt.Errorf("acme_dns specified without DNS provider config, but no provider specified with 'dns' global option")
572
}
573
}
574
+ acmeIssuer.Challenges = &caddytls.ChallengesConfig{
575
+ DNS: new(caddytls.DNSChallengeConfig),
576
+ }
577
+ } else if globalACMEDNS != nil {
578
acmeIssuer.Challenges = &caddytls.ChallengesConfig{
579
DNS: &caddytls.DNSChallengeConfig{
580
ProviderRaw: caddyconfig.JSONModuleObject(globalACMEDNS, "name", globalACMEDNS.(caddy.Module).CaddyModule().ID.Name(), nil),
@@ -622,12 +626,18 @@ func newBaseAutomationPolicy(
626
_, hasLocalCerts := options["local_certs"]
627
keyType, hasKeyType := options["key_type"]
628
ocspStapling, hasOCSPStapling := options["ocsp_stapling"]
625
-
629
hasGlobalAutomationOpts := hasIssuers || hasLocalCerts || hasKeyType || hasOCSPStapling
630
631
+ globalACMECA := options["acme_ca"]
632
+ globalACMECARoot := options["acme_ca_root"]
633
+ _, globalACMEDNS := options["acme_dns"] // can be set to nil (to use globally-defined "dns" value instead), but it is still set
634
+ globalACMEEAB := options["acme_eab"]
635
+ globalPreferredChains := options["preferred_chains"]
636
+ hasGlobalACMEDefaults := globalACMECA != nil || globalACMECARoot != nil || globalACMEDNS || globalACMEEAB != nil || globalPreferredChains != nil
637
+
638
// if there are no global options related to automation policies
639
// set, then we can just return right away
630
- if !hasGlobalAutomationOpts {
640
+ if !hasGlobalAutomationOpts && !hasGlobalACMEDefaults {
641
if always {
642
return new(caddytls.AutomationPolicy), nil
643
}
@@ -649,6 +659,14 @@ func newBaseAutomationPolicy(
659
ap.Issuers = []certmagic.Issuer{new(caddytls.InternalIssuer)}
660
}
661
662
+ if hasGlobalACMEDefaults {
663
+ for i := range ap.Issuers {
664
+ if err := fillInGlobalACMEDefaults(ap.Issuers[i], options); err != nil {
665
+ return nil, fmt.Errorf("filling in global issuer defaults for issuer %d: %v", i, err)
666
+ }
667
+ }
668
+ }
669
+
670
if hasOCSPStapling {
671
ocspConfig := ocspStapling.(certmagic.OCSPConfig)
672
ap.DisableOCSPStapling = ocspConfig.DisableStapling
caddytest/integration/caddyfile_adapt/acme_dns_naked_use_dns_defaults.caddyfiletest
+1
-8
@@ -34,17 +34,10 @@ example.com {
34
"automation": {
35
"policies": [
36
{
37
- "subjects": [
38
- "example.com"
39
- ],
37
"issuers": [
38
{
39
"challenges": {
43
- "dns": {
44
- "provider": {
45
- "name": "mock"
46
- }
47
- }
40
+ "dns": {}
41
},
42
"module": "acme"
43
}
caddytest/integration/caddyfile_adapt/global_options_preferred_chains.caddyfiletest
-3
@@ -31,9 +31,6 @@ example.com
31
"automation": {
32
"policies": [
33
{
34
- "subjects": [
35
- "example.com"
36
- ],
34
"issuers": [
35
{
36
"module": "acme",